LEGAL
Privacy policy
1. Data controller
The personal data controller is Iulia Bălan Atelier, based in Bucharest, Romania. Contact: contact@iuliabalan.ro.
2. What data we collect and why
When you place an order: first and last name, shipping and billing addresses, email, phone number and payment data processed exclusively by Shopify Payments. Legal basis: performance of the contract — Article 6(1)(b) GDPR.
When you subscribe to our newsletter: your email address and express consent. Legal basis: consent — Article 6(1)(a) GDPR. You can withdraw consent at any time through the unsubscribe link in any email or by contacting contact@iuliabalan.ro.
When you use the platform: IP address, browser type, pages visited and session duration, collected through cookies. Legal basis: your consent for analytics and marketing cookies; cookies strictly necessary for the store to function are treated separately.
When you complete the personalisation form: the information provided is used exclusively to process your personalisation request. Legal basis: performance of the contract.
3. How long we keep data
Order and billing data: 5 years from the transaction date, in accordance with tax and accounting obligations.
Newsletter data: until consent is withdrawn.
Browsing data and analytics cookies: up to 13 months.
4. Who receives your data
- Shopify Inc. — e-commerce platform and payment processing, PCI DSS certified.
- DHL Express — courier services; only the data necessary for delivery.
- Fan Courier — for deliveries in Romania.
- Klaviyo Inc. — email marketing platform, only with your consent.
- Meta Platforms — interaction measurement and marketing through Meta Pixel, only when you have permitted both analytics and marketing in your cookie preferences. The returns form is not used for marketing.
- Google LLC — the Google & YouTube channel for the product catalogue. Optional marketing cookies and events require your consent.
Iulia Bălan Atelier does not sell or rent your data.
5. Your rights
Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, portability and objection. To exercise these rights, contact contact@iuliabalan.ro. We reply within 30 days.
If you believe your rights have been infringed, you may lodge a complaint with ANSPDCP: dataprotection.ro.
6. Cookies
We use essential cookies to operate the platform, and analytics and marketing cookies with your consent. You can manage your preferences through the cookie banner on your first visit and subsequently through the 'Cookie preferences' button in the footer, including to withdraw consent.
7. International data transfers
Data transfers to processors outside the EU (Shopify, Klaviyo, Google) are governed by Standard Contractual Clauses approved by the European Commission, ensuring an adequate level of protection.
8. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted communications (SSL/TLS) and restricted access to personal data.