This policy explains what personal data we collect when you use oskind.com or buy from us, why, who we share it with, and your rights under the EU General Data Protection Regulation (GDPR).
Who is responsible for your data
The data controller is:
- Company
- [to be added: legal company name]
- Brand
- osk.ind
- Trade Register no.
- [to be added: trade register no. (nr. orc)]
- Fiscal code (CUI)
- [to be added: cui (fiscal code)]
- VAT
- [to be added: vat status]
- Registered address
- [to be added: registered address]
- letsbuild@oskind.com
For anything about your data, email letsbuild@oskind.com.
What we collect
- Order details: name, billing and shipping address, email, phone number, the products you buy, order notes, and your order history.
- Account details (if you create an account): email, password (stored encrypted), saved addresses.
- Payment details: your card is entered directly into Stripe’s secure form. We only see the card type, the last four digits and whether the payment succeeded.
- Batch updates (only if you subscribe): your email address, when and how you subscribed and confirmed, and whether you opened our emails and which links you clicked.
- Messages: what you send us by email or through a contact form.
- Technical data: IP address, browser and device information, and the pages you request, recorded by our web server for security and to keep the site working.
We don’t collect more than we need, and we don’t buy data about you from anyone.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Taking, making, shipping and supporting your order; handling returns and guarantee claims | Performing our contract with you (6(1)(b)) |
| Running your account, if you create one | Performing our contract with you (6(1)(b)) |
| Invoices and accounting records | Legal obligation (6(1)(c)) |
| Preventing fraud and keeping the site secure | Our legitimate interest in a safe shop (6(1)(f)) |
| Replying to your messages | Our legitimate interest in answering you (6(1)(f)), or steps before a contract (6(1)(b)) |
| Sending batch updates by email, if you subscribe | Your consent (6(1)(a)), which you can withdraw at any time |
We only send marketing emails if you subscribe to our batch updates and confirm your address by email. They tell you when a batch opens or closes, when a new platform launches and when new add-ons are released. Every email has an unsubscribe link, and you can also unsubscribe by emailing us. Unsubscribing doesn’t affect your orders or your account.
We don’t use your data for automated decisions or profiling.
Who we share it with
We share only what each party needs to do its job:
- Stripe (Stripe Payments Europe Ltd., Ireland) processes card payments and checks for fraud.
- Our web host, Hostinger, hosts the website, its database and our email.
- The courier that delivers your order receives your name, shipping address, phone number and parcel details.
- Our accountant receives invoice data to keep our books.
- MailPoet (part of Automattic Inc., United States) sends our batch-update emails and receives your email address and the emails we send you. Your subscription itself is stored in our own website database.
- Public authorities, only when the law requires it.
Stripe and some service providers may process data outside the European Economic Area (for example, in the United States). When that happens, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework) or by the European Commission’s standard contractual clauses.
We never sell your personal data.
How long we keep it
- Orders and invoices: for as long as Romanian accounting and tax law requires us to keep them.
- Your account: until you ask us to delete it. Order records we must keep by law stay for the period above.
- Messages: as long as needed to deal with your request, and then for up to 3 years in case of follow-up questions or claims.
- Batch updates: until you unsubscribe. If you don’t confirm your subscription, your address is deleted after 30 days.
- Server logs: for a short period, normally no more than a few weeks.
Cookies
We only use cookies that are strictly necessary for the shop to work, so we don’t need to ask for consent. We don’t use analytics, advertising or social media tracking cookies.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | this site | Remember your cart | Session / up to 2 days |
| wordpress_logged_in_*, wordpress_sec_* | this site | Keep you logged in to your account | Session / up to 14 days if you tick “remember me” |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention during payment | 1 year / 30 minutes |
Our fonts are hosted on our own server, so loading this site doesn’t send your data to Google or any other font provider.
Your rights
You have the right to:
- access the personal data we hold about you and get a copy of it;
- have incorrect data corrected;
- have your data deleted, where we don’t have to keep it by law;
- restrict or object to how we use it, where we rely on legitimate interest;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email letsbuild@oskind.com. We reply within one month.
You can also complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority in the EU country where you live.
Children
Our shop is not aimed at children under 16, and we don’t knowingly collect their data.
Security
The whole site uses an encrypted connection (HTTPS). Access to order data is limited to the people who need it to run the shop.
Changes
We’ll update this policy if what we do with your data changes. The date at the top shows the latest version.