Privacy policy

Kinzello respects the privacy of its visitors and customers. This document describes what data we collect, why, how we use it and what rights you have. It has been drawn up in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law 190/2018.

1. The data controller

Kinzello, tax ID (CUI) pending registration, Trade Register no. pending registration, with its registered office in Atelier · Suceava, Scueava, România. Contact: contact@kinzello.com / +40 740 563 227.

2. What data we collect

We process the following categories of data:

• Identification and contact details (first name, last name, email, phone) — provided when you place an order, subscribe to the newsletter or contact us.
• Delivery details (address, city, county, postal code) — needed to ship the products.
• Order details (products ordered, personalisation, history) — generated automatically when you place an order.
• Technical data (IP address, browser type, device, pages visited) — collected automatically through strictly necessary cookies and, with your consent, through analytics cookies. Full details in our Cookie policy.
• Photos uploaded for an order — stored only to generate previews of the personalised product and to fulfil your order. They are not used for any other purpose.

We do not collect sensitive data (racial or ethnic origin, political opinions, health, biometric data, sexual orientation) unless you disclose it voluntarily in a message to us — in which case we process it only to reply to your message.

3. Why we process this data (purposes and legal bases)

4. How long we keep data

• Order and invoicing data: 10 years, as required by Romanian Accounting Law 82/1991.
• User account (if any): until you delete the account or after 3 years of inactivity.
• Newsletter: until you unsubscribe.
• Photos uploaded for an order: 90 days after the order is completed, then deleted automatically. If no order is placed, they are deleted after 30 days.
• Cookies: see the specific duration in our Cookie policy.
• Technical logs: up to 12 months for security and troubleshooting.

5. Who we share data with

We do not sell or rent your data. We share it with the following processors, only to the extent strictly necessary:

• Couriers (Fan Courier, Sameday, DPD or similar) — name, address and phone number for delivery.
• Hosting / infrastructure provider — the servers running the website and database; located in the EU.
• Transactional email provider — for order confirmations and the newsletter (e.g. Resend, SendGrid or similar).
• Our accountant — for tax obligations (invoices, returns).
• Public authorities — in case of legal requests (ANAF, courts, ANPC).

All processors have signed data processing agreements under Art. 28 GDPR and are bound to keep your data confidential.

6. Transfers outside the EU

Our infrastructure is located in the EU. Certain services (e.g. Google Fonts web fonts, or the analytics platform if enabled with your consent) may involve transfers outside the EU. In such cases, transfers rely on standard contractual clauses approved by the European Commission or on adequacy decisions.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access — to know what data we hold about you.
• Right to rectification — to correct inaccurate data.
• Right to erasure (“right to be forgotten”) — to ask for your data to be deleted, subject to legal exceptions (e.g. invoices).
• Right to restriction — to ask for processing to be paused in certain cases.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to processing based on legitimate interest or for direct marketing.
• Right to withdraw consent — at any time, for processing based on consent; withdrawal does not affect the lawfulness of earlier processing.
• Right to lodge a complaint with ANSPDCP — the Romanian data protection authority: dataprotection.ro.

To exercise any of these rights, write to us at contact@kinzello.com. We will reply within 30 days, free of charge. We may ask for additional information to verify your identity, strictly to protect your data.

8. Security

We use appropriate technical and organisational measures to protect your data: role-based access, encrypted connections (HTTPS/TLS), regular backups, hashed passwords and up-to-date servers. If a security breach affects your rights, we will notify you within 72 hours in accordance with Articles 33–34 GDPR.

9. Minors

The site is not intended for people under 16. We do not knowingly collect data from minors. If you are under 16, please use the site only with the consent of a parent or legal guardian.

10. Changes

This policy may be updated. The applicable version is the one shown here, with its “effective from” date. Substantial changes will be communicated to you if you have given us your contact details.