Privacy

The controller of your data is EMSENSA STUDIO S.R.L., with its registered office in Florești, jud. Cluj, CUI 55304910, registration no. J2026046392008, through the website emsensa.com. You can contact us with any question about your data at contact@emsensa.com or on +40 756 122 515.

Orders — name, email, phone, delivery address, your notes and, if you buy as a company, the company name and tax code: to perform the sales contract (Art. 6(1)(b) GDPR) and to meet our tax and accounting obligations (point (c)).

Card payments — payment is made on Stripe’s secure page. We receive the payment confirmation, the amount and the delivery details entered there; your card details never reach us. If a payment isn’t completed, we send you at most two reminders with a link to resume it, only if you ticked the marketing consent. If you have an account and didn’t consent, we may send a single, non-promotional notice that your order’s payment wasn’t completed.

Account and pre-orders — email, name, password (kept by Firebase Authentication, never in plain text) or your Google sign-in; for pre-orders, also your phone, city, quantity, chosen designs, preferred contact method and your message: to manage your account and reservations, at your request (Art. 6(1)(b)).

Newsletter and marketing emails — email and, if you give it to us, your name: only on the basis of your consent (Art. 6(1)(a)), given by subscribing or through the optional checkbox in the cart (unticked by default). We keep proof of consent (the time and the text you ticked). Every email has a one-click unsubscribe link.

Contact messages — name, email, subject, message: to reply to you (legitimate interest, Art. 6(1)(f)).

Protection against abuse — so that our forms cannot be used for spam, we count the requests sent within an hour using a fingerprint (hash) of the IP address or account; the fingerprint is deleted automatically within 48 hours at most (legitimate interest, Art. 6(1)(f)).

With your consent (the cookie banner), we use Google Analytics 4 for aggregated statistics about how the website is used (Art. 6(1)(a)). You can refuse or withdraw your consent at any time from the Cookies page — when you withdraw it, we stop collecting and delete the analytics cookies we have set.

Separately, we keep our own traffic statistics (pages visited, time spent on them, the source of the visit, device type, a temporary session identifier), on the basis of our legitimate interest in understanding and improving the website (Art. 6(1)(f)). This data is not combined with your identity and, without your consent, does not use any storage in your browser.

The assistant in the corner of the page and the message suggestions on the product page run on an artificial intelligence model provided by OpenAI. What you write there (and the page you are on) is sent to OpenAI so that you receive a reply; if you are signed in and ask for help with an order, the assistant can also see your orders. Do not write passwords, card details or other sensitive data in the conversation.

We keep the text of conversations for 90 days, without your name or account, to improve the replies; email addresses and phone numbers written in the conversation are masked before saving. The legal basis is our legitimate interest in providing and improving support (Art. 6(1)(f)). The assistant does not make decisions that affect you and cannot place orders; for any issue you can talk to the team at any time.

Data is stored securely on Google Firebase infrastructure (hosting, database, authentication, functions), transactional emails are sent through Brevo, card payments are processed by Stripe, and the AI assistant uses OpenAI — all of them act as processors, under contract. So does the website developer, who has technical access for maintenance and receives order notifications in order to step in if errors occur.

For delivery, the courier receives your name, phone number and address. Google, Stripe and OpenAI may also process data outside the EEA, on the basis of the Standard Contractual Clauses and the EU–US Data Privacy Framework. We do not sell or rent your data to anyone.

Orders and pre-orders, including cancelled ones, and the related documents — for the period required by tax and accounting law; incomplete card payments — 90 days; contact messages — 2 years from receipt; conversations with the AI assistant — 90 days; newsletter subscription — until you unsubscribe; your account — until you delete it; traffic statistics — 2 years. Anything older than these periods is deleted automatically, every day.

You can delete your account yourself at any time, from the Your account page → „Șterge contul” (“Delete account”). We immediately delete the account (email, name, password or Google sign-in), your newsletter subscription and the messages sent from the account or from the account’s confirmed email address. Orders and pre-orders, including cancelled or unpaid ones, remain in the order history, no longer linked to any account: for delivery, for the records required by tax law (Art. 17(3)(b) GDPR) and for handling any complaints (Art. 17(3)(e)), for the periods above. A new account created with the same email starts empty.

You have the right of access, rectification, erasure, restriction, portability, objection and the right to withdraw your consent at any time — including unsubscribing from the newsletter. Send a request to contact@emsensa.com and we will reply within 30 days at most. You also have the right to lodge a complaint with the supervisory authority, the Romanian National Supervisory Authority for Personal Data Processing: ANSPDCP.

You will find details about cookies and your preferences on the Cookies page.