roen

Privacy policy

Last updated: 8 November 2026 · This is a translation; the Romanian version prevails.

1. Controller

Your data is controlled by GUNDAHAR S.R.L., registered office Str. Feleacului nr. 14, Oradea, jud. Bihor, 410150, Trade Register no. J05/1981/2016, tax ID (CUI) 36704546. Questions about your data: contact@clgworks.ro.

2. What we use and why

  • Orders: name, email, phone, delivery address or chosen easybox, billing details (company and tax ID if any) and the products ordered, to deliver your order (contract, GDPR Art. 6(1)(b)) and to issue the invoice (legal obligation, (c)).
  • Custom-part requests: contact details, description and photos you send, to prepare a quote ((b)).
  • WhatsApp updates: your phone number, only if you tick the option at checkout (consent, (a)). Opt out any time with a WhatsApp message or an email.
  • Security: IP address and technical data on the request form, to stop spam (legitimate interest, (f)).

We don't send marketing and don't sell data. We make no automated decisions with legal effects on you.

3. Who receives it

Only the providers the shop needs, each under a data processing agreement:

  • Sameday Courier (delivery): name, phone, email, address or easybox, cash-on-delivery amount.
  • NETOPIA Payments (card payments): order and contact details; you enter card details directly with NETOPIA.
  • SmartBill (invoicing) and our accountant.
  • Supabase (database, servers in Frankfurt, EU) and Vercel (website hosting, Frankfurt region).
  • Resend (order emails) and Cloudflare (spam protection on the request form).
  • Meta / WhatsApp (only if you chose WhatsApp updates).
  • Authorities, when the law requires it.

4. Transfers outside the EU

Some providers (Vercel, Resend, Cloudflare, Meta) are US companies. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

5. How long we keep it

  • Orders and invoices: as long as accounting law requires (currently up to 10 years).
  • Custom-part requests that don't become orders: up to 12 months after they close.
  • Messages and notification logs: up to 2 years.

6. Your rights

You can ask for access, correction, erasure, restriction, portability, or object, and withdraw consent. Write to contact@clgworks.ro; we reply within one month.

You can complain to the Romanian data protection authority ANSPDCP (dataprotection.ro).

7. Cookies

We only use strictly necessary cookies. See the Cookie policy.