Privacy policy
Last updated: 14 October 2026
1. Data controller
The controller of your personal data is Cosmetics Market SRL, with its registered office at Str. Pădurii nr. 66, Sc. A, Et. 1, Ap. 6, Florești, Cluj County, Romania, registered with the Trade Register under no. J2025038130008, VAT no. RO51876715, e-mail contact@amavo.ro, phone 0752-481-247 (“AMAVO”, “we”). For any question or request about personal data, write to us at contact@amavo.ro.
2. What data we process, why and on what legal basis
| Situation | Data | Purpose | Legal basis (GDPR, art. 6) |
|---|---|---|---|
| Order and delivery | name, address, phone, e-mail, products ordered, payment data (without card details) | processing the order, delivery, invoicing, returns, guarantee | performance of the contract – art. 6(1)(b) |
| Invoicing and accounting | the data on the invoice | tax and accounting obligations | legal obligation – art. 6(1)(c) |
| Customer account (optional) | e-mail, encrypted password, addresses, order history | quick access to orders and addresses | performance of the contract – (b) |
| Contact form, e-mail, phone | name, e-mail, phone, order number, the message | replying to the request | legitimate interest – (f) / performance of the contract – (b) |
| Newsletter and free guide | sending the guide and news | consent – (a), withdrawable at any time via the unsubscribe link | |
| Skin test | your answers; your e-mail only if you ask for the routine by e-mail | recommending a routine | consent – (a) |
| Reviews | first name, e-mail, skin type, review text | publishing the review, verifying the purchase | consent – (a) |
| Security and fraud prevention | IP address, device and transaction data | protecting the store and payments | legitimate interest – (f) |
| Analytics and marketing cookies | online identifiers, activity on the site | statistics, personalised ads | consent – (a), via the “Cookie settings” banner |
We do not take automated decisions with legal effects concerning you. We do not knowingly collect data from children under 16.
3. Who we share data with
We share data only as far as necessary, with:
- Shopify International Limited (Ireland) – the online store platform, acting as processor;
- SameDay Courier SRL – parcel delivery;
- payment processors, for card payments and bank transfers;
- the e-mail marketing provider, for the newsletter;
- our accountant and advisers, who are bound by confidentiality;
- public authorities, only when required by law.
Some providers may process data outside the European Economic Area (e.g. the USA or Canada). In these cases the transfer is based on an adequacy decision of the European Commission or on standard contractual clauses approved by the Commission. We do not sell your data.
4. How long we keep data
| Data | Period |
|---|---|
| Orders, invoices, accounting documents | the periods set by financial and accounting law (currently up to 10 years) |
| Customer account | until the account is deleted |
| Correspondence and complaints | 3 years after the request is closed |
| Newsletter | until you unsubscribe |
| Reviews | as long as the review is published or until consent is withdrawn |
| Cookies | according to the period in the cookie settings, usually no more than 13 months |
5. Your rights
Under the GDPR you have the right:
- of access to the data we hold about you;
- to rectification of inaccurate data;
- to erasure of data (“right to be forgotten”), as provided by law;
- to restriction of processing;
- to data portability;
- to object, including to direct marketing, at any time;
- to withdraw your consent at any time, without affecting processing carried out before.
Requests should be sent to contact@amavo.ro. We reply within one month of receipt at most. We may ask for additional information to confirm your identity.
You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro.
6. Data security
We use appropriate technical and organisational measures: encrypted connection (HTTPS), access to data limited to the people who need it, and GDPR-compliant providers.
7. Cookies
We use cookies strictly necessary for the store to work (cart, login, security) and, only with your consent, analytics and marketing cookies. You can change your choice at any time from the “Cookie settings” link in the page footer.
8. Changes
We may update this policy. The version in force is published on the Site, with the date of the last update. We will inform you by e-mail of important changes.