Privacy policy

01Data controller

The controller of your data is MICROFRUITS S.A., registered office at 16 Garii Street, Branesti village, Branesti commune, Ilfov county, Romania, tax ID RO29252740, J23/4197/2022. For any question or request about personal data, write to office@microfruits.ro with the subject “Personal data”.

02What data we process

Depending on how you use the shop, we process:

• Identification and contact details: name, e-mail, phone.
• Delivery details: address, chosen pickup point or locker, delivery window, notes for the courier.
• Order and payment details: products, quantities, amounts, payment method, invoices. Full card details are processed only by NETOPIA Payments; we keep only the card type, the last 4 digits and, if you choose to save the card, a payment token.
• Account details: password (stored as an irreversible hash), preferences, subscription, credit.
• For companies: company name, tax ID, billing addresses, contact people and their roles in the portal.
• Reviews, complaints and messages you send us.
• Technical data: IP address, browser and device type, security logs and, only with your consent, browsing data collected through analytics and marketing cookies.
• In the mobile app: the push notification token, only if you allow notifications. The app does not access your location, camera, microphone or contacts.

03Why we process it and on what legal basis

• Taking, packing, delivering and invoicing orders, managing your account, subscription and complaints — performance of the contract (Art. 6(1)(b) GDPR).
• Issuing and keeping invoices and accounting records, reporting to RO e-Factura and answering requests from authorities — legal obligation (Art. 6(1)(c)).
• Service e-mails and notifications (confirmation, delivery, failed payment, subscription renewal), account security, fraud prevention and defending our rights in court — legitimate interest (Art. 6(1)(f)).
• Review requests after delivery and abandoned-cart messages, only for existing customers and about products similar to those bought — legitimate interest, with an unsubscribe link in every e-mail.
• Newsletter and personalised offers — consent (Art. 6(1)(a)), which you can withdraw at any time.
• Traffic analytics and advertising on Google and Meta — consent, given through the cookie banner.

04What happens if you do not give us your data

Your name, contact details and address are needed to conclude and perform the contract: without them we cannot take, deliver or invoice your order. Data for the newsletter, analytics and marketing is optional, and refusing it does not stop you from buying.

We do not make decisions based solely on automated processing that produce legal effects for you.

05How long we keep data

• Customer account: while it is active; accounts with no activity for 3 years are deleted or anonymised after we notify you by e-mail.
• Orders and invoices: 5 years for supporting documents and 10 years for accounting records, under Accounting Law No 82/1991.
• Complaints and correspondence: 3 years after resolution, the general limitation period.
• Newsletter: until you unsubscribe.
• Abandoned carts: 30 days.
• Technical and security logs: 12 months.
• Cookies: the durations in the Cookie policy.

06Who we share data with

We never sell or rent your data. We share it only with processors working for us, under a data processing agreement as required by Art. 28 GDPR, and only as far as they need it for their service:

• the NETOPIA Payments payment processor;
• courier companies and locker operators, for delivery;
• our hosting and cloud infrastructure provider;
• our transactional e-mail and newsletter provider;
• the ERP system provider (SeniorERP) and the platform developer, for invoicing, stock and maintenance;
• Google (Analytics, Ads) and Meta (Pixel), only if you accepted the matching cookies;
• public authorities (for example ANAF, including through RO e-Factura, ANPC, the courts) when the law requires it, and our advisers (accountants, auditors, lawyers), who are bound by confidentiality.

07Transfers outside the European Economic Area

Some providers (for example Google and Meta) may process data outside the EEA. In those cases the transfer relies on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

08Minors

The shop is intended for people over 18. We do not knowingly collect children's data; if you learn that a minor has sent us data, write to us and we will delete it.

09Your rights

You have the right:

• to know what data we hold about you and get a copy (access);
• to have incorrect data corrected (rectification);
• to have your data erased when we no longer have grounds to keep it;
• to restrict processing;
• to receive your data in a structured format (portability);
• to object to processing based on legitimate interest, including direct marketing;
• to withdraw your consent at any time, without affecting earlier processing.

10How to exercise your rights

Write to office@microfruits.ro or use the settings in your account. We reply within one month of receiving your request; for complex requests this can be extended by two more months, and we will tell you. We may ask for extra details only to confirm the request comes from you.

If you believe your data is not processed correctly, you can complain to the Romanian data protection authority (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, www.dataprotection.ro.

11Data security

We use encrypted connections (HTTPS), hashed passwords, role-based access to the admin panel, limits on sign-in attempts and regular backups. Card details never reach our servers. If a data breach could affect you, we will notify you as the law requires.

12Changes to this policy

We may update this policy. If the changes are significant, we tell you by e-mail or with a notice on the site before they take effect.