Privacy policy

1. Who we are

The controller of your personal data is Seeds of Kenosis Design S.R.L., registered at Str. Vasile Alecsandri no. 14, Giarmata, Timiș County, Romania, tax ID (CUI) RO40006371, registered with the Romanian Trade Register under no. J35/3556/2018.

You can contact us by email at contact@massifbeds.com or through the form on our Contact.

2. What data we collect

Depending on how you interact with our website, we collect the following categories of data:

• Identification and contact data: first name, last name, email address, phone number, delivery/billing address.
• Order data: the products ordered, the configurations chosen (sizes, colours, materials), the order value, the payment method (without storing card data — processing is carried out entirely by Netopia Payments).
• Technical data: IP address, browser type, pages visited, traffic source — collected through cookies and analytics tools (Google Analytics).
• Communications: messages sent through the contact form or by email.

We do not collect sensitive data (racial origin, religion, health, political opinions, etc.).

3. Why we collect data and on what legal basis

3.1 Performance of a contract (Art. 6(1)(b) GDPR)

We process your data to process and deliver your order, issue the tax invoice, and handle any returns or complaints. Without this data we cannot fulfil your order.

3.2 Legal obligations (Art. 6(1)(c) GDPR)

We keep financial and accounting documents (invoices, receipts) in line with Romanian tax law (Law 82/1991, the Fiscal Code). This data is retained for 10 years from the date the document was issued.

3.3 Legitimate interest (Art. 6(1)(f) GDPR)

We use anonymised browsing data to improve the website and the shopping experience. We may contact existing customers about similar products or offers, with the option to unsubscribe at any time.

3.4 Consent (Art. 6(1)(a) GDPR)

If you have subscribed to the newsletter or accepted marketing cookies, we process your data on the basis of your consent. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before.

4. How long we keep data

• Order data: 10 years (legal accounting obligation), then deleted.
• Customer account data: for as long as the account exists + 2 years after the last activity, unless you ask for earlier deletion.
• Newsletter data: until you unsubscribe or withdraw consent.
• Analytics cookie data: according to Google Analytics settings (14 months by default).
• Contact messages: 3 years from the last communication.

5. Who we share data with

We do not sell or rent your data. We share it only with the partners needed to run the service:

• Netopia Payments S.A. — online payment processor; card data is handled directly by Netopia, not by us.
• Courier companies (Fan Courier, DPD or another chosen per order) — delivery data (name, address, phone) needed for shipping.
• Google LLC — traffic analysis through Google Analytics (anonymised data / masked IP). Google may transfer data to the US under the EU standard contractual clauses.
• Vercel Inc. — website hosting and infrastructure (technical data / server logs). Transfer to the US under the EU standard contractual clauses.
• Public authorities — only upon express request and with a legal basis (ANAF — the Romanian tax authority, police, etc.).

6. International transfers

Some of our partners (Google, Vercel) process data outside the European Economic Area. These transfers are made under the standard contractual clauses adopted by the European Commission (Art. 46 GDPR), which provide an adequate level of protection.

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — you can ask for a copy of the data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your data, within the limits of our legal obligations (e.g. invoices cannot be deleted before 10 years).
• Right to restriction of processing — you can ask us to limit the use of your data in certain circumstances.
• Right to data portability — you can receive the data you provided to us in a structured, machine-readable format.
• Right to object — you can object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent — at any time, without retroactive effect.

To exercise any of these rights, send a request to contact@massifbeds.com. We will reply within 30 days.

8. Cookies

The website uses technical cookies (needed for it to work) and analytics cookies (Google Analytics, with your consent). You can manage your preferences from the cookie banner shown on your first visit or from your browser settings.

9. Data security

We implement appropriate technical and organisational measures to protect your data: HTTPS connections, restricted access to systems, certified payment-processing partners (Netopia — PCI DSS certified).

10. Changes to this policy

We may update this policy from time to time. The current version is always available on this page, with the date of the last update. Significant changes will be communicated by email to active customers.

11. Supervisory authority

If you believe your data is not being processed correctly, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Website: www.dataprotection.ro
• Address: Bd. G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, Romania
• Email: anspdcp@dataprotection.ro

We’d still encourage you to contact us first at contact@massifbeds.com — we’ll do our best to resolve any issue directly.