Privacy Policy | Aristo Collection

1. Who we are

The controller of your personal data is LOGICHUS LINE S.R.L., tax identification number RO17760485, registered with the Trade Register under no. J2022000188300, with its registered office at Str. Nicolae Bălcescu nr. 61, sat Păulești, com. Păulești, jud. Satu Mare, cod 447230, România.

For any matter concerning your personal data, write to contact@aristocollection.ro.

We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.

2. What data we collect

Category	Specific data
Identification and contact	First and last name, e-mail address, phone number
Delivery and billing	Delivery address, billing address, county, city, postal code
Company data (for business invoices)	Company name, VAT number, trade register number, registered office
Order	Products ordered, chosen configuration, value, order history, payment status
Account	Password stored as a hash, preferences, wishlist, reviews
Technical	IP address, browser and device type, pages visited, cookies
Correspondence	Messages sent through the contact form or the support system

We do not collect or store your card details. They are entered directly on the payment provider's secure page; the provider acts as an independent controller.

3. Why we process data and on what basis

Purpose	Legal basis	Retention
Processing the order, production and delivery	Performance of a contract – Art. 6(1)(b) GDPR	For the duration of the contract
Issuing and archiving invoices	Legal obligation – Art. 6(1)(c) GDPR (accounting and tax law)	10 years
Managing your user account	Performance of a contract – Art. 6(1)(b) GDPR	Until the account is deleted
Complaints, warranty, returns	Legal obligation and legitimate interest – Art. 6(1)(c) and (f) GDPR	3 years after resolution
Newsletter and commercial communications	Consent – Art. 6(1)(a) GDPR	Until you unsubscribe
Abandoned cart reminders	Legitimate interest – Art. 6(1)(f) GDPR	30 days
Analytics and marketing cookies	Consent – Art. 6(1)(a) GDPR	See the Cookie Policy
Site security, fraud prevention	Legitimate interest – Art. 6(1)(f) GDPR	12 months (logs)
Establishing and defending legal claims	Legitimate interest – Art. 6(1)(f) GDPR	Until the limitation period expires

Providing identification, contact and delivery data is necessary to conclude and perform the contract; without it we cannot process the order. All other data is optional.

4. Who we share data with

The payment processor – to collect and secure the card payment (Stripe Payments Europe Ltd.).
The carrier – name, address and phone number, to deliver the products (FAN Courier Express S.R.L.).
The e-mail service provider – to send order confirmations and notifications.
The SMS service provider – for order status notifications, if you provided a phone number.
The hosting and IT maintenance provider – which keeps the website running.
Accountants and auditors – to meet tax and accounting obligations.
Public authorities – tax authorities, consumer protection bodies, courts, investigating bodies, where the law requires it.

All providers processing data on our behalf do so under processing agreements concluded in accordance with Article 28 GDPR. We do not sell your data and do not share it with third parties for their own marketing.

5. Transfers outside the European Economic Area

Data is hosted on servers within the European Union. If a provider processes data outside the EEA, the transfer takes place only on the basis of an adequacy decision of the European Commission or of the standard contractual clauses adopted by it, with supplementary security measures where appropriate.

6. Your rights

Access (Art. 15) – to find out what data we hold about you and receive a copy.
Rectification (Art. 16) – to correct inaccurate or incomplete data.
Erasure (Art. 17) – the “right to be forgotten”, within the limits of our legal archiving duties.
Restriction of processing (Art. 18).
Data portability (Art. 20) – to receive your data in a structured, commonly used format.
Objection (Art. 21) – including, at any time and without justification, to direct marketing.
Withdrawal of consent (Art. 7(3)) – at any time, without affecting the lawfulness of prior processing.
Not to be subject to automated decision-making (Art. 22). We do not take automated decisions with legal effects and do not carry out profiling.

You can exercise your rights by writing to contact@aristocollection.ro or directly from your account settings. We respond within one month of receiving the request; this may be extended by two months for complex requests, with prior notice to you. Exercising your rights is free of charge.

If you are not satisfied with our response, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, e-mail anspdcp@dataprotection.ro, www.dataprotection.ro. You may also lodge a complaint with the supervisory authority of your own country of residence, and you have the right to an effective judicial remedy.

7. Data security

Encrypted TLS connection across the whole site.
Passwords are stored only as hashes, never in plain text.
CSRF protection on all forms.
Rate limiting of sign-in attempts and blocking of suspicious IP addresses.
Access to data limited to staff who need it for their duties.
Regular backups and restore procedures.

In the event of a personal data breach likely to result in a high risk to your rights, we will inform you without undue delay and notify ANSPDCP within 72 hours, under Articles 33–34 GDPR.

8. Children's data

The site is not intended for persons under 16 and we do not knowingly collect data from them. If you become aware that a minor has provided us with personal data, write to us and we will delete it without delay.

9. Cookies

The use of cookies and similar technologies is described separately in the Cookie Policy, where you can also change your choices.

10. Changes to this policy

We may update this policy. The version in force is always the one published on this page, with the date of the last update shown at the top. For substantial changes we will inform you by e-mail or through a prominent notice on the site.