Privacy policy

Last updated: 24 October 2026

This is a translation for your convenience. In case of any difference, the Romanian version prevails.

This policy explains what personal data we collect when you use the Raisalis Glow website, why we use it, who we share it with, how long we keep it and what your rights are, under Regulation (EU) 2016/679 (“GDPR”).

1. Who we are

The data controller is Andra Rugina, Trade Register no. , Tax ID , registered office at Str. Pelicanului nr. 17, bl. B17, ap. 82, Brasov, jud. Brasov.
For any question about your data, write to us at raisalisglow@gmail.com or call 0740 959 7963.

2. What data we collect and why

Orders

When you place an order (with or without an account) we ask for your name, email address, phone number, delivery address and, optionally, notes. We use them to process and deliver the order, to contact you about it and to issue the invoice.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legal accounting obligations (Art. 6(1)(c)).

Customer account

If you create an account, we keep your username, email address, password (only in irreversibly encrypted form; we cannot see it), your name, phone number and address (if you fill them in), your favourite products and your order history. We use your email address to confirm the account, to reset your password and for the free shipping offer on your first order.
Legal basis: performance of a contract (Art. 6(1)(b)).

Reviews

When you write a review, we keep the rating, title, comment, the name shown (or “anonymous”, if you choose so) and your email address. The email is never shown publicly; we only use it if we need to contact you about the review. Reviews are published after we check them.
Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by asking us to delete the review.

Emails

We only send emails related to your orders and your account (order confirmation, invoice, email address confirmation, password reset). We do not send newsletters or advertising.

Security and running the website

To prevent abuse (for example repeated login attempts or automated messages), we temporarily use your IP address, kept only in the server’s memory for at most one hour. The server may record website errors in its technical logs; if you choose to send us an error report from the error page, we also receive the message you write.
Legal basis: our legitimate interest in keeping the website secure and working (Art. 6(1)(f)).

3. Cookies

We only use cookies that are strictly necessary for the website to work. We do not use analytics or advertising cookies and we do not track you on other websites, which is why we do not ask for your consent for them.

In addition, your browser remembers locally (it is not sent to us) whether you closed the banners on the home page.

4. Who we share data with

We do not sell or rent your data. We only share it with the providers we need to run the shop, each with access only to what it needs:

• Cargus (courier) — your name, phone number and delivery address, to deliver the parcel.
• Hetzner Online GmbH (Germany) — hosting of the website and database.
• Google (Gmail service) — sending emails about orders and accounts.
• Cloudinary — storing product images and PDF invoices (which contain your name and address).
• jsDelivr — delivering some technical files of the website (styles, scripts); it receives the visitor’s IP address, like any web server.
• Public authorities, only when the law requires us to.

Some of these providers (Google, Cloudinary, jsDelivr) may also process data outside the European Economic Area, including in the USA. In those cases the transfer is based on the EU–U.S. adequacy decision (EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the European Commission.

5. How long we keep data

• Orders and invoices: for the period required by accounting law.
• Your account: until you delete it, which you can do at any time from “My account” → “Delete account”. Orders you placed are kept (for the legal obligations above) but are no longer linked to the account.
• Reviews: until you ask us to delete them or we remove them.
• Links in emails (email confirmation, password reset) expire after 24 hours and one hour respectively.
• IP addresses used for security: at most one hour.

6. Your rights

You have the right to request access to your data, its correction, its deletion, restriction of processing, data portability (receiving it in a structured format), to object to processing based on legitimate interest, and to withdraw your consent at any time, without affecting processing done before.

You can do much of this yourself from your account (profile details, email address, password, deleting the account). For anything else write to us at raisalisglow@gmail.com; we will answer within one month.

You may also lodge a complaint with the Romanian data protection authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, sector 1, Bucharest, www.dataprotection.ro.

7. How we protect data

The website uses an encrypted connection (HTTPS), passwords are only stored irreversibly encrypted, and only the shop staff who process orders have access to order data.

8. Children

The website is not aimed at people under 16 and we do not knowingly collect their data.

9. Changes

We may update this policy when the way we process data changes. The version in force is always the one on this page, with the last-updated date shown above.