Privacy policy

Last updated: 29 September 2026

This English version is a translation provided for convenience. In case of any discrepancy, the Romanian version prevails.

At Mitza we treat your data with the same care we put into choosing our products. On this page we explain, in plain words, what data we collect, why, how long we keep it and what rights you have, under Regulation (EU) 2016/679 (GDPR).

1. Who is responsible for your data

The data controller is Dumlu Emre Persoană Fizică Autorizată (authorised sole trader), Tax ID (CUI) 50650492, registered office at Str. Ion Ghica nr. 240A, Corp C3, Camera 1, loc. Ghergani, oraș Răcari, jud. Dâmbovița, Romania. For any question about your data, write to us at mitzasupport@gmail.com.

2. What data we collect

• Identification and contact data: name, email address, phone number, delivery and billing address.
• Order data: products bought, amount, payment and delivery method, order history.
• Payment data: entered directly with the payment processor. We don't see or store your full card number.
• Messages and requests: what you write to us through the contact form or by email, including withdrawal requests and, if you give it to us for a refund, your IBAN account.
• Technical data and cookies: IP address, device and browser type, pages visited and interactions with the website, to the extent allowed by your choices in the cookie banner.
• Reviews: the name or initials, city, text and photos you choose to publish.

3. Why we use the data and on what legal basis

• To process and deliver your order, keep you updated on its status and handle returns and guarantees: performance of the contract (Art. 6(1)(b) GDPR).
• For invoicing, accounting and legal obligations (for example, consumer protection and tax obligations): legal obligation (Art. 6(1)(c)).
• To reply to your messages, prevent fraud, keep the website secure and defend our rights: legitimate interest (Art. 6(1)(f)).
• For the newsletter and offers, only if you subscribe: consent (Art. 6(1)(a)). You can unsubscribe at any time from the link in any email.
• For statistics and personalised ads (for example, through the TikTok and Meta pixels): only with your consent in the cookie banner (Art. 6(1)(a)).

We don't make decisions based solely on automated processing that produce legal effects concerning you.

4. Who we share the data with

We don't sell your data. We only share it with the partners we need for the store to work, each of whom is required to protect it:

• Shopify: the platform the store runs on, including payment processing;
• courier companies: for delivery and, where applicable, collecting cash on delivery;
• our invoicing provider and accountant: to issue invoices and keep the accounts;
• email and infrastructure providers (for example, Google for email, Cloudflare for the domain);
• TikTok and Meta: only technical and browsing data, and only if you have accepted marketing cookies;
• public authorities: only when the law requires us to.

Some of these partners may process data outside the European Economic Area (for example, in Canada or the USA). In these cases, the transfer is based on an adequacy decision of the European Commission or on the standard contractual clauses approved by the Commission.

5. How long we keep the data

• Order and billing data: for as long as tax and accounting law requires (currently, up to 10 years for accounting documents).
• Data needed for returns, guarantees and any complaints: for the duration of the guarantee and the legal limitation period.
• Messages sent through forms or email: for as long as needed to resolve them, then at most 3 years.
• Newsletter data: until you unsubscribe.
• Cookies: for the duration shown in the cookie settings, at most 13 months for statistics and marketing cookies.

6. Cookies

We use strictly necessary cookies (for the cart, checkout and security), which don't require your consent, and, only with your consent, statistics and marketing cookies. You can accept, refuse or change your choice at any time from the banner shown on the website, through the "Manage preferences" option.

7. Your rights

You have the right to request access to your data, its rectification or erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time, without affecting the processing carried out before. For any of these rights, write to us at mitzasupport@gmail.com; we'll reply within one month at most.

If you're not satisfied, you can file a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

8. Security

The website uses an encrypted connection (HTTPS), and access to data is limited to the people and partners who need it to fulfil your order.

9. Minors

The website is not aimed at people under 16 and we don't knowingly collect data about them.

10. Changes

We may update this policy when the way we work or the law changes. The version in force is always the one published on this page, with the date of the last update.