EU GDPR Policy

Last updated: May 26, 2026

1. Data Controller

THE GLAMS EMPIRE S.R.L. (hereinafter referred to as the "Controller")

• Tax ID (CUI): 53940369
• Trade Register No.: J2026010220009
• EUID: ROONRC.J2026010220009
• Address: Str. Fantana Rosie no. 17, postal code 500123, Brasov, Brasov County
• Phone: +40 733 656 267
• General email: contact@lexotique.ro
• Privacy email: contact@lexotique.ro

The Controller is the entity that determines the purposes and means of processing personal data.

2. Categories of data processed

Identification and contact data

Surname, first name, delivery/billing address, telephone, email.

Transactional data

Ordered products, value, payment method, delivery status, AWB codes.

Technical and site usage data

IP address, online identifiers (cookies), system logs, preferences.

Communications

Content of messages sent through the contact form, complaints, feedback.

3. Purposes and legal bases

We process data only to the extent necessary, for specified and legitimate purposes:

3.1 Conclusion and performance of the contract — art. 6(1)(b) GDPR

• Account registration and administration;
• Receiving and processing orders;
• Invoicing;
• Delivery;
• Customer relations;
• Returns and refunds.

3.2 Legal obligations — art. 6(1)(c) GDPR

• Keeping financial and accounting documents;
• Responding to requests from authorities;
• Archiving in accordance with the law.

3.3 Legitimate interest — art. 6(1)(f) GDPR

• Security of the site and accounts;
• Fraud prevention;
• Defense of rights in court;
• Minimum internal analysis necessary for improving services (without advanced profiling).

3.4 Consent — art. 6(1)(a) GDPR

• Newsletter and commercial communications by email/SMS;
• Placement of certain marketing cookies.

You may withdraw your consent at any time, without affecting the lawfulness of processing prior to the withdrawal.

4. Recipients and transfers

We may disclose data to:

• Service providers (courier, online payments, emailing, hosting, IT maintenance, accounting, customer support), who act as processors and process data only on the basis of our instructions and contractual confidentiality and data protection agreements;
• Public authorities, when required by law;
• External consultants (lawyers, auditors), based on legal obligations or legitimate interest.

5. Storage period

We keep data only for as long as necessary for the stated purposes:

• Contract, invoicing, and payment data: 10 years (financial and accounting obligations, in accordance with tax legislation);
• Customer account data: for the duration of the account activation and until deletion upon request or prolonged inactivity, with subsequent retention of the minimum necessary in accordance with legal obligations;
• Customer communications (support): as a rule, 3 years from resolution;
• Data for marketing based on consent: until withdrawal of consent or expiration of the purpose;
• Technical and security logs: in accordance with internal policies, generally between 6 and 24 months.

The deadlines may vary if a legal provision imposes a longer period or if retention is necessary for the defense of rights in court.

6. Cookies and similar technologies

We use strictly necessary cookies for the operation of the site and, on the basis of your consent, analytics and marketing cookies. Full details are available in the site's Cookie Policy.

You can manage your preferences from the dedicated banner/section or from your browser settings.

7. Your GDPR rights

You have the following rights, under the conditions of the law:

• Right to information and access to data — to be informed about the processing of data and to obtain a copy of the processed data;
• Right to rectification — to request the correction of inaccurate data or the completion of incomplete data;
• Right to erasure ("right to be forgotten") — when applicable under GDPR;
• Right to restriction of processing — in certain situations provided by law;
• Right to data portability — when the basis is the contract or consent and the processing is carried out by automated means;
• Right to object — to processing based on legitimate interest or for direct marketing purposes;
• Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you in a similar way (we do not make such decisions in the context of normal customer relations).

8. Complaints

You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Address: Bd. G-ral Gheorghe Magheru no. 28-30, sector 1, 010336 Bucharest
• Website: www.dataprotection.ro
• Email: anspdcp@dataprotection.ro

We encourage you to contact us first to try to reach an amicable resolution.

9. Security

We apply appropriate technical and organizational measures to protect data against loss, unauthorized access, disclosure, or alteration:

• Access control;
• Encryption in transit (HTTPS / TLS);
• Retention policies;
• Back-up;
• Periodic auditing and testing.

Staff access is limited to the strictly necessary.

10. Minors

11. Updates to this notice

We may periodically update this notice to reflect legislative or operational changes. The current version is available on the site and indicates the date of the last update.

In the event of significant changes, we will inform you through the usual communication channels (email, announcement on the site).

12. Contact details

For any questions related to the processing of personal data or for exercising your rights, you can contact us:

• Name: THE GLAMS EMPIRE S.R.L.
• Address: Str. Fantana Rosie no. 17, postal code 500123, Brasov, Brasov County
• Phone: +40 733 656 267
• Email: contact@lexotique.ro

For more information, please also consult our Terms and Conditions page and our Cookie Policy.

For any questions or clarifications, please contact us at contact@lexotique.ro or by phone at +40 733 656 267.