Privacy Policy

Privacy Policy

Last updated: June 2026

Maison Noéthra respects your right to privacy and is committed to protecting your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

1. Data Controller

The data controller is Maison Noéthra. For any requests related to your personal data, please contact us at the email address indicated on the website.

2. What Data We Collect

We collect the following categories of personal data:

  • Identification data: first name, last name
  • Contact data: email address, phone number, delivery/billing address
  • Transaction data: order history, purchased products, payment methods (no full card details stored)
  • Technical data: IP address, browser type, pages visited, session duration (via cookies)

3. Purpose and Legal Basis for Processing

  • Performance of a contract (Art. 6(1)(b) GDPR): processing orders, delivery, invoicing
  • Legal obligations (Art. 6(1)(c) GDPR): retention of accounting documents under Romanian law
  • Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention, website security
  • Consent (Art. 6(1)(a) GDPR): sending marketing communications, use of non-essential cookies

4. Data Retention

We retain your data for as long as necessary for the purposes stated or as required by legal obligations (e.g., fiscal documents are retained for 10 years under Romanian law).

5. Recipients of Data

Your data may be shared with:

  • Courier and logistics service providers
  • Payment processors (Shopify Payments and other authorised processors)
  • IT and hosting service providers (Shopify Inc., USA — with adequate GDPR safeguards)
  • Public authorities, upon lawful request

6. International Data Transfers

Some service providers (e.g., Shopify Inc.) are based in the USA. Transfers are carried out with appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

7. Your Rights

Under GDPR, you have the following rights:

  • Right of access — to request a copy of the data we process
  • Right to rectification — to correct inaccurate data
  • Right to erasure ("right to be forgotten")
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw consent at any time

To exercise these rights, please contact us at the email address on the website. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

8. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction.

This policy is for general informational purposes. We recommend consulting a data protection specialist to adapt it to your specific business activity.