Privacy policy

The privacy of your data is important to us. We process personal data responsibly, transparently and only for the purposes described below, in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018.

Last updated: 22 September 2026

1. Data controller

The controller of your personal data is:

  • GLOBELA TRADE SRL, CUI RO36526082, Trade Register no. J2016012144409
  • Registered office: Str. Aviator Mircea Zorileanu Nr. 91, Floor 1, 012054 Bucharest, Sector 1, Romania
  • E-mail: vanzari@sculedepot.ro · Phone: +40 770 432 871 / +40 374 955 788
  • Data protection contact: vanzari@sculedepot.ro

2. What data we collect

Depending on how you interact with us, we process:

  • Identification and contact data: surname, first name, e-mail address, phone number.
  • Delivery and billing data: delivery and billing address; for legal entities, the company name and CUI.
  • Order data: the products ordered, their value, order history, and communications relating to the order.
  • Payment data: payment confirmation and technical transaction data. We do not collect or store full card details — they are processed exclusively by the payment processor.
  • Technical and usage data: IP address, device and browser type, data collected through cookies (see the Cookie policy).
  • Account data (if you create an account): authentication data managed through the Shopify Customer Account API.

3. Purposes and legal bases of processing

  • Processing and delivering the order, handling returns and warranty claims — performance of the contract, Art. 6(1)(b) GDPR.
  • Issuing invoices, e-Factura reporting, accounting archiving — legal obligation, Art. 6(1)(c) GDPR.
  • Fraud prevention and site security — legitimate interest, Art. 6(1)(f) GDPR.
  • Marketing communications / newsletter (if you subscribe) — consent, Art. 6(1)(a) GDPR.
  • Non-essential cookies (analytics, marketing) — consent, Art. 6(1)(a) GDPR.
  • Measuring and personalising ads on Facebook and Instagram (Meta), including the transmission of hashed contact and delivery data — consent, Art. 6(1)(a) GDPR.

Providing identification, delivery and billing data is necessary to conclude and perform the sales contract and to issue the invoice required by law; without this data, the order cannot be processed. Data for marketing/newsletter purposes is provided voluntarily, on the basis of consent, and refusing to provide it does not affect your ability to place orders.

4. Recipients of the data (processors and other recipients)

We only transfer the data that is strictly necessary to:

  • Shopify International Ltd. / Shopify Inc. — the e-commerce platform and hosting of the shop (including hosting on the Shopify Oxygen infrastructure), acting as processor.
  • NETOPIA FINANCIAL SERVICES S.A. (NETOPIA Payments), CUI RO43131360, Bd. Dimitrie Pompeiu 9-9A, IRIDE Business Park, Building 24, 4th floor, Sector 2, Bucharest — the card payment processor: transaction data and payment confirmation, necessary to process the payment. Full card details are entered directly on the processor's secure page and do not reach us.
  • Courier companies — FAN Courier and Sameday (including delivery to easybox): name, address and phone number, for delivery and, where necessary, returns.
  • ANAF — through the RO e-Factura system, for tax obligations.
  • The Shopify platform's analytics tools — for statistics on the use of the shop, activated only after you have given your consent to non-essential cookies.
  • Meta Platforms Ireland Ltd. (Facebook, Instagram) — for measuring and personalising ads: your actions on the site (for example viewing a product, adding to cart, completing an order, with the products, value and currency), technical data (IP address, browser, the ad click identifier), cookie identifiers and, in hashed (pseudonymised) form, the contact and delivery data used for the order (e-mail, phone, name, city, county, postal code, country, customer identifier). This data is sent on the basis of your consent to marketing cookies, which you can withdraw at any time using the "Cookie settings" button. The data is also used to personalise the ads you see on Facebook and Instagram (profiling). For the collection and transmission of this data, we and Meta are joint controllers under the Meta Controller Addendum: we are responsible for informing you and for obtaining your consent, and Meta responds to requests concerning the data it holds after transmission; you can exercise your rights against either of us. Withdrawing consent stops future transmissions; data already transmitted is kept by Meta under its own policy. Meta's further processing is governed by the Meta Privacy Policy.
  • Public authorities, where required by law.

We do not sell or rent your personal data.

5. Relationship with Shopify and sub-processors

The shop runs on the Shopify platform, which acts as processor and in turn uses sub-processors (for example cloud infrastructure and CDN providers). The current list of Shopify's sub-processors and the Data Processing Addendum (DPA) are published by Shopify on its own website.

To protect, grow and improve the shop's business, we use certain enhanced Shopify features that incorporate data from your interactions with our shop, with other merchants and with Shopify. For these features, Shopify processes the data as an independent controller and responds to requests to exercise your rights in relation to them. Details and available options: Shopify Consumer Privacy Policy and Shopify Privacy Portal.

6. International transfers

Some of our providers (for example Shopify and Meta) may process data outside the European Economic Area. In such cases, transfers are protected by appropriate safeguards, such as the standard contractual clauses approved by the European Commission, or by an adequacy decision.

7. Retention period

We keep data only for as long as necessary for the purposes above. Data relating to orders and invoices is kept for the statutory archiving periods laid down by the applicable accounting and tax legislation (Accounting Law no. 82/1991 and the tax rules in force). Data processed on the basis of consent is kept until consent is withdrawn. Data that is no longer needed is deleted or anonymised.

8. Data security

We apply appropriate technical and organisational measures to protect the data against unauthorised access, loss or disclosure, including encryption of traffic (HTTPS) and restricted access to data.

9. Cookies

The site uses cookies and similar technologies. Full details can be found in the Cookie policy. Data is provided through non-essential cookies only with your consent, which you can withdraw at any time.

10. Your rights

Under the GDPR, you have the following rights:

  • the right of access to your data (Art. 15);
  • the right to rectification (Art. 16);
  • the right to erasure / "right to be forgotten" (Art. 17);
  • the right to restriction of processing (Art. 18);
  • the right to data portability (Art. 20);
  • the right to object, including to direct marketing (Art. 21);
  • the right not to be subject to automated decision-making / profiling (Art. 22);
  • the right to withdraw your consent at any time, without affecting the lawfulness of prior processing (Art. 7(3)).

11. How to exercise your rights

For any request concerning your data, write to us at vanzari@sculedepot.ro. We will normally respond within one month of receiving the request.

12. Right to lodge a complaint

If you consider that the processing of your data breaches the law, you have the right to lodge a complaint with the supervisory authority:

  • National Supervisory Authority for Personal Data Processing (ANSPDCP)
  • B-dul G-ral Gheorghe Magheru nr. 28–30, Sector 1, postal code 010336, Bucharest, Romania
  • Phone: +40 318 059 211 / +40 318 059 212 · E-mail: anspdcp@dataprotection.ro · Web: dataprotection.ro

You may also bring the matter before the competent courts.

13. Data of minors

The site is intended for persons with full legal capacity. We do not knowingly collect data of minors under 16 without the consent of the holder of parental responsibility.

14. Changes to this policy

We may update this policy. The version in force is permanently published on this page, together with the date of the last update.