Privacy policy
This is a translation for information purposes. In case of differences, the Romanian version prevails. Romanian version
Last updated: 24.09.2026.
1. Who processes the data
The data controller is ElectroPiese SRL, CUI RO47995637, J2023007204408, with its registered office at Str. Colnicului nr. 2, Sector 4, București, 041252 (“EPDirect”, “we”). You can contact us with any question about your data at contact@epdirect.ro or 0753 55 77 11. We are not required to appoint a data protection officer (DPO); requests are handled directly by us.
2. What data we process and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Contact form / “Can't find the part” | name, phone, email, appliance model, message | to reply to you and find the right part | art. 6 alin. (1) lit. b) (Art. 6(1)(b)) – steps prior to a contract, at your request |
| “Send a photo of the label” | name, phone, photo of the appliance's rating label | identifying the compatible part | art. 6 alin. (1) lit. b) |
| Orders | name, phone, email (optional), delivery address, billing details (for companies: name, CUI, Trade Register no., registered office), products ordered, payment | phone confirmation of the part, delivery, invoicing, guarantee | art. 6 alin. (1) lit. b) – performance of the contract; lit. c) – legal obligations (tax, accounting, consumer protection) |
| Preventing uncollected orders | the phone number, email and delivery address from orders that were confirmed but refused or not collected from the courier | additional verification or refusal of future online orders with the same details (you can still place them by phone/WhatsApp) | art. 6 alin. (1) lit. f) (Art. 6(1)(f)) – legitimate interest in avoiding losses on return shipping; kept for 2 years at most |
| Customer account (optional) | name, email, phone, password (stored only in encrypted, irreversible form), saved addresses, order history, favourite products, loyalty points and Wallet credit, bank account for refunds (IBAN and bank), saved shopping basket, sign-in history (IP, browser, 90 days) | access to orders, invoices, AWBs and returns; automatic completion of orders | art. 6 alin. (1) lit. b) – the account contract, at your request |
| Sign-in with Google (optional) | your name, email address and Google account identifier, received from Google only when you choose “Continue with Google” | creating the account and signing in without a password | art. 6 alin. (1) lit. b) – at your request |
| Returns | the order, the returned parts, the reason, the IBAN for the refund | processing the return and refunding the money | art. 6 alin. (1) lit. b) and c) – contract and legal obligations |
| Company details from CUI | the CUI entered; the company's public details are retrieved from the ANAF public service | automatic completion of billing details | art. 6 alin. (1) lit. b) – at your request |
| WhatsApp messages | phone number, profile name, messages and photos sent | to reply to you | art. 6 alin. (1) lit. b) |
| Browsing the site | technical data (IP address, browser type, pages visited) in the server logs | operation and security of the site, preventing abuse | art. 6 alin. (1) lit. f) – legitimate interest |
| Analytics / marketing cookies (only if enabled) | online identifiers, interactions with the site | statistics, measuring ads | art. 6 alin. (1) lit. a) (Art. 6(1)(a)) – your consent, which you can withdraw at any time |
We do not take decisions based solely on automated processing and we do not create profiles with legal effects on you. We do not sell your data.
3. Who we share the data with
Only with the partners we need in order to reply to you or deliver your order, on the basis of a contract and only with the strictly necessary data:
- the web hosting provider (the servers the site runs on);
- our parts supplier in the European Union – only the delivery details, when the part is sent directly to you;
- the courier company – name, phone, delivery address, cash-on-delivery amount;
- the card payment processor (the bank) – you enter your card details directly on the bank's secure page; they never reach us;
- the invoicing software (Oblio) and our accountant – the details on the invoice;
- WhatsApp (Meta Platforms Ireland Ltd.) – only if you message us on WhatsApp;
- Google Ireland Ltd. – only if you choose to sign in with Google (Google learns that you use your account on our site);
- public authorities, when required by law.
4. Transfers outside the European Economic Area
Some partners (for example WhatsApp / Meta or, if we enable analytics, Google) may transfer data to the USA. Transfers are made on the basis of the EU–US Data Privacy Framework or of standard contractual clauses approved by the European Commission.
5. How long we keep the data
- contact requests and photos sent: 24 months from sending, after which they are deleted automatically;
- the IP address from forms (used only against abuse): 30 days; from orders and from the account sign-in log: 90 days;
- orders, invoices and delivery documents: 10 years from the end of the financial year (Legea contabilității nr. 82/1991 – Accounting Law no. 82/1991); after a deletion request, this data is no longer used for any other purpose and is kept only for legal obligations;
- the customer account and saved addresses: until you ask for the account to be deleted; cancelled orders are anonymised on request;
- return requests and the IBAN for refunds: together with the order they relate to (accounting obligations);
- technical server logs: up to 90 days;
- proof of your cookie choice: 24 months.
6. Your rights
You have the right to request: access to your data and a copy of it; rectification of incorrect data; erasure of your data (“the right to be forgotten”), except for data the law requires us to keep; restriction of processing; data portability; you can object to processing based on legitimate interest; you can withdraw your consent at any time, without affecting processing carried out before.
Write to us at contact@epdirect.ro or on WhatsApp. We reply free of charge, within one month at most (a period that may be extended by two further months for complex requests, in which case we'll inform you). For your security, we may ask you to confirm your identity (for example, a message from the phone number used).
If you are not satisfied, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București, www.dataprotection.ro.
7. Security
The site uses encrypted connections (HTTPS) exclusively. Access to customer data is limited to staff who need it, with two-step authentication and an access log. Photos sent are reprocessed on upload, and hidden information in them (for example GPS location) is removed.
8. Minors
The shop is intended for persons over 18. We do not knowingly collect data about minors.
9. Changes
We may update this policy; the current version is always on this page, with the date of the last update. You can find details about cookies in the Cookie policy.