Privacy policy

The controller of your personal data is the Fabrica Artizanală bakery in Alba Iulia, Romania (“we”). You can contact us through the contact page or on WhatsApp, including to exercise your rights.

This policy explains what data we process, why, who we share it with, how long we keep it and what rights you have. The site is not aimed at people under 18.

We process only the data needed to deliver orders and manage your account. Without a name, phone and delivery address we cannot deliver an order.

• Account: name, email address, phone number, the language of the emails and the password, stored only as a hash (it cannot be read). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Saved addresses: the delivery addresses you add to your account, so you do not type them for every order.
• Orders: the products ordered, prices, delivery date, your name, phone, delivery address and any notes you leave. This data is copied onto the order when it is placed.
• Subscriptions: the delivery days, products, address and skipped deliveries.
• Favourites: the products you mark with a heart while signed in.
• Acceptance of the terms: the version accepted and the date.
• Messages: the name, email address and text sent through the contact form. The message reaches the bakery by email and is not saved in the site's database.
• Technical data: for each session we keep the IP address and browser details (user agent). To limit abuse (repeated sign-in attempts, excessive orders or messages) we keep counters tied to the IP address or email; for the contact form only as a hash.
• The shopping cart and the chosen language are kept in your browser; the cart reaches us only when you place the order.

We use the data for these purposes:

• Delivering orders and managing the account, addresses and subscriptions (performance of a contract, Art. 6(1)(b) GDPR).
• Emails about the account and orders: verifying the email address, confirming and cancelling orders, skipped subscription deliveries, password reset and account deletion, and replies to your messages (performance of a contract or our legitimate interest in answering you, Art. 6(1)(b) and (f)).
• Completing the address: the text typed in the street field (our legitimate interest in making the address easier to fill in, Art. 6(1)(f)) and the device's coordinates, only if you press “Use my location” and accept the browser's request (your consent, Art. 6(1)(a)).
• Keeping orders in the bakery's records, for accounting and tax records, to prove orders and to settle complaints (legal obligation and legitimate interest, Art. 6(1)(c) and (f)).
• Site security and abuse prevention (legitimate interest, Art. 6(1)(f)).
• We do not use the data for advertising, we do not sell it and we make no automated decisions with legal effects on you. We do not send marketing messages without your separate consent.

The data is processed by providers who help us run the site, on our behalf, and by the people who deliver orders:

• Hosting: Hetzner (the server) and Cloudflare (traffic protection and delivery; it sees visitors' IP addresses).
• The database: Neon, in the Frankfurt region (European Union). Accounts, addresses, orders, subscriptions, sessions and the counters for abuse limiting are kept here.
• Sending emails: Resend or Brevo, depending on how the site is configured. They receive the email address and the content of the messages sent.
• The bakery's mailbox (currently Gmail, Google): receives a copy of every order, with the name, phone and delivery address, and the messages from the contact form.
• Completing the address: Geoapify (based on OpenStreetMap) receives, directly from your browser, the text typed in the street field and your IP address and, only if you press “Use my location”, your device's coordinates. We do not keep this data.
• Sign-in with Google, if you choose it: Google.
• The delivery person or courier company: the name, phone and address, strictly to deliver the order.
• Public authorities, where the law requires us to share data.

Some of the providers above (for example Google, Cloudflare, Neon, Resend) are US companies or may process data outside the European Economic Area. In those cases the safeguards provided by the GDPR apply: the European Commission's standard contractual clauses or the adequacy decision for the EU–US Data Privacy Framework.

We keep the account data, addresses, favourites and subscription for as long as you have an account. A session expires after 30 days without activity.

You can delete the account at any time from the profile page. On deletion the name on the account becomes “Cont șters” (deleted account) and the email and phone are removed; saved addresses, favourites, sessions and sign-in methods are deleted, the subscription is stopped and orders that can still be cancelled are cancelled. If an order is already being prepared, the account can be deleted after it is delivered. You receive a confirmation email at the old address.

Orders are not deleted with the account. They stay in the bakery's records, together with the name, phone and delivery address on the order, for accounting and tax records, to prove orders and to settle complaints. We keep them for as long as these purposes require, as the law provides.

Database backups may contain deleted data until they expire.

Messages from the contact form stay in the bakery's mailbox for as long as needed to answer you and resolve your request.

We use only strictly necessary items, which do not require consent: the session cookie, which keeps you signed in, and, in your browser's local storage, the shopping cart and the chosen language. We use no advertising or tracking cookies and have no analytics tools, which is why we show no cookie banner. If we add statistics that use cookies, we will ask for your consent first.

Passwords are stored only as a hash, the connection to the site is secure (HTTPS) and access to data is limited to the people who need it to deliver orders and run the site. If an incident affects your data in a way that may harm you, we will tell you and the authority, as the law requires.

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability and to object, and the right to withdraw consent at any time where processing is based on consent. The right to erasure does not apply to the data on orders, which we are entitled to keep (see “How long we keep data”).

You can correct your name, phone and addresses directly in your account, and you can delete the account. For other requests, write to us through the contact page or on WhatsApp; we may ask you to confirm your identity. We normally answer within one month.

If you believe we have infringed your rights, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

We may update this policy. The version in force is the one published on this page, with the date of the last update.