Privacy Policy

1. Who we are

The controller of your personal data is SC CARESTA BAGS SRL, registered office at Str. Alexandru Ioan Cuza nr. 35, Alba Iulia, Alba County, 510191, Romania, Trade Register no. J2011000371010 (formerly J01/371/2011), VAT no. RO28499300 (“CARESTA”, “we”).

For any question about personal data, write to office@carestaofficial.com with the subject “Data protection”. This policy applies to data processed through carestaofficial.com, through orders, through communication with us and through our social media pages.

2. What data we process, why and on what legal basis

Purpose	Data	Legal basis (GDPR)	How long we keep it
Taking, processing and delivering orders; order communications	name, delivery and billing address, e-mail, phone, products ordered, order history	Art. 6(1)(b) – performance of a contract	for the duration of the contract and afterwards according to the legal periods below
Invoicing, accounting and tax records	billing data, transaction amounts	Art. 6(1)(c) – legal obligation	as required by accounting law (usually 5 or 10 years, depending on the document)
Payment	transaction data; card details are processed directly by the payment processor, not by CARESTA	Art. 6(1)(b)	according to accounting periods
Customer account (optional)	name, e-mail, password (encrypted), saved addresses, order history	Art. 6(1)(b)	until the account is deleted or after 3 years of inactivity
Withdrawals, returns, guarantee claims, complaints	order data, content of the request, photos, IBAN (for refunds)	Art. 6(1)(b) and (c)	3 years after resolution (general limitation period)
Replying to messages and requests	name, e-mail, phone, message content	Art. 6(1)(f) – legitimate interest in replying; (b) where related to a contract	2 years from the last message exchanged
Newsletter and e-mail offers	e-mail, name (optional), preferences, interaction with e-mails	Art. 6(1)(a) – consent	until you unsubscribe
Analytics and marketing cookies	browsing data, online identifiers	Art. 6(1)(a) – consent	see the Cookie Policy
Fraud prevention and website security	IP address, device data, transaction data	Art. 6(1)(f) – legitimate interest	up to 1 year; for a suspicious transaction, until the case is resolved
Product safety (safety reports and any recalls)	contact details, product purchased	Art. 6(1)(c) – obligations under Regulation (EU) 2023/988	as long as necessary to investigate the report
Defending our rights in a dispute	data relevant to the dispute	Art. 6(1)(f)	until final resolution

Providing the data needed for an order is a condition for concluding the contract; without it we cannot process and deliver your order. Subscribing to the newsletter is optional and is not a condition for buying.

3. Newsletter and marketing communications

We send you newsletters and offers only if you have subscribed, by ticking the separate dedicated box or completing the sign-up form. Accepting the Terms and Conditions does not subscribe you to the newsletter. You can unsubscribe at any time, free of charge, using the link in each e-mail or by writing to office@carestaofficial.com.

4. Who we share data with

We do not sell your data. We share it only with:

service providers acting on our behalf (processors): the Shopify e-commerce platform, the Shopify Payments payment processor, the Shopify Email marketing service, the hCaptcha service (anti-spam protection for forms), the Revoq service (handling withdrawal requests), hosting and IT providers, the website developer and our accountants;
courier companies Cargus and DHL, for delivery and returns;
public authorities (the Romanian tax authority ANAF, the consumer authority ANPC, courts), where required by law;
analytics and advertising providers: Google (Google Analytics, Google Ads), Meta (Facebook, Instagram) and Pinterest, only if you have consented to the relevant cookies.

5. Transfers outside the European Economic Area

Some providers (Shopify, Google, Meta, Pinterest and hCaptcha) may process data outside the EEA, including in the USA or Canada. In these cases, the transfer is based on a European Commission adequacy decision (for example, the EU–US Data Privacy Framework, for certified companies) or on standard contractual clauses approved by the Commission. You can request information about the applicable safeguards at the address above.

For deliveries outside the EEA, the data needed for delivery is shared with the courier and the customs authorities of the destination country, as this is necessary to perform the contract.

6. Your rights

right of access – to know what data we process and receive a copy;
right to rectification – to correct inaccurate data;
right to erasure – in the cases provided by law;
right to restriction of processing;
right to data portability for data you have provided;
right to object – including, at any time, to direct marketing;
right to withdraw consent at any time, without affecting the lawfulness of earlier processing;
right not to be subject to a decision based solely on automated processing. CARESTA does not make such decisions.

You can exercise your rights by writing to office@carestaofficial.com. We reply within one month, which may be extended by two further months for complex requests, in which case we will inform you.

You have the right to lodge a complaint with the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP) – dataprotection.ro – or with the data protection authority of the country where you live.

7. Data security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS/SSL), restricted access to data, encrypted passwords and providers offering security guarantees. Card details are not stored by CARESTA.