Privacy policy
Updated: 30.09.2026
This policy explains how we process the personal data of customers and visitors of the bagstodoor.ro online shop, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
1. Data controller
ELECTRIC S.R.L., registered office at B-dul București nr. 16A, Focșani, Vrancea County, Romania, tax ID RO1447920, Trade Register No. J39/559/1991, is the controller of the data processed through the Bags to Door shop.
Data protection contact: [email protected], phone +40 730 524 129, or by post to the registered office address, marked "Data protection".
2. What data we process, why and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Taking, fulfilling and delivering orders, order communications | name, email, phone, delivery address, products ordered, order history | Art. 6(1)(b), performance of a contract |
| Invoicing and accounting records | name or company name, tax ID, trade register number, billing address, transaction value | Art. 6(1)(c), legal obligation (tax and accounting law) |
| Card payment | transaction identifier, amount, payment status (card data is processed only by the payment processor) | Art. 6(1)(b), performance of a contract |
| Customer account | email, password (stored encrypted), saved billing and delivery details, order history | Art. 6(1)(b), performance of a contract at your request |
| Quote requests and custom orders | name, company, email, phone, request details, artwork files sent | Art. 6(1)(b), pre-contractual steps at your request |
| Returns, warranty and complaints | order details, description of the problem, photos, IBAN for refunds where needed | Art. 6(1)(c), legal obligation, and Art. 6(1)(b), performance of a contract |
| Stock alerts | email, product followed | Art. 6(1)(a), consent |
| Newsletter | email, name (optional), preferences | Art. 6(1)(a), consent |
| Product reviews | display name, review text and rating, date, link to the order | Art. 6(1)(a), consent when publishing the review |
| Site security, fraud prevention, access logs | IP address, date and time, page accessed, browser type, login events | Art. 6(1)(f), legitimate interest in protecting the site and customers |
| Website usage statistics | online identifiers (cookies), pages visited, aggregated device data | Art. 6(1)(a), consent via the cookie banner |
| Online marketing (Meta, Google Ads) | online identifiers (cookies), site events | Art. 6(1)(a), consent via the cookie banner |
| Establishing or defending legal claims | data relevant to the dispute | Art. 6(1)(f), legitimate interest |
Providing the data needed for ordering and invoicing is required to conclude the contract; without it we cannot process the order. All other data is optional.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you.
3. Recipients of the data
We share data only as far as necessary for the purpose:
| Category | Recipient | What they receive |
|---|---|---|
| Couriers | FAN Courier, Sameday; for pallet or international deliveries, the carrier stated in the quote | name, phone, delivery address, cash on delivery amount where applicable |
| Payment processor | the authorised card payment processor shown on the payment page | the data needed to authorise the payment |
| Hosting and infrastructure | the website hosting provider | all data stored in the shop, as a processor |
| the transactional email service provider and, if you subscribe, the newsletter service provider | email, name, message content | |
| Statistics and tags | Google Ireland Limited (Google Analytics 4, Google Tag Manager), only after consent | online identifiers, usage data |
| Anti-spam protection | Google (reCAPTCHA), if enabled on forms | technical data about the device and interaction |
| Marketing | Meta Platforms Ireland Limited, Google Ireland Limited (Google Ads), only after consent | online identifiers, site events |
| Accounting and advisers | accountants, auditors, legal advisers bound by confidentiality | the data needed for their service |
| Authorities | ANAF (tax authority), ANPC, courts and other public authorities, where required by law | the data lawfully requested |
Processors handle data only on our instructions and under a contract that complies with Article 28 GDPR. We do not sell personal data.
4. Transfers outside the European Economic Area
Some providers (for example Google and Meta) may transfer data to the United States or other countries outside the EEA. These transfers are based on the adequacy decision for the EU-U.S. Data Privacy Framework, for certified companies, or on the standard contractual clauses approved by the European Commission, with supplementary measures where needed. You can ask for information about the safeguards applied using the contact details above.
5. How long we keep data
| Data category | Retention period |
|---|---|
| Accounting documents (invoices, supporting documents) | 10 years from the end of the financial year, under Romanian Accounting Law no. 82/1991 |
| Order, return and complaint data | for the duration of the contract and 3 years afterwards (general limitation period), unless a longer legal period applies |
| Customer account | until the account is deleted; accounts inactive for 3 years are deleted after prior notice by email |
| Quote requests with no order | 3 years from the last communication |
| Stock alerts | until the alert is sent or you unsubscribe, and no longer than 12 months |
| Newsletter | until consent is withdrawn (unsubscribe) |
| Reviews | while the review is published or until you ask for deletion |
| Security logs | 12 months |
| Statistical data in Google Analytics | up to 14 months, per the Google Analytics retention setting |
| Proof of cookie consent | 12 months, after which you are asked again |
When these periods expire, data is deleted or anonymised.
6. Your rights
Under the GDPR you have the following rights:
- right of access to your data;
- right to rectification of inaccurate data;
- right to erasure, in the cases provided by law;
- right to restriction of processing;
- right to data portability for data you provided, processed on the basis of a contract or consent;
- right to object to processing based on legitimate interest;
- right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (for example via the unsubscribe link in emails or the "Setări cookie-uri" (Cookie settings) link in the site footer);
- right not to be subject to a decision based solely on automated processing.
To exercise your rights, write to [email protected]. We reply within one month of receiving the request; this may be extended by two further months for complex requests, in which case we will inform you. We may ask for additional information to confirm your identity.
You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, https://www.dataprotection.ro, or with the supervisory authority in your EU country of residence.
7. Data security
We use encrypted connections (HTTPS), role-based access to customer data, encrypted password storage and backups. Card data is not stored by the shop. No system is completely risk-free; if a personal data breach is likely to result in a high risk to you, we will inform you as required by law.
8. Minors
The shop is not intended for persons under 16 and we do not knowingly collect their data.
9. Changes
We may update this policy. The version in force is published on this page with the date of the last update. For significant changes, we will also inform you by email if you have an account or are subscribed.
Last updated: 25 September 2026.