Legal information

Privacy Policy

Effective from 9 October 2026

This notice explains what personal data we process about you, for what purpose and on what legal basis, to whom we disclose it, how long we keep it, and what rights you have. This notice has been prepared in accordance with the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Law No. 190/2018 on measures implementing Regulation (EU) 2016/679.

1. The controller

  • Vivien Vance S.R.L., 410583 Oradea, Bihor County, Str. S. Vavilov nr. 8, Romania
  • Tax identification number (CUI): RO37077259, Trade Register number: J5/286/2017
  • Email: contact@vivienvance.com
  • Phone: +40 359 630 008
  • We have not appointed a data protection officer; you can contact us with any data protection questions using the contact details above.

For orders placed in the Hungarian and other online stores, the controller is Vivien Vance Kft. (Budapest, Hungary), which has its own privacy policy.

2. What data we process and why

Orders and delivery

Data: name, email address, phone number, shipping and billing address, contents of the order. Purpose: performance of the contract, delivery, communication with you. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Retention: until claims arising from the contract become time-barred (3 years).

Invoicing

Data: name, billing address, tax identification number (if you provide it), purchase details. Legal basis: legal obligation (Article 6(1)(c) GDPR, Accounting Law No. 82/1991). Retention: for the period required by Accounting Law No. 82/1991.

Account (registration)

Data: name, email address, phone number, saved addresses, previous orders. Purpose: faster checkout, managing orders, returns and exchanges. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Retention: until the account is deleted; accounting data for the period stated above.

Customer service and complaints

Data: the data you provide in your enquiry, the order number, the description of the complaint, photos. Legal basis: handling complaints is a legal obligation (Article 6(1)(c) GDPR, Government Ordinance No. 21/1992 on consumer protection); for other enquiries, legitimate interest (Article 6(1)(f) GDPR). Retention: complaints and our responses for 3 years (the general limitation period), other enquiries for 1 year after they are closed.

Newsletter

Data: name, email address. Purpose: sending offers and news. Legal basis: consent (Article 6(1)(a) GDPR), which you can withdraw at any time using the unsubscribe link at the bottom of our emails. Retention: until you unsubscribe.

Push notifications

If you allow it in your browser, we may send you notifications (OneSignal). Legal basis: consent, which you can withdraw at any time in your browser settings.

Cookies, analytics and advertising

Cookies necessary for the online store to function are used without consent. We use analytics and advertising cookies only with your consent (Article 6(1)(a) GDPR); you can change your consent at any time in the cookie settings. A detailed list of cookies is provided in section 7.

3. To whom we disclose your data (processors, recipients)

  • Hosting and online store platform: WebOrigo Magyarország Zrt. (Prodyflow); server: Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro, Italy
  • Payment: Stripe Payments Europe Ltd. (Ireland), Revolut Bank UAB (Lithuania) — card data is processed by them and never reaches us
  • Delivery: the courier or parcel point provider you choose when ordering (the currently available options are shown at checkout) — they receive the data necessary for delivery (name, address, phone number, email address)
  • Invoicing: SmartBill (invoicing software)
  • Accounting: an external accounting firm
  • Analytics and advertising (with consent): Google Ireland Ltd. (Google Analytics, Google Ads), Meta Platforms Ireland Ltd. (Meta Pixel), TikTok Technology Ltd. (TikTok Pixel), Microsoft Ireland Operations Ltd. (Clarity)
  • Push notifications: OneSignal, Inc. (USA)

Some providers (for example Google, Meta, Microsoft and OneSignal) may also process data outside the European Economic Area, primarily in the United States. Such transfers take place on the basis of the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

4. Data security

We receive data over an encrypted connection (HTTPS), restrict access to staff who need it for their work, and contractually require our processors to provide appropriate protection.

5. Your rights

  • Access: you can request information about what data we process about you.
  • Rectification: you can request that inaccurate data be corrected.
  • Erasure: you can request that your data be erased if there is no legal obligation to retain it.
  • Restriction and objection: you can request that processing be restricted, and you can object to processing based on legitimate interest.
  • Data portability: you can request that we provide the data you have given us in a machine-readable format.
  • Withdrawal of consent: for processing based on consent, at any time, without affecting the lawfulness of processing before withdrawal.

We will respond to your request within one month. You can send requests to the email address above or by post.

6. Remedies

If you believe that the processing of your data is unlawful, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București, anspdcp@dataprotection.ro, dataprotection.ro) or with the data protection supervisory authority of the EU Member State where you live or work, or you can go to court; you may also bring proceedings before the court of your place of residence.

7. Cookies

Cookies are small data files stored by your browser. We use the following cookies (as of October 2026):

  • Necessary: XSRF-TOKEN (security), session cookie, cc_cookie (your cookie settings), switch_site_dismissed (region selector).
  • Analytics: _ga, _ga_* (Google Analytics), _clck, _clsk (Microsoft Clarity).
  • Advertising: _gcl_au (Google Ads), _fbp (Meta), _ttp, _tt_enable_cookie, ttcsid* (TikTok).

8. Changes

We update this notice when the law or our processing activities change; the current version is always available on this page.