Politica de confidentialitate

Last update: September 9, 2026.

1. Data Controller

Edelnova Studio SRL (Dahlia brand), Piața Eroilor no. 9, 515100 Abrud, Alba County, Tax ID 55238108, Trade Reg. No. J2026044951007, e-mail: office@dahlia.ro, phone: 0745 553 388. We process your data in accordance with Regulation (EU) 2016/679 (GDPR).

2. What data we collect

First name, last name, delivery/billing address, e-mail, phone number, order details and, where applicable, technical data (IP address, cookies, browser type, operating system, screen resolution, visited pages). We do not store card details; these are processed directly by Netopia Payments.

3. Data of minors

Our services are not intended for persons under 16 years of age. We do not knowingly collect personal data from minors. If you discover that a minor has provided us with personal data without the consent of a parent or legal guardian, please contact us at office@dahlia.ro and we will delete this data as soon as possible (Art. 8 GDPR, 16-year threshold according to Romanian law).

4. Purpose and legal basis of processing

Performance of a contract (Art. 6(1)(b) GDPR): order processing, delivery, order-related communications. Legal obligation (Art. 6(1)(c) GDPR): invoicing, accounting records. Consent (Art. 6(1)(a) GDPR): newsletter and marketing communications (only with your explicit consent, which you can withdraw at any time). Legitimate interest (Art. 6(1)(f) GDPR): website improvement, traffic analysis, fraud prevention.

Providing personal data (name, address, phone, e-mail) is necessary for the performance of the sales contract. Without this data, we cannot process and deliver the order.

5. How long we keep the data

For as long as necessary for the above purposes. Accounting/tax documents are kept for 10 years according to the law. Marketing data is deleted upon withdrawal of consent. Inactive account data (without orders or login) is anonymized after 3 years of inactivity.

6. Who we share data with

We share your data only with partners strictly necessary to fulfill the stated purposes:

Courier services: Sameday, Cargus, FAN Courier (name, address, phone, for delivery).

Payment processor: Netopia Payments (transaction data; card details are processed directly by Netopia, not by us).

E-commerce platform: Shopify Inc. (Canada/USA), which hosts our online store (Shopify policy).

Traffic analysis: Google Analytics (Google LLC, USA), for anonymized statistical analysis regarding site traffic (Google policy).

Advertising: Meta Pixel (Meta Platforms Ireland Ltd.), for measuring advertising campaign performance and remarketing, based on your consent via the cookie banner (Meta policy).

Email marketing: Shopify Email, for sending newsletters and marketing communications, based on your consent.

Public authorities: in exceptional situations, we may be required to transmit personal data to the ANAF (National Tax Agency), police authorities, prosecutor's office, or courts of law, based on a legal obligation (Art. 6(1)(c) GDPR).

We do not sell or share your data with third parties for their own marketing purposes.

7. International transfers

Some of our processors store or process data outside the European Economic Area:

Shopify Inc. (Canada/USA): transfer based on the European Commission's adequacy decision for Canada and EU-approved standard contractual clauses for the USA.

Google LLC (USA): transfer based on the EU-US Data Privacy Framework and standard contractual clauses.

Meta Platforms (USA): transfer based on the EU-US Data Privacy Framework and standard contractual clauses.

In all cases, a level of protection equivalent to that of the European Economic Area is ensured.

8. Profiling and automated decision-making

We do not make decisions based solely on automated processing that produce legal effects or significantly affect you (Art. 22 GDPR). We use analysis tools (Google Analytics, Meta Pixel) for aggregated statistics on traffic and campaign performance, not for individual profiling that affects you.

9. Data security

We apply appropriate technical and organizational measures to protect your data: secure connection (SSL/TLS) throughout the site, restricted access to personal data, secure passwords, and payment processing through a PCI DSS certified intermediary (Netopia Payments). We periodically evaluate these measures and update them according to risks.

10. Your rights

According to the GDPR, you have the right to: access your data (Art. 15), rectification (Art. 16), erasure ("right to be forgotten", Art. 17), restriction of processing (Art. 18), portability (receive data in a structured format, Art. 20), object (Art. 21), and the right not to be subject to an automated decision (Art. 22). You can withdraw your consent for marketing at any time.

To exercise your rights, write to us at office@dahlia.ro. We will respond within one month. In complex cases, the term may be extended by another two months, with prior notification.

If you believe your data is not being processed correctly, you can contact the ANSPDCP (National Supervisory Authority for Personal Data Processing): dataprotection.ro, Bd. G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest.

11. Policy changes

We reserve the right to update this privacy policy at any time to reflect changes in our practices or applicable legislation. The date of the last update is displayed at the top of this page. We encourage you to periodically check this page. Substantial changes will be communicated via e-mail or a notice on the site.