--- title: "Privacy Policy — Grafo Dalas" description: "How GRAFMARK collects and protects the personal data of grafo.ro visitors." url: https://grafo.ro/en/legals/privacy.html language: en --- legal # Privacy Policy This English version is a courtesy translation. If the two versions differ, the [Romanian version](https://grafo.ro/legals/privacy.html) prevails. **Last updated:** 6 April 2026 ## 1\. General information This Privacy Policy explains how GRAFMARK collects, uses, stores and protects your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018 on measures implementing the GDPR. Please read this policy carefully to understand your rights and choices regarding personal data. For any questions about data processing, you can contact us at: - E-mail: grafodragos@gmail.com - Phone: 0745.993943 ## 2\. Contact details of the Controller and of the Data Protection Officer (if applicable) - Controller: S.C. GRAFMARK S.R.L., tax ID (CUI) 43750391, trade register no. J22/589/2021, registered office at Str. Oancea 22, Iași ## 3\. Categories of personal data processed Depending on how you interact with the Platform, we may collect the following categories of data: - Identification and contact data: surname, first name, e-mail address, phone number, delivery/billing address. - Order and payment data: products purchased, price, payment method, billing data (including, where applicable, the billing address and the personal numeric code (CNP) for invoicing natural persons). - Technical and browsing data: IP address, device type, browser, operating system, data collected through cookies and similar technologies (see the Cookie Policy). - Communication data: the content of messages sent through the contact forms or by e-mail. - Preference and marketing data: whether you have given your consent to receive newsletters or promotional offers. ## 4\. Purposes of processing and legal bases Your data are processed for the following purposes and on the following legal bases (according to art. 6 of the GDPR): Purpose Legal basis Processing orders (including the delivery of physical products and the supply of digital products) Art. 6(1)(b) – performance of a contract Invoicing and compliance with legal obligations (e.g. archiving accounting documents) Art. 6(1)(c) – compliance with a legal obligation Managing the relationship with clients (replying to requests, support) Art. 6(1)(b) or (f) – legitimate interest Sending commercial communications (newsletter, offers) – only with your prior consent Art. 6(1)(a) – consent Ensuring the security of the Platform, preventing fraud Art. 6(1)(f) – legitimate interest ## 5\. Data retention period We keep your personal data only for as long as necessary to fulfil the purposes mentioned above, observing the legal archiving periods: - Data related to orders and invoices – 10 years from the date the contract was concluded (according to accounting legislation). - Marketing data – until consent is withdrawn, but no longer than 2 years from the last interaction. - Technical data (IP, cookies) – according to the durations specified in the Cookie Policy. - Contact form data – 1 year from the last message. After these periods expire, the data are securely erased or anonymised. ## 6\. Your rights as a data subject Under the GDPR, you have the following rights: - Right of access – you can obtain confirmation that we process your data and a copy of them. - Right to rectification – you can request the correction of inaccurate data or the completion of incomplete data. - Right to erasure (“right to be forgotten”) – you can request the erasure of your data under certain conditions (e.g. the data are no longer necessary for the purposes for which they were collected). - Right to restriction of processing – you can request that processing be limited in specific cases (e.g. you contest the accuracy of the data). - Right to data portability – you can receive the data in a structured, commonly used and machine-readable format, and you can transmit them to another controller. - Right to object – you can object to processing based on legitimate interest, including profiling. - Right not to be subject to a decision based solely on automated processing – including profiling. To exercise your rights, you can send us a written request at the e-mail address grafodragos@gmail.com or at the postal address of S.C. GRAFMARK S.R.L. We will reply within one month (which may be extended by two months in justified cases). You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) – www.dataprotection.ro. ## 7\. Disclosure to third parties and international data transfers We do not sell or transfer your personal data to third parties for their own purposes. We may disclose your data to: - Payment service providers (card processor, bank) – for processing payments. - Courier / postal service providers – for delivering physical products. - IT and hosting service providers (hosting, e-mail platform) – acting as our processors. - Public authorities – when the law requires or allows us to do so. All third parties that process data on our behalf are contractually bound to respect the security and confidentiality of the data. If we transfer personal data to countries outside the EEA, we make sure that appropriate safeguards exist (adequacy decisions, standard contractual clauses etc.). ## 8\. Security of processing GRAFMARK implements appropriate technical and organisational measures to protect personal data against loss, destruction, alteration or unauthorised access, including data encryption, firewalls, access control and staff training. Despite our efforts, no system is completely secure. In the event of a security breach affecting your data, we will notify you in accordance with the legal requirements. ## 9\. Changes to the Privacy Policy GRAFMARK reserves the right to update this policy whenever necessary. Any change will be published on the Platform, with the date of the update. We recommend that you check this page periodically. ## 10\. Privacy contact For any further questions about the processing of personal data, or to exercise your rights, you can write to us at: grafodragos@gmail.com (mentioning “Privacy” in the subject line).