Privacy Policy

• Name: EXI Moments (Szilveszter Izolda-Hajnalka egyéni vállalkozó)
• Address: Sovata, județul Mureș, România
• E-mail: ervinxizolda@gmail.com

The scope and volume of data processed does not meet the threshold in GDPR Art. 37 for mandatory DPO appointment; no DPO has been designated. For any data protection question, please contact the controller directly.

Data: name, phone, e-mail, delivery address, ID / CNP, reserved period.

Legal basis: GDPR Art. 6(1)(b) — performance of a contract.

Retention: 10 years from contract end (Romanian Fiscal Code Art. 25).

Data: name, address, ID/CNP, VAT number (optional, B2B), amounts paid.

Legal basis: GDPR Art. 6(1)(c) — legal obligation.

Retention: 10 years.

Data: the above + complaint content and correspondence.

Legal basis: GDPR Art. 6(1)(c) (consumer protection) and (f) (legitimate interest in defending legal claims).

Retention: 3 years from complaint closure.

Data: session ID (first-party cookie), IP hash, user agent, timestamp, version.

Legal basis: GDPR Art. 6(1)(c) — demonstrable consent under Romanian Law 506/2004 (e-Privacy); partly (f) legitimate interest.

Retention: 1 year.

Data: session ID, page visited, event type (click, form interaction), timestamp, IP hash (SHA-256).

Legal basis: GDPR Art. 6(1)(a) — consent (cookie banner).

Retention: 90 days, then automatic deletion.

Raw IPs are never stored — only server-salted hashes.

Data: administrator actions, timestamp, IP.

Legal basis: GDPR Art. 6(1)(c) and (f) — security and accountability.

Retention: 3 years, then anonymised.

The controller does not send marketing messages. Any future marketing activity will begin only after separate consent, which can be withdrawn at any time.

The controller uses the following processors under Data Processing Agreements (DPAs), with EU-hosted infrastructure:

• Supabase Inc. — database and file storage (EU, Frankfurt).
• Vercel Inc. — web hosting and service worker (EU).
• Resend (Resend Inc.) — transactional e-mail (EU).

All processors run EU-hosted, so personal data does not leave the EU. Should this change in the future, users will be informed in advance and the controller will apply the safeguards in GDPR Art. 46-49 (Standard Contractual Clauses).

Personal data is not shared with third parties, except when required by law (court order, ANPC, ANAF, ANSPDCP or other competent authority).

• Access (Art. 15).
• Rectification (Art. 16).
• Erasure (Art. 17), subject to statutory retention.
• Restriction (Art. 18).
• Portability (Art. 20).
• Objection (Art. 21) — for legitimate-interest processing.
• Withdrawal of consent (Art. 7) — analytics, marketing.
• Not to be subject to automated decisions / profiling (Art. 22) — currently not used.

To exercise any right, e-mail ervinxizolda@gmail.com. The controller will respond within 15 days.

You may lodge a complaint with the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — B-dul G-ral. Gheorghe Magheru 28-30, București 010336, tel. +40 318 059 211, e-mail: anspdcp@dataprotection.ro, dataprotection.ro.

Name, e-mail, phone, delivery address and ID/CNP are requiredto conclude and perform the rental contract. Without them, the service cannot be provided. Analytics and marketing processing are optional.

This policy is reviewed periodically. The current version is always available on this page. If a material change is made, users will be notified separately.