Privacy policy

1. Who is responsible for your data

The controller of your personal data is S.C. Paintpoint S.R.L., Str. Gheorghe Doja nr. 80, et. 2, Târgu Mureș, județul Mureș, România, Trade Register number J26/1054/2019, tax identification number RO38607949. For any question about your data, or to exercise your rights, write to [email protected] or call +40 33 66 30003.

2. What data we process

Order data: name, delivery and invoice address, telephone, email, the products ordered, and, if you order for a company, its name, VAT or tax number and registration number.

Account data: email, your password in encrypted (hashed) form, your saved details and orders and, only if you choose to give it, your date of birth.

Payment data: the payment is processed by the payment provider you choose; we receive the confirmation and the reference of the payment, never your full card details. Please never send us passwords, card security codes or photographs of your card by email.

Messages: what you write to us through the contact form, the business enquiry form, the withdrawal function, by email or by telephone, and the information needed to settle a return or a complaint.

Partner accounts and business enquiries: the company’s details and the name, role and professional contact details of the person who represents it.

Newsletter: your email address, your name and the date of your consent.

Technical data: the IP address, browser type, requests to the server and timestamps recorded in server logs for the operation and security of the site, and your cookie choice.

Most data comes from you. The payment provider and the courier send us confirmations of payment and delivery. If someone orders a gift for you, we receive your delivery details from that person and use them only to deliver the parcel. Mandatory fields are marked in each form; please do not include sensitive data or information about other people unless it is necessary.

3. Why we process it and on what legal basis

To conclude and perform the contract with you: taking and delivering orders, messages about the order, payments, returns, subscriptions and your account (Article 6(1)(b) GDPR).

To comply with our legal obligations: invoicing, accounting, consumer-protection, product-safety and tax rules (Article 6(1)(c) GDPR).

With your consent: newsletters, the birthday greeting and the measurement of our advertising with the Meta Pixel (Article 6(1)(a) GDPR). You can withdraw consent at any time; this does not affect what was done before, and refusing does not prevent you from buying. A business enquiry is not a subscription to the newsletter.

For our legitimate interests: answering general questions, communicating with the company a business contact represents, keeping the site secure, preventing fraud and establishing, exercising or defending legal claims (Article 6(1)(f) GDPR). This basis does not authorise behavioural advertising.

If you report a possible unwanted reaction to a product, we process only the health information that is necessary to look into the report and to meet our product-safety obligations (Article 9(2) GDPR together with the bases above).

We do not take decisions about you based solely on automated processing, and we do not sell your data or pass it to partners for their own marketing.

4. Your date of birth

Giving your date of birth is optional. We use it only to send you a greeting or a small gift around your birthday. You can delete it in your account or by writing to us.

5. Who receives your data

Courier companies that deliver your parcel. Payment providers: PayU, Stripe (including Apple Pay and Google Pay) and PayPal. The provider that hosts this website. Our customer-relationship system (CRM), which runs on servers in a data centre in Germany. Our email and accounting service providers. Meta Platforms Ireland, only if you accept marketing measurement. Public authorities, when the law requires it.

These recipients process your data only for the purposes described here, under contracts that require them to protect it.

6. Transfers outside the European Economic Area

Your data is stored in the European Union. Some providers, such as the payment providers, the hosting provider and Meta, belong to groups based in the United States and may process data there. Such transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses approved by the Commission.

7. How long we keep it

Orders and invoices: for the period required by accounting and tax law, currently five years from the end of the financial year in which they were issued.

Complaints and disputes: until they are settled and, for the information needed to defend our rights, for the limitation period that applies.

Account data: until you ask us to close the account, or three years after your last activity, without deleting documents we must keep.

Newsletter data: until you unsubscribe. A minimal record of the unsubscription and of your consent is kept for three more years, so that we do not contact you again.

Messages and enquiries: up to three years after the conversation ends.

Partner applications and accounts: for the duration of the partnership and three years afterwards.

Server logs: up to twelve months.

When these periods end, the data is deleted or made anonymous.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, to object to processing based on our legitimate interests and to withdraw your consent at any time. If you object to direct marketing, we stop using your data for that purpose. Erasure is not absolute: invoices we must keep, or data needed to defend a legal claim, may lawfully be retained.

Write to [email protected]. We reply within one month; where requests are complex or numerous, this may be extended by two further months, and we tell you so, with the reasons, within the first month. We may ask for proportionate proof of your identity, not automatically a full copy of an identity document. Requests are free of charge, with the limited exceptions in the GDPR.

You also have the right to lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, București, dataprotection.ro, or with the authority of the country where you live or work. You do not have to contact us first.

9. Security

We use encrypted connections (HTTPS), store passwords only as hashes, limit access to personal data to the people who need it for their work and keep it in systems protected against unauthorised access. No system is absolutely secure; any incident is handled and notified as the law requires.

10. Children

The shop is intended for adults. We do not knowingly collect data from persons under 18. Information about Baby SPA is addressed to parents.

11. Changes to this policy

We update this policy when our processing changes. The date of the current version is shown at the top of the page; for important changes we also tell account holders by email.

12. Magic SPA Rewards

If you have an account, you take part in Magic SPA Rewards: we create a personal referral code and a Magic SPA Credit balance for you. To run the programme we process the code and the link you share, the fact that an order was placed through them, the value of that order, the rewards and credit entries in your balance, and your progress towards bonuses. When you arrive through a friend’s link, we keep the code on your device for 30 days and record it on your first order. The legal basis is the performance of the programme terms you take part under; for the checks that keep the programme fair (the same person behind two accounts, the same telephone number, payment method or address, an unusual number of orders) it is our legitimate interest in preventing abuse. No decision with legal effect is taken by automated means alone: doubtful cases are reviewed by a person, and you can ask for a review.

The friend who invited you learns only that an order counted towards their rewards and the amount of their reward; they do not see your name, your address or what you bought. We do not ask you for your friends’ contact details and we do not write to them: you share the link yourself. Programme records are kept for as long as your account exists and, where they belong to an order, for the period that applies to orders. You can leave the programme at any time by writing to us; unused credit is then lost.