Policies

Privacy policy

Last updated: January 2026

1. Data we collect

• • Account data — email address, display name, hashed password.
• • Order data — cart contents, source URLs, notes, shipping addresses.
• • Payment data — payment method type and transaction amount. Card numbers are handled exclusively by our PCI-DSS-certified payment processor; we never see or store them.
• • Technical data — IP address, browser user-agent, session cookies, device fingerprints used for fraud prevention.

2. Why we use it

• • To fulfil the buying-agent contract with you (legal basis: contract).
• • To comply with Romanian/EU accounting and anti-fraud obligations (legal basis: legal obligation).
• • To improve the service, detect abuse, and prevent exploits (legal basis: legitimate interest).
• • To send optional marketing emails, only when you opt in (legal basis: consent).

3. Sharing with third parties

We only share the minimum data needed to deliver the service: payment processors (Stripe/Adyen), international carriers (DHL, FedEx, SF Express, Yanwen), and cloud infrastructure providers located in the EU. We never sell your data to third-party marketers.

4. International transfers

Shipping and sourcing data is transferred to our warehouse team in mainland China to physically handle your parcels. Such transfers are covered by Standard Contractual Clauses approved by the European Commission.

5. Retention

Order and invoice records are retained for 10 years, as required by Romanian fiscal law. Account data is kept while your account is active; on deletion request, we anonymise personal identifiers and keep only the records strictly required for tax audits.

6. Your rights

Under GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. Email office@clubathra.com to exercise any of these rights. You also have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP).

7. Cookies

We use first-party cookies strictly necessary for authentication (session cookie) and cart persistence. We do not use third-party advertising cookies.

8. Contact

For data-protection requests, write to office@clubathra.com. The data controller's full company-registration details are listed in the Terms of Service.