Privacy policy
This policy explains what personal data the TESNA online shop at www.tesnaromania.com processes, why, for how long, and what your rights are. Regulation (EU) 2016/679 (GDPR) and Romanian data protection law apply.
WHO IS RESPONSIBLE
The controller is the company selling through this site. Its name, tax number (CUI), trade register number and registered office are shown at the foot of every page. Write to the e-mail address on the contact page with any question about your data.
WHAT WE PROCESS
Orders: name, e-mail, phone, delivery address and, if you ask for a company invoice, the company's details. The products ordered, prices and how you paid.
Customer account: e-mail, name, phone, password (kept only as a cryptographic hash that nobody can read), saved addresses, favourites, your language and the consents you gave.
Signing in with Google or Apple: if you choose this, Google or Apple sends us an identifier for your account, your e-mail address and, from Apple, your name, the first time only. We never receive your password from them.
Account security: for every sign-in attempt we keep the time, IP address, browser and result, so unauthorised access can be stopped.
Messages, quote requests and warranty registration: what you write, the contact details you give and, for a warranty, the product's serial number.
Reviews: the text and the rating. Reviews are published without your name.
Newsletter: your e-mail address and when you subscribed.
Card payments: made on Stripe's page. Your card details go only to Stripe, never to us.
WHY, AND ON WHAT BASIS
To make and perform the sales contract: the order, delivery, returns and warranty (GDPR art. 6(1)(b)).
To meet legal obligations: invoicing, accounting records, consumer rights (art. 6(1)(c)).
To keep the shop and accounts secure and to answer your messages: our legitimate interest (art. 6(1)(f)).
To send you news: only with your consent, which you can withdraw at any time (art. 6(1)(a)).
We make no automated decisions with legal effect on you and no advertising profiling.
HOW LONG WE KEEP IT
Orders and invoices: as long as accounting and tax law requires (Romanian Accounting Law no. 82/1991).
Customer account: until you close it. When you do, the account's data is deleted or anonymised; orders stay only as long as the law requires.
Sign-in history: 2 years.
Sign-in sessions: 30 days after they end.
Confirmation and password links: 30 days after use or expiry.
E-mails sent by the site: 90 days; the text of an e-mail that could not be sent is deleted after 30 days.
Messages and quote requests that have been dealt with: the period the shop's administrator sets in the admin panel.
Newsletter: until you unsubscribe.
Backups are encrypted, rotated automatically and used only to restore the site.
WHO WE SHARE IT WITH
The courier, for delivery: name, phone and address.
Stripe, if you pay by card.
The hosting provider (Hostinger), whose servers run the site and its e-mail.
Google or Apple, only if you choose to sign in with them.
The invoicing software, once it is in use, to issue your invoice.
Authorities, only when the law requires it.
We never sell or rent data to anyone.
Stripe, Google and Apple may process data outside the European Economic Area; such transfers rely on European Commission adequacy decisions or standard contractual clauses.
YOUR RIGHTS
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time.
From your account you can download a copy of the data we hold and close the account yourself, without writing to us.
For anything else, write to the address on the contact page. We answer within one month.
You have the right to complain to the Romanian data protection authority, ANSPDCP, www.dataprotection.ro.
HOW WE PROTECT IT
The site works only over an encrypted connection (HTTPS). Passwords are kept only as Argon2id hashes. Staff access is limited by role, with two-step sign-in, and every change is logged. Backups are encrypted.
COOKIES
What we store in your browser is explained in the cookie statement.
CHILDREN
The shop is not aimed at children under 16 and we do not knowingly collect their data.
CHANGES
When this policy changes, the new version is published here with its date.
Last updated: 30 September 2026.
Note: this text describes what the site does today and must be checked by a lawyer before it is treated as final.
