Legal information
Privacy policy
Last updated: 31 October 2026
Required details are missing. Fill them in before launch:
- [lipsește: telefon]
This policy explains what personal data we process, why, for how long and what your rights are, under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Law 190/2018.
1. Controller
The controller is Promotion Performance SRL, Trade Register no. J2025079836006, CUI RO52722951, registered office: Strada Someşului 4. For anything about your data write to pro.motion.creative.pmc@gmail.com (phone [lipsește: telefon]).
2. What data we process
- Orders: name, email, phone and delivery address as you enter them at checkout, order details and payment status. Card data is handled only by Stripe; we never see it.
- Account: email and the sign-in tokens of the links we send you.
- Newsletter: email, the signup and its confirmation.
- Ambassador program: name, Instagram handle, number of followers, the contract and payout details.
- Studio: the images and texts you upload for your tee.
- Our own analytics (no cookies): pages visited, referrer, device type and a salted hash of the IP address and browser, rotated daily. We do not store the IP address.
- With your consent: data collected by the Meta Pixel and Google tags (Google Analytics and Google Ads via Google Tag Manager, with Consent Mode). See the Cookie policy.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Taking, delivering and supporting orders; returns and guarantee claims; the customer account; Studio orders; the ambassador contract | Performance of the contract |
| Invoices and accounting | Legal obligation |
| Newsletter; marketing and analytics cookies (Meta Pixel, Google) | Consent, which you can withdraw at any time |
| Site security, fraud prevention, our own cookieless analytics | Legitimate interest |
The data marked as required at checkout is needed to conclude and perform the contract; without it we cannot deliver the order.
4. Who receives the data
We share data only as needed, with: Namecheap (hosting and email), Stripe (payments), the courier (delivery), the invoicing/accounting provider, Meta Platforms and Google (only with your consent), and public authorities when the law requires it. These providers act as processors or, where applicable, as separate controllers.
5. Transfers outside the EEA
Stripe, Meta, Google and Namecheap may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission.
6. How long we keep data
- Orders and the account: for as long as needed to perform the contract and handle returns and guarantee claims, then for as long as needed to establish or defend legal claims.
- Invoices and accounting records: 10 years, as required by accounting law.
- Newsletter: until you unsubscribe or withdraw consent.
- Sign-in tokens: until the link expires or is used.
- Ambassador program: for the duration of the contract, then as required by accounting law and for legal claims.
- Studio uploads: for as long as needed for the order and your account; you can ask us to delete them.
- Our own analytics: 400 days.
- Cookies: see the cookie policy.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time (without affecting processing done before). Write to pro.motion.creative.pmc@gmail.com; we answer within one month, as the GDPR requires. You may also complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.
8. Minimum age
Orders can be placed only by persons aged 18 or over.
9. Security
The site uses HTTPS, admin access is protected, and we limit access to data to what is needed.