1. Controller
SC Lőrincz GROUP SRL is the data controller for personal data collected via https://magicharghita.ro.
Contact: info@magicharghita.ro • Address: nr. 511, Comuna Căpâlnița, Harghita County, Romania.

2. Categories of data
• Identification: name, billing/shipping address, company name, VAT.
• Contact: email, phone.
• Transaction: order history, payment details (tokenised).
• Technical: IP address, device/browser info, cookies (see Cookies Policy).
• Marketing preferences.

3. Purposes & legal bases
Maintain Site security – 6(1)(f) legitimate interest
Marketing emails (newsletter) – 6(1)(a) consent
Respond to enquiries – 6(1)(f)

4. Data retention
• Accounting records: 10 years (per Romanian fiscal rules).
• Customer account: while active + 3 years after last activity.
• Marketing data: until consent withdrawal.

5. Third-party recipients
• Payment processors (e.g. Stripe/Netopia).
• Courier services.
• Hosting & analytics providers within EEA or under adequacy/standard clauses.

6. International transfers
Where data leaves the EEA, we rely on adequacy decisions, SCCs or explicit consent.

7. Your rights
Access, rectification, erasure, restriction, portability, objection, withdraw consent, lodge complaint with ANSPDCP (www.dataprotection.ro).

8. Automated decision-making
No profiling that produces legal effects.

9. Security
We implement SSL, access controls, encryption at rest for payment tokens, regular backups.

10. Changes
We may update this Policy; changes will appear here with a new date.

11. Contact
For privacy queries or to exercise rights, email info@magicharghita.ro.