Personal Data Processing Policy

The personal data controller is S.C. Backstage Production Group International S.R.L., with its registered office at Str. Bucur, Nr. 4-6, 040292, București, Județ Sector 4, România, registered at the Trade Registry under no. J2003016584407, Tax ID RO15972430.

Contact details: email contact@backstage.ro, phone +40 726 314 538.

We process your personal data for the following purposes and based on the following legal grounds:

a) Performance of a contract (Art. 6(1)(b) GDPR): processing orders, delivering products, managing your user account, communicating regarding order status, and invoicing.

b) Legal obligations (Art. 6(1)(c) GDPR): compliance with tax and accounting obligations, responding to requests from competent authorities, and maintaining financial documents in accordance with applicable legislation.

c) Consent (Art. 6(1)(a) GDPR): sending marketing communications and newsletters, using non-essential cookies, and profiling for marketing purposes. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

d) Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention and detection, ensuring platform security, improving services, and analyzing website usage patterns.

Depending on your interaction with our platform, we may process the following categories of data:

Identification data: first name, last name, email address, phone number.

Delivery data: delivery address, county, postal code, delivery preferences.

Billing data: billing address, company name, tax identification number (if applicable).

Transaction data: order history, transaction amounts, payment method. We do not store bank card data – these are processed directly by the payment processor.

Technical and browsing data: IP address, browser type and version, operating system, pages visited, session duration, data collected through cookies and similar technologies.

Communication data: content of correspondence via email, chat, or phone with customer service.

We do not process special categories of personal data (sensitive data) within the meaning of Art. 9 GDPR.

Personal data is stored only for the duration necessary to fulfill the purposes for which it was collected, in compliance with the following periods:

User account data: for the duration of the account's existence and 3 years from the last activity or account deletion.

Order and billing data: 10 years from the transaction date, in accordance with applicable tax and accounting legislation.

Marketing data: until consent is withdrawn or until deletion is requested.

Technical and browsing data (cookies, logs): for the durations indicated for each cookie in the Cookie Policy (up to 2 years for analytics cookies).

Upon expiration of the storage period, data will be deleted or irreversibly anonymized.

We do not sell or rent your personal data.

We may share personal data with the following categories of recipients, strictly for the stated purposes:

Courier and delivery service providers: for order delivery (name, address, phone).

Payment processors: for processing financial transactions.

IT service providers: for platform hosting, maintenance, and technical support.

Email and marketing service providers: for sending communications and newsletters.

Public authorities: when required under applicable legislation.

All our partners are contractually obligated to process data in compliance with GDPR and may not use the data for other purposes.

Your personal data is primarily processed within the European Union / European Economic Area (EU/EEA).

A transfer outside the EU/EEA takes place in the case of the web analytics services we use (Google Analytics, provided by Google LLC, United States of America), which are enabled only after you consent to analytics cookies. Such transfer is carried out with appropriate safeguards as provided by GDPR:

Adequacy decisions of the European Commission (Art. 45 GDPR).

Standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).

Approved certification mechanisms or codes of conduct.

You have the right to request additional information regarding the safeguards applied to international data transfers by contacting us at the email address provided.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or accidental alteration, including:

• Encryption of communications via SSL/TLS protocol.
• Restriction of data access, limited to authorized personnel only.
• Regular data backups and continuous system monitoring for threat detection.
• Internal information security policies and regular staff training.
• Periodic risk assessments and security measure audits.

In the event of a data security breach, we will notify the National Supervisory Authority for Personal Data Processing (ANSPDCP) and affected data subjects in accordance with Art. 33 and 34 GDPR.

In accordance with GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR): you have the right to obtain confirmation of data processing and a copy thereof.

Right to rectification (Art. 16 GDPR): you have the right to request correction of inaccurate data or completion of incomplete data.

Right to erasure (Art. 17 GDPR): you have the right to request deletion of data under certain conditions provided by law.

Right to restriction of processing (Art. 18 GDPR): you have the right to request limitation of processing in certain situations.

Right to data portability (Art. 20 GDPR): you have the right to receive data in a structured, commonly used, and machine-readable format.

Right to object (Art. 21 GDPR): you have the right to object to data processing under certain conditions, including for direct marketing.

Right not to be subject to automated individual decision-making (Art. 22 GDPR): you have the right not to be subject to a decision based solely on automated processing, including profiling.

Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.

Right to lodge a complaint: with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, website: www.dataprotection.ro.

To exercise any of these rights, you may contact us at contact@backstage.ro. We will respond to your request within a maximum of 30 calendar days.

Our website uses cookies and similar technologies for the proper functioning of the platform, improving the browsing experience, and traffic analysis.

For detailed information regarding the types of cookies used, their purpose, and management options, please consult our Cookie Policy.

We reserve the right to update this policy at any time to reflect changes in our processing practices or legal requirements.

Any significant changes will be communicated by displaying the updated version on the website and, where appropriate, through direct notification.

We recommend that you periodically check this page to stay informed about the latest information regarding the processing of your data.