1. Data Controller
CRAMA CASA VRÂNCEANU S.R.L. (trade name: Casa Vrânceanu)
Registered office: Str. Constantin Dobrogeanu Gherea, Nr. 4 bis, Sc. B, Ap. 14, 601040 Onești, Bacău County, Romania
Tax ID (CUI): 25232790
Administrator: Marinela Vrânceanu
Phone: 0740 290 898
Email: cramacasavranceanu@yahoo.com
The controller has not appointed a DPO. Data protection requests should be sent to: cramacasavranceanu@yahoo.com
2. Categories of Personal Data Processed
| Category | Data | Source |
|---|---|---|
| Identification | First name, last name | Order form |
| Contact | Email, phone | Account / Order |
| Shipping | Address, county, city, postal code | Order form |
| Order | Products, quantities, prices, payment method, status | Ordering process |
| Browsing / Cookies | IP address, user agent, cookie preferences, language | Site visit |
| Authentication | Email, session token, OAuth provider (if applicable) | Account login |
3. Processing Purposes
- Contract performance (Art. 6(1)(b) GDPR) — order processing, delivery, invoicing, transactional communications.
- Legal obligation (Art. 6(1)(c) GDPR) — tax invoicing, age verification (Romanian Law 21/1992 — sale of alcoholic beverages), consumer protection compliance.
- Consent (Art. 6(1)(a) GDPR) — direct marketing (newsletter), analytics and marketing cookies. You may withdraw consent at any time.
- Legitimate interest (Art. 6(1)(f) GDPR) — fraud prevention, site security, service improvement.
4. Data Retention
- Active account data — for the duration of the account + 30 days after deletion.
- Order and invoice data — 5 years from transaction date (fiscal obligation under Romanian Tax Code).
- Cookie data — according to the duration of each cookie (see Cookie Policy).
- Marketing data — until consent is withdrawn.
5. Recipients / Processors
Your data may be shared with the following processors, strictly for service provision:
| Processor | Purpose | Location |
|---|---|---|
| Sameday Courier | Order delivery (name, phone, address) | Romania |
| Netopia Payments | Payment processing (tokenized card data, PCI-DSS) | Romania |
| Cloudflare | DNS, CDN, DDoS protection (IP address) | Global (edge), SCC |
| Email processor (pending decision) | Transactional emails (order confirmation, password reset) | EU (selection in progress) |
Application servers (database) are hosted on a self-managed VPS within the EU. We do not transfer data outside the European Economic Area.
6. International Transfers
We do not transfer personal data outside the EU/EEA. Cloudflare operates under Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Your Rights
Under GDPR, you have the following rights:
- Right of access (Art. 15) — you may request a copy of your personal data.
- Right to rectification (Art. 16) — you may correct inaccurate data.
- Right to erasure (Art. 17) — you may request deletion of your data, except where required by legal obligations.
- Right to restriction of processing (Art. 18) — you may request limitation of processing under certain conditions.
- Right to data portability (Art. 20) — you may receive your data in a structured, commonly used format.
- Right to object (Art. 21) — you may object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7) — at any time, without affecting the lawfulness of prior processing.
8. How to Exercise Your Rights
Send an email to cramacasavranceanu@yahoo.com with the subject "GDPR Request". We will respond within 30 days.
9. Complaint to Supervisory Authority
If you believe your data processing violates GDPR, you have the right to lodge a complaint with:
National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, 010336, Romania
Phone: +40 318 059 211
Email: anspdcp@dataprotection.ro
Website: www.dataprotection.ro
10. Cookies
We use cookies in accordance with our Cookie Policy. You can manage your preferences via the cookie banner or your browser settings.
11. Policy Changes
We reserve the right to update this policy. Any substantial changes will be communicated via email or site notification. The date of the last update is indicated at the top of this page.
Ultima actualizare: 08.05.2026