Privacy Policy (GDPR)

Privacy policy

Protecting your personal data is a fundamental commitment of altamag.ro. We process data in full compliance with Regulation (EU) 2016/679 ("GDPR") and applicable Romanian legislation. This document transparently explains what data we collect, why, how long we retain it, who we share it with, and what rights you have.

We reserve the right to periodically update this policy; the current version, with the date of the last update, is permanently published on the website. We recommend checking it periodically.

1. Who we are and how you can contact us

The controller of your personal data is ALTANET S.R.L., a Romanian legal entity, with its registered office at Strada Caracal no. 162, Craiova, Dolj County, registered with the Trade Register under no. J16/1373/2003, CUI RO15748710 — the operator of the altamag.ro online store.

For any questions or requests regarding your personal data, you can contact us:

By email: [email protected] (with the subject line "Data Protection")
By mail or courier: Strada Caracal no. 162, Craiova, Dolj, 200745 — for the attention of the Data Protection Officer
By phone: +40 351 444 444 (Monday–Friday, 09:00–17:00)

2. Categories of personal data we process

We collect data directly from you, ensuring you remain in control of the information provided:

When creating an account: email address, first and last name, password (stored encrypted).
When placing an order: first and last name, delivery address, billing address and details (including company details for legal entities), phone number, email address, ordered products, selected payment method.
When paying by card: card details are collected and processed exclusively by the Stripe payment processor; Altamag does not store or have access to full card numbers.
When using the contact form, return request, or service inquiries: provided identification and contact details, order/invoice number, and request content.
When subscribing to the newsletter: email address.
When browsing the site: IP address, technical device and browser details, browsing behavior — collected via cookies and similar technologies, as detailed in our Cookie Policy.

We do not collect or process sensitive data (special categories of data under GDPR). We do not intentionally process data of minors under 16 years of age; accounts can only be created by individuals at least 18 years old.

3. Purposes and legal bases for processing

a) Providing altamag.ro services

Creating and managing the account; processing, validating, dispatching, and invoicing orders; providing order status updates; handling cancellations, returns, and refunds; offering customer support; managing warranty and service requests.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for invoicing and record-keeping — legal fiscal and accounting obligations (Art. 6(1)(c) GDPR).

b) Marketing

Sending newsletters and commercial communications (offers, new products, articles) via email.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in any email or by contacting [email protected]; withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

c) Improving services

Analyzing website usage, traffic statistics, catalog improvements, and shopping experience optimization.

Legal basis: our legitimate interest to develop our commercial operations (Art. 6(1)(f) GDPR), always ensuring your rights and freedoms are protected; for analytics cookies — your consent.

d) Protecting our legitimate interests

Security measures to protect the website and users against cyberattacks; preventing and detecting fraud attempts, including sharing information with competent public authorities; establishing, exercising, or defending legal claims.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) or legal obligations.

4. Data retention period

Account-related data: retained while the account is active; upon account deletion request, data is erased or anonymized, subject to statutory exceptions below.
Financial and accounting documents (invoices, order data): retained for the duration required by tax and accounting legislation (currently, as a general rule, 5 years following the end of the financial year).
Warranty-related data: retained for the duration of the applicable legal or commercial warranty.
Newsletter email address: retained until consent is withdrawn.

5. Data disclosures to third parties

We disclose data, strictly to the extent necessary, to:

Courier companies (Fan Courier, Sameday): name, phone, delivery address, cash-on-delivery amount, for order delivery;
Stripe payment processor: for processing card payments;
IT service providers (hosting, maintenance, email platforms): under contracts ensuring confidentiality and data protection;
Manufacturers/Authorized service centers: when necessary to fulfill warranty claims;
Public authorities: when required by a legal obligation or to defend a legitimate interest.

We do not sell or rent your personal data to third parties. We ensure third-party access complies with data protection laws under executed contracts.

6. International data transfers

As a rule, data is stored and processed within the European Union / European Economic Area (EEA). If certain services (e.g., payment processing or analytics tools) involve transfers outside the EEA, they occur only under adequate safeguards pursuant to Arts. 44–49 GDPR: European Commission adequacy decisions or Standard Contractual Clauses, alongside supplementary measures where necessary.

7. How we secure data

We implement appropriate technical and organizational measures: encrypted website communications (HTTPS/TLS), encrypted password storage, access restricted on a need-to-know basis, backups, and internal security procedures. Online payments are processed via Stripe with industry-standard encryption (PCI DSS). However, internet transmissions cannot be guaranteed as completely immune to unauthorized third parties.

8. Your rights

Under GDPR, you benefit from the following rights:

Right of access: to obtain confirmation of data processing and a copy of your data;
Right to rectification: to correct inaccurate or incomplete data;
Right to erasure ("right to be forgotten"): under Art. 17 GDPR; certain data may be retained where required by law (e.g., fiscal laws);
Right to restriction of processing: under Art. 18 GDPR;
Right to data portability: to receive data in a structured, commonly used, machine-readable format;
Right to object: including objecting at any time and without justification to direct marketing processing;
Right not to be subject to automated decision-making: producing legal effects or significantly affecting you;
Right to lodge a complaint with the supervisory authority and seek judicial remedy.

To exercise these rights, submit a request to [email protected], preferably from the email address associated with your account. We respond within one month; in complex cases, this may be extended by up to two months with prior notification. Exercising rights is free of charge.

9. Supervisory authority

You have the right to lodge a complaint with:

National Authority for Quality and Data Protection Supervision (ANSPDCP)
B-dul G-ral. Gheorghe Magheru no. 28–30, Sector 1, postal code 010336, Bucharest
Phone: +40 318 059 211 / +40 318 059 212 · Email: [email protected] · dataprotection.ro

We encourage you to contact us first — we will make every effort to resolve any concern amicably.

ALTANET S.R.L. · Strada Caracal no. 162, Craiova, Dolj · CUI RO15748710 · J16/1373/2003
Email: [email protected] · Phone: +40 351 444 444