Privacy Policy
Last updated: October 2026
1. Data Controller
The data controller responsible for your personal data is:
- Legal name: Soare M.N.B. I.I.
- Trade name: Daos's Pure Herbs
- CIF (Tax ID): 35982498
- Trade Registry: F40/713/2016
- Address: Dinicu Golescu 31, Bucharest, 010866, RO
- Email: daospureherbs.eu@gmail.com
2. What Personal Data We Collect
We collect the following categories of personal data:
2.1 Data you provide directly
- Account registration: name, email address, password and, optionally, phone number
- Orders: full name, shipping address, billing address, phone number, email
- Contact form: email address, message content
- Withdrawal from the contract: name, email address, order number and the details you write in the withdrawal form
2.2 Data collected automatically
- Technical data: IP address, browser type and version, operating system, device type
- Cookies: only cookies that are strictly necessary for the site to work (see Section 7)
2.3 Payment data
Payment card details are processed directly by Stripe (our payment processor) and are never stored on our servers. Stripe processes your data in accordance with their own privacy policy and PCI DSS standards.
3. Why We Process Your Data (Legal Basis)
| Purpose | Legal Basis (GDPR) |
|---|---|
| Processing and fulfilling your orders | Contract performance (Art. 6(1)(b)) |
| Creating and managing your account | Contract performance (Art. 6(1)(b)) |
| Sending order confirmations and shipping updates | Contract performance (Art. 6(1)(b)) |
| Responding to your enquiries via contact form | Legitimate interest (Art. 6(1)(f)) |
| Complying with tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Preventing fraud | Legitimate interest (Art. 6(1)(f)) |
| Receiving and confirming your withdrawal from the contract | Legal obligation (Art. 6(1)(c)) |
4. Who We Share Your Data With
We share your personal data only with the following categories of recipients, and only to the extent necessary:
- Stripe — payment processing (card, Apple Pay, Link, Bancontact, EPS)
- Shipping carriers — to deliver your orders
- Hetzner Online GmbH — website hosting (servers located in the EU)
- Google — Gmail, for sending the shop's emails (such as order confirmations and password resets) and receiving the messages you send through the contact form; and Google Maps, only if you choose to show the map on the contact page, in which case it receives your IP address
- ipapi.co (Kloudend, Inc., United States) — when you open an address of the website that does not contain a language (for example a page that does not exist) and your browser does not have the site's language cookie yet, the website asks ipapi.co which country you are in, to suggest the Romanian version; ipapi.co receives your IP address
We do not sell, rent, or trade your personal data to third parties.
5. International Data Transfers
Your data is primarily processed within the European Economic Area (EEA). Our hosting provider (Hetzner) operates servers in the EU.
Some of the providers listed in section 4 may process personal data outside the EEA, in particular in the United States. Personal data processed by Stripe is transferred to Stripe, LLC in the United States on the basis of the EU-U.S. Data Privacy Framework, under which Stripe, LLC is certified, or, where it does not apply, the European Commission's Standard Contractual Clauses. Google states that, for users in the EEA, the controller of their data is Google Ireland Limited, and that Google LLC is certified under the EU-U.S. Data Privacy Framework and that it relies on Standard Contractual Clauses where transfers are not covered by an adequacy decision. ipapi.co is operated by Kloudend, Inc. in the United States; its privacy policy states that transfers outside the EEA are governed by Standard Contractual Clauses, as set out in its data processing agreement.
6. How Long We Keep Your Data
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account, plus 30 days |
| Order and invoice data | 10 years (Romanian fiscal obligations) |
| Contact form messages | 12 months after resolution |
7. Cookies
Our website uses only cookies that are strictly necessary for it to work. We do not use analytics or marketing cookies.
You can view this information at any time by clicking the "Cookie Settings" link in the footer.
Types of cookies we use:
| Category | Purpose | Consent Required |
|---|---|---|
| Essential | Session, shopping cart, security, the site language, your wishlist and your choice in the cookie banner; on the payment page, the payment security cookies set by Stripe | No (strictly necessary) |
8. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15) — request a copy of your personal data
- Right to rectification (Art. 16) — correct inaccurate data
- Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten")
- Right to restriction (Art. 18) — restrict processing in certain circumstances
- Right to data portability (Art. 20) — receive your data in a machine-readable format
- Right to object (Art. 21) — object to processing based on legitimate interest
- Right to withdraw consent (Art. 7(3)) — withdraw consent at any time (without affecting prior processing)
To exercise any of these rights, contact us at daospureherbs.eu@gmail.com. We will respond within 30 days.
9. Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP):
- Name: Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal
- Website: www.dataprotection.ro
- Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, 010336, Romania
- Phone: +40 318 059 211
- Email: anspdcp@dataprotection.ro
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- SSL/TLS encryption for all data in transit
- Secure payment processing via Stripe (PCI DSS compliant)
- Access controls and authentication for administrative areas
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.
12. Contact
For any questions about this Privacy Policy or your personal data, please contact:
- Email: daospureherbs.eu@gmail.com
- Address: Dinicu Golescu 31, Bucharest, 010866, RO