CeaiCraftPrivacy Policy
This text explains what personal data CeaiCraft Atelier S.R.L. ("CeaiCraft") collects when you visit ceaicraft.shop or order tea from us, why we use it, how long we keep it, who can access it, and what your rights are. We process data in compliance with the provisions of the General Data Protection Regulation (GDPR).
About this privacy policy
These rules apply to the ceaicraft.shop website, orders placed in the shop, and messages you send to us. They do not apply to external websites we may link to, which have their own policies.
Contact details and data controller
The data controller is CeaiCraft Atelier S.R.L., located at Str. Plevnei nr. 42, 400394 Cluj-Napoca, România. For questions regarding your personal data, write to us at [email protected] or call +40 569 222 168.
- Merchant
- CeaiCraft Atelier S.R.L.
- Registered address
- Str. Plevnei nr. 42, 400394 Cluj-Napoca, România
- [email protected]
- Phone
- +40 569 222 168
What personal data we collect
We only collect data strictly necessary for the purpose specified in each category.
3.1 Information you provide directly
Name, shipping address for the botanicals, email address, and phone number when you order; message content when you write to us or leave feedback. These are retained for the duration of order processing and statutory accounting periods, and messages up to 3 years from the last contact.
3.2 Payment and transaction data
Order number, selected herbal blends, amounts, chosen payment method, and delivery status. No card details or online banking credentials are entered on this website. We keep this data for the period required by accounting laws.
3.3 Automatically collected information
IP address, browser and device type, pages viewed, referral page, and visit timestamp, recorded by the server and files described in our Cookie Policy. These remain in server logs for 30 days and up to 14 months in aggregated analytics reports.
3.4 Marketing and advertising data
The campaign, referral, or link that brought you to the website, retained solely to attribute your visit and order to that source. These are kept for up to 90 days.
3.5 Data received from our partners
Delivery status transmitted by the courier and payment confirmation received from the payment processor, associated with your tea order.
3.6 Children
Our shop is not intended for individuals under 18. We do not intentionally collect data from minors; a parent or guardian may contact us at [email protected] to request deletion.
Data you are required to provide
Name, shipping address, email, and phone number are required to package and dispatch your order and to communicate with you. Without them, we cannot send the tea parcel. All other fields are optional.
How we use your personal data
- To prepare the batch, ship and invoice your tea order, and to handle returns and refunds.
- To answer your questions and send you parcel tracking updates via email or SMS.
- To keep the shop secure, prevent fraudulent attempts, and analyze how the website is used.
- To send you harvest updates only if you requested them; every message includes an easy unsubscribe link.
- To comply with legal obligations, such as maintaining workshop accounting records.
Who we share your personal data with
We never sell our customers' data. We only share it with the partners listed below, each contractually bound to process it solely upon our instructions.
6.1 Payment processing
The processor for your selected payment method receives the details strictly necessary to process and verify the payment.
6.2 Shipping and fulfilment partners
The courier receives your name, delivery address, and phone number to deliver the tea to your door and notify you upon arrival.
6.3 Service providers
Services that host our website, send our communications, or support customer relations process data on our behalf.
6.4 Advertising and analytics partners
Analytics and advertising cookies, set only with your consent, transmit browsing data to their providers, as explained in our Cookie Policy.
6.5 Legal and regulatory disclosures
We disclose data when strictly required by law or to protect our rights, such as during an order dispute.
6.6 Business transfers
In the event of a sale or merger of our business, customer data transfers to the new operator under the same data protection rules.
International data transfers
Our partners may also process data outside Romania. When this occurs, we rely on adequacy decisions or standard contractual clauses, maintaining the same level of care for your data.
Your rights and choices
Under the General Data Protection Regulation (GDPR), you hold data subject rights under Articles 15-22 GDPR.
8.1 Access, rectification, erasure, and data portability
You can ask us to show what data we hold about you, correct it, erase it, receive a copy in a standard format, restrict or stop its processing, and withdraw your consent. Withdrawal does not affect actions taken prior to your request.
8.2 Marketing choices
Every informational email includes an unsubscribe link. Analytics and advertising cookies can be disabled at any time in the preferences panel.
8.3 Exercising your rights
Send a message to [email protected]. We may request identity verification and will reply within 30 days. You may also lodge a complaint with the data protection authority in Romania.
Data security
Our web pages run over secure HTTPS connections. Order data resides on restricted-access systems, accessible only to staff and partners who need it for the stated purposes. We do not collect or store payment card details on this site.
Data retention
Order and invoice data remain archived for the legally required accounting period, after which they are deleted. Messages sent to us are retained for up to 3 years from the last contact. Server logs are kept for 30 days, and aggregated statistical data for up to 14 months. Your consent to receive updates from our workshop is retained until you decide to opt out.
Third-party websites and services
Links to external websites, social networks, or payment processors lead to platforms with their own privacy rules. We are not responsible for how they manage your data.
Changes to this policy
We update this policy when our procedures change or when required by law. The current version is always available on this page, with the latest revision date shown at the top.