Privacy policy

In short

The controller of your data is Calantha S.R.L.. For any question, write to us at contact@tivona.ro.
We use your data mainly to accept, deliver and invoice your orders.
We do not sell your data and we never receive your card details.
The newsletter and detailed visit statistics only start with your consent; we do not use advertising cookies, and we remember which promotional messages (popups) you have seen from one visit to the next only if you accept the “Marketing” category.
You can ask at any time to access, correct or erase your data, and you can complain to ANSPDCP.

1.Who we are

The controller of your personal data, meaning the company that decides why and how it is used, is:

Company: Calantha S.R.L.
Tax ID (CUI): RO32669608
Trade Register no.: J12/121/2014
Registered office: Sat Legii 222, Com. Geaca, Transilvania, România
Email: contact@tivona.ro
Phone: +40 766 467 649

This policy applies to the demo.tivona.ro website and the Tivona online shop, your customer account, the emails we send you and orders. We process data under Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 implementing it, and Romanian Law no. 506/2004 on personal data processing and privacy in electronic communications.

We have not appointed a data protection officer (DPO), because our activities do not fall within the cases where the law requires one (Art. 37 GDPR). For any question about your data, write to us at contact@tivona.ro.

2.What data we process and where it comes from

We only use the data we need for the purposes in section 3:

identification and contact details: your name, email and phone number;
delivery and billing addresses and, if you buy as a business, the company name, tax ID (CUI) and Trade Register number;
order data: products, prices, discounts, delivery and payment method, invoices, returns and refunds (including your IBAN for refunds by bank transfer);
account data: your password (kept only as a cryptographic hash), security settings, favourites list;
content you send us: messages, reviews, photos, reports;
technical data: your IP address (used as an irreversible hash, pseudonymised in the newsletter consent proof or only temporarily), browser and device type and, only with your consent, the pages you visit;
your preferences: newsletter subscription, your cookie banner choice, the site language.

Where the data comes from

from you, when you order, create an account, write to us, leave a review or subscribe;
from someone who orders for you (for example, your name and address as the recipient of a gift);
from payment processors and couriers: payment confirmation and delivery status;
from your browser, automatically: the technical data above.

Do you have to give us your data?

The details marked as required at checkout are needed to enter into and perform the contract and to issue the invoice: without them we cannot accept and deliver your order. Everything else (an account, the newsletter, reviews, visit statistics) is optional.

We do not ask for health data. We only process it if you send it to us in a report about a reaction to a product (section 5). We do not sell or rent your data.

3.Why we use your data, on what legal basis and for how long

The table below shows, for each purpose, what data we use, the legal basis under the GDPR and how long we keep it. When the periods end, the data is deleted or anonymised.

Purposes of processing: data used, legal basis and retention period
Purpose	Data	Legal basis	How long we keep it
Orders and invoicing	Your name, email, phone number, delivery and billing addresses, company details (if you ask for a company invoice), the products, prices, coupon, delivery and payment method, order status, invoice and the emails about your order.	Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR): receiving, confirming and delivering your orderLegal obligation (Art. 6(1)(c) GDPR): invoicing and accounting records	10 years from the end of the financial year in which the documents were drawn up (Article 25 of Romanian Accounting Law no. 82/1991)
Delivery	Your name, phone number, email, delivery address or chosen parcel locker, parcel details (weight, amount payable on delivery), the tracking number and the delivery status received from the courier.	Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR)	Together with the order (see the “Orders and invoicing” row). The courier keeps its own records under its own policy.
Payment	The amount, order number, chosen processor, transaction ID and status, and any refunds. You enter your card details (number, expiry date, CVV) directly on the processor’s secure page: we never receive or store them.	Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR)Legal obligation (Art. 6(1)(c) GDPR): accounting records	Payment and refund records: 10 years from the end of the financial year in which the documents were drawn up (Article 25 of Romanian Accounting Law no. 82/1991).
Withdrawal from the contract, returns, guarantee claims and complaints	The order and products concerned, the reason and description of the problem, any photos you send, the refund method and, for refunds by bank transfer, the IBAN and account holder, plus our correspondence. When you withdraw from the contract using the function on the site, we also keep the declaration itself: the products you gave up, the message you wrote if you wrote one, and the date and time you pressed the button.	Legal obligation (Art. 6(1)(c) GDPR): the right of withdrawal (OUG no. 34/2014), the guarantee of conformity (OUG no. 140/2021) and accounting recordsPerformance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR)	Return and refund documents: 10 years from the end of the financial year in which the documents were drawn up (Article 25 of Romanian Accounting Law no. 82/1991). Withdrawal declarations, with their content, date and time, are kept for the same period, because they are our proof that we sent you the acknowledgement required by Article 11^1 of OUG no. 34/2014. Correspondence: until the matter is resolved, then 3 years (the general limitation period, Article 2517 of the Romanian Civil Code).
Customer account	Your name, email, password (kept only as a cryptographic hash, never in plain text), phone number, account type and company details, favourites list and order and return history. If you turn on two-step verification: the secret key (encrypted), recovery codes (hashes only) and trusted devices (browser and operating system, last IP address, usage and expiry dates).	Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR): creating and running your account at your requestLegitimate interests (Art. 6(1)(f) GDPR): keeping your account secure (trusted devices)	For as long as you have the account. If you ask us to close it, we delete or anonymise the account data within one month, except for orders and invoices, which we keep for as long as the law requires.Trusted devices: until they expire (30 days) or you revoke them.Password reset link: 1 hour.
Guest orders later linked to an account	The email used for the order and the guest orders placed with the same address.	Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR): at your request, after you confirm through the emailed link that the address is yours. After the first confirmation, later guest orders placed with the same address appear in your account automatically.	Confirmation link: 24 hours. Orders: as in the “Orders and invoicing” row.
The contact form and messages you send us	Your name, email, phone number (optional), message and the page language. Your IP address is used only temporarily, in the server’s memory, to limit automated submissions.	Legitimate interests (Art. 6(1)(f) GDPR): answering your questionsPerformance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR): when your message is about an order	Your message reaches us by email and is not saved in the site’s database. We keep it for as long as we need to reply; if it concerns an order or a complaint, for up to 3 years after the matter is resolved.
Newsletter and back-in-stock alerts	Your email, where you subscribed (the site footer, a promotional window (popup) or an out-of-stock product page, with the product name), the date of consent, your subscription status and the sending history (which campaign we sent you and whether it went out).The “Notify me” form on an out-of-stock product subscribes you to the newsletter, as stated under the form: the newsletter is also how you hear when the product is back in stock.Subscribing from a promotional window (popup) only becomes active after you confirm it using the link we email you (double opt-in). If the window offers a discount code, we keep a record of whether we have sent you the welcome code, so that each address receives it only once. If you subscribe while signed in with the same address, the subscription may be linked to your account.If you have unsubscribed before, a new request through the “Notify me” form only becomes active after you confirm it using the link we email you (double opt-in).The confirmation link is valid for 48 hours. When a subscription is confirmed by email, we keep proof of your consent: the text you accepted (and the window in which you saw it), the date, the language and, from the time of the request and of the confirmation, your pseudonymised IP address (never in clear) and your browser and operating system (user agent).	Your consent (Art. 6(1)(a) GDPR): subscribing through the form or the promotional window (popup). You can unsubscribe at any time using the link in every email.	Until you unsubscribe. After that we keep your address marked as unsubscribed and the date, to respect your choice and to be able to prove consent; you can also ask us to delete it, together with the proof of consent.We keep the proof of consent for as long as you are subscribed. After you unsubscribe, the pseudonymised IP address and browser in the proof, and the link to your account, are deleted; the accepted text, the date and the language remain.A subscription request you do not confirm is deleted, together with its proof, 7 days after the confirmation link expires. If the address had already unsubscribed, it stays unsubscribed, and the text shown, the date and the language remain from the request, without the pseudonymised IP address and browser.Sending history: 90 days after the campaign is sent.
Skin analysis (questionnaire)	Your answers stay on your device and do not reach us (section 4).	Not applicable: we do not process your answers on our servers.	We do not keep them.
Adverse reaction reports	Your contact details, the product and batch, a description of the reaction and the information about your health that you give us.	Legal obligation and reasons of public interest in the area of public health (Art. 6(1)(c) and Art. 9(2)(i) GDPR); details in section 5.	See section 5.
Site security and fraud prevention	Sign-in attempts (the email used, the result, the date and an irreversible hash of the IP address), temporary lockouts after too many attempts, trusted devices, the IP address and browser type used temporarily to limit repeated requests and filter automated traffic (bots), and signs of fraud in orders and payments.	Legitimate interests (Art. 6(1)(f) GDPR): protecting accounts, the shop and customers against unauthorised access, abuse and fraud	Security log: 180 days. Data used to limit requests: only in the server’s memory, for a few minutes. Trusted devices: until they expire or you revoke them.
Visit statistics	Only with your consent: the page visited, the domain of the site you came from, time spent on the page, a random session identifier (kept in your browser) and a visitor identifier calculated on the server from an irreversible hash of your IP address and browser, which changes every day. Your IP address is not saved. Without consent, your visit is only added to a daily total.	Your consent (Art. 6(1)(a) GDPR): given in the cookie banner, also as required by Article 4(5) of Romanian Law no. 506/2004Legitimate interests (Art. 6(1)(f) GDPR): the daily visit total, with no details, and filtering out bots	400 days. The daily total contains no personal data.
Legal obligations and legal claims	The data from the rows above that is relevant to a request from an authority, an inspection or a dispute.	Legal obligation (Art. 6(1)(c) GDPR)Legitimate interests (Art. 6(1)(f) GDPR): establishing, exercising or defending legal claims	For the duration of the proceedings and the applicable limitation period (generally 3 years).

Purpose: Orders and invoicing
Data
Your name, email, phone number, delivery and billing addresses, company details (if you ask for a company invoice), the products, prices, coupon, delivery and payment method, order status, invoice and the emails about your order.
Legal basis
Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR): receiving, confirming and delivering your orderLegal obligation (Art. 6(1)(c) GDPR): invoicing and accounting records
How long we keep it
10 years from the end of the financial year in which the documents were drawn up (Article 25 of Romanian Accounting Law no. 82/1991)
Purpose: Delivery
Data
Your name, phone number, email, delivery address or chosen parcel locker, parcel details (weight, amount payable on delivery), the tracking number and the delivery status received from the courier.
Legal basis
Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR)
How long we keep it
Together with the order (see the “Orders and invoicing” row). The courier keeps its own records under its own policy.
Purpose: Payment
Data
The amount, order number, chosen processor, transaction ID and status, and any refunds. You enter your card details (number, expiry date, CVV) directly on the processor’s secure page: we never receive or store them.
Legal basis
Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR)Legal obligation (Art. 6(1)(c) GDPR): accounting records
How long we keep it
Payment and refund records: 10 years from the end of the financial year in which the documents were drawn up (Article 25 of Romanian Accounting Law no. 82/1991).
Purpose: Withdrawal from the contract, returns, guarantee claims and complaints
Data
The order and products concerned, the reason and description of the problem, any photos you send, the refund method and, for refunds by bank transfer, the IBAN and account holder, plus our correspondence. When you withdraw from the contract using the function on the site, we also keep the declaration itself: the products you gave up, the message you wrote if you wrote one, and the date and time you pressed the button.
Legal basis
Legal obligation (Art. 6(1)(c) GDPR): the right of withdrawal (OUG no. 34/2014), the guarantee of conformity (OUG no. 140/2021) and accounting recordsPerformance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR)
How long we keep it
Return and refund documents: 10 years from the end of the financial year in which the documents were drawn up (Article 25 of Romanian Accounting Law no. 82/1991). Withdrawal declarations, with their content, date and time, are kept for the same period, because they are our proof that we sent you the acknowledgement required by Article 11^1 of OUG no. 34/2014. Correspondence: until the matter is resolved, then 3 years (the general limitation period, Article 2517 of the Romanian Civil Code).
Purpose: Customer account
Data
Your name, email, password (kept only as a cryptographic hash, never in plain text), phone number, account type and company details, favourites list and order and return history. If you turn on two-step verification: the secret key (encrypted), recovery codes (hashes only) and trusted devices (browser and operating system, last IP address, usage and expiry dates).
Legal basis
Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR): creating and running your account at your requestLegitimate interests (Art. 6(1)(f) GDPR): keeping your account secure (trusted devices)
How long we keep it
For as long as you have the account. If you ask us to close it, we delete or anonymise the account data within one month, except for orders and invoices, which we keep for as long as the law requires.Trusted devices: until they expire (30 days) or you revoke them.Password reset link: 1 hour.
Purpose: Guest orders later linked to an account
Data
The email used for the order and the guest orders placed with the same address.
Legal basis
Performance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR): at your request, after you confirm through the emailed link that the address is yours. After the first confirmation, later guest orders placed with the same address appear in your account automatically.
How long we keep it
Confirmation link: 24 hours. Orders: as in the “Orders and invoicing” row.
Purpose: The contact form and messages you send us
Data
Your name, email, phone number (optional), message and the page language. Your IP address is used only temporarily, in the server’s memory, to limit automated submissions.
Legal basis
Legitimate interests (Art. 6(1)(f) GDPR): answering your questionsPerformance of a contract, or steps you ask for before entering into one (Art. 6(1)(b) GDPR): when your message is about an order
How long we keep it
Your message reaches us by email and is not saved in the site’s database. We keep it for as long as we need to reply; if it concerns an order or a complaint, for up to 3 years after the matter is resolved.
Purpose: Newsletter and back-in-stock alerts
Data
Your email, where you subscribed (the site footer, a promotional window (popup) or an out-of-stock product page, with the product name), the date of consent, your subscription status and the sending history (which campaign we sent you and whether it went out).The “Notify me” form on an out-of-stock product subscribes you to the newsletter, as stated under the form: the newsletter is also how you hear when the product is back in stock.Subscribing from a promotional window (popup) only becomes active after you confirm it using the link we email you (double opt-in). If the window offers a discount code, we keep a record of whether we have sent you the welcome code, so that each address receives it only once. If you subscribe while signed in with the same address, the subscription may be linked to your account.If you have unsubscribed before, a new request through the “Notify me” form only becomes active after you confirm it using the link we email you (double opt-in).The confirmation link is valid for 48 hours. When a subscription is confirmed by email, we keep proof of your consent: the text you accepted (and the window in which you saw it), the date, the language and, from the time of the request and of the confirmation, your pseudonymised IP address (never in clear) and your browser and operating system (user agent).
Legal basis
Your consent (Art. 6(1)(a) GDPR): subscribing through the form or the promotional window (popup). You can unsubscribe at any time using the link in every email.
How long we keep it
Until you unsubscribe. After that we keep your address marked as unsubscribed and the date, to respect your choice and to be able to prove consent; you can also ask us to delete it, together with the proof of consent.We keep the proof of consent for as long as you are subscribed. After you unsubscribe, the pseudonymised IP address and browser in the proof, and the link to your account, are deleted; the accepted text, the date and the language remain.A subscription request you do not confirm is deleted, together with its proof, 7 days after the confirmation link expires. If the address had already unsubscribed, it stays unsubscribed, and the text shown, the date and the language remain from the request, without the pseudonymised IP address and browser.Sending history: 90 days after the campaign is sent.
Purpose: Skin analysis (questionnaire)
Data
Your answers stay on your device and do not reach us (section 4).
Legal basis
Not applicable: we do not process your answers on our servers.
How long we keep it
We do not keep them.
Purpose: Adverse reaction reports
Data
Your contact details, the product and batch, a description of the reaction and the information about your health that you give us.
Legal basis
Legal obligation and reasons of public interest in the area of public health (Art. 6(1)(c) and Art. 9(2)(i) GDPR); details in section 5.
How long we keep it
See section 5.
Purpose: Site security and fraud prevention
Data
Sign-in attempts (the email used, the result, the date and an irreversible hash of the IP address), temporary lockouts after too many attempts, trusted devices, the IP address and browser type used temporarily to limit repeated requests and filter automated traffic (bots), and signs of fraud in orders and payments.
Legal basis
Legitimate interests (Art. 6(1)(f) GDPR): protecting accounts, the shop and customers against unauthorised access, abuse and fraud
How long we keep it
Security log: 180 days. Data used to limit requests: only in the server’s memory, for a few minutes. Trusted devices: until they expire or you revoke them.
Purpose: Visit statistics
Data
Only with your consent: the page visited, the domain of the site you came from, time spent on the page, a random session identifier (kept in your browser) and a visitor identifier calculated on the server from an irreversible hash of your IP address and browser, which changes every day. Your IP address is not saved. Without consent, your visit is only added to a daily total.
Legal basis
Your consent (Art. 6(1)(a) GDPR): given in the cookie banner, also as required by Article 4(5) of Romanian Law no. 506/2004Legitimate interests (Art. 6(1)(f) GDPR): the daily visit total, with no details, and filtering out bots
How long we keep it
400 days. The daily total contains no personal data.
Purpose: Legal obligations and legal claims
Data
The data from the rows above that is relevant to a request from an authority, an inspection or a dispute.
Legal basis
Legal obligation (Art. 6(1)(c) GDPR)Legitimate interests (Art. 6(1)(f) GDPR): establishing, exercising or defending legal claims
How long we keep it
For the duration of the proceedings and the applicable limitation period (generally 3 years).

Where we rely on legitimate interests, we have first weighed our interest against your rights and we limit ourselves to what is necessary. You can object to this processing at any time (section 9). You can withdraw consent at any time, without affecting processing carried out before.

4.Skin analysis

The skin analysis on the site (the questionnaire about your skin) runs entirely on your device, in your browser: from your answers we show you your estimated skin type, the needs that stand out and the ritual that suits you. Your answers and your result are not sent to our servers, we do not store them on our side and we do not link them to your account. Nobody at Tivona sees them.

So that you can come back to your result without retaking the questionnaire, your answers stay saved in your browser’s local storage, under the key “tivona-ritual-answers”. They delete themselves 180 days after your last answer, and until then you can delete them at any time, immediately, with the “Retake the analysis” button on the result page or by clearing the site’s data in your browser. If you add the recommended products to your cart, your cart is saved in your browser as well, as with any purchase (see our Cookie policy).

The result is a suggestion of cosmetic products, not a diagnosis or medical advice, and it has no legal effect on you. If you have a skin condition, ask a dermatologist for advice.

5.Adverse reaction reports

If you report an unexpected reaction to a product, as explained in our Terms and conditions, you also send us information about your health. This is a special category of data (Art. 9 GDPR), so we handle it with extra care and limit access to the people dealing with the case.

Data: Your name and contact details, the product and batch number, when you started using it, where you applied it, a description of the reaction, any treatment you received and photos, if you send them.
Why: To assess the case and reply to you, to notify serious undesirable effects to the competent authority (in Romania, the Ministry of Health) and to monitor product safety.
Legal basis: The legal obligation in Article 23 of Regulation (EC) No 1223/2009 on cosmetic products (Art. 6(1)(c) GDPR) and, for health data, reasons of public interest in the area of public health, ensuring product safety (Art. 9(2)(i) GDPR). If we need to defend legal claims, Art. 9(2)(f) GDPR.
Who receives it: The responsible person for the product (named on the packaging), if that is not us, the product’s safety assessor and, for serious effects, the Ministry of Health. We only share data that identifies you when it is necessary.
How long we keep it: Data that identifies you: for as long as the case is being assessed, then up to 3 years (the general limitation period). Information about the effect observed, without data that identifies you, may stay in the product information file for as long as that file must be kept: 10 years after the last batch was placed on the market (Article 11 of Regulation (EC) No 1223/2009).

6.Who we share data with

We do not sell or rent your data. We only share it with those who need it for the purposes above:

providers working on our behalf, under contract and bound to keep the data confidential and secure: website hosting, email delivery, invoicing, technical monitoring and IT maintenance;
partners who also process the data on their own account, for the service they provide to you: payment processors and banks, couriers;
our accountant, auditors and lawyers, who are bound by confidentiality;
the responsible person for the cosmetic products and public health authorities, only for adverse reaction reports;
public authorities and bodies (for example the tax authority ANAF, the consumer protection authority ANPC, the data protection authority ANSPDCP, courts or the police), only when the law requires it or to defend our rights;
a potential buyer or successor of the business, if it is reorganised or sold, with the same safeguards for your data.

Providers we may use

Depending on the services active at any given time, we may use the following providers:

Providers that may receive personal data: their role, where they process data and transfer safeguards
Provider	What it does	Where	Transfer safeguards
Hosting provider	Hosts the site, the database and backups.	We will give you the details (company and server location) on request.	—
Resend (Plus Five Five, Inc.)	Sends the site’s emails: order confirmations and updates, account emails, the newsletter and messages from the contact form.	USA	Certified under the EU-U.S. Data Privacy Framework
Banca Transilvania S.A. (BT iPay)	Processes card payments on the bank’s secure page.	Romania	Not applicable (EEA)
NETOPIA Payments (Netopia Financial Services S.A.)	Processes card payments on the processor’s secure page.	Romania	Not applicable (EEA)
Stripe (Stripe Payments Europe, Limited)	Processes card payments on Stripe’s secure page.	Ireland; some data reaches Stripe, LLC in the USA	Data Privacy Framework and the European Commission’s standard contractual clauses
SmartBill (Intelligent IT S.R.L.)	Issues invoices and, where required, submits them to the Romanian e-Factura system.	Romania	Not applicable (EEA)
FGO (i-Tom Solutions S.R.L.)	Issues invoices and, where required, submits them to the Romanian e-Factura system.	Romania	Not applicable (EEA)
Sameday (Delivery Solutions S.A.)	Delivers parcels to your address or to easybox lockers.	Romania	Not applicable (EEA)
Ecolet (Alsendo group)	Courier platform: passes the delivery details to the courier chosen for the parcel (for example DPD, FAN Courier, Cargus, GLS, Sameday or Poșta Română).	Romania and the European Union	Not applicable (EEA)
UploadThing (T3 Tools, Inc.)	Stores the images we publish on the site (products, articles). It receives no data about customers or visitors: images reach you through our own server.	USA	Not applicable: we do not send it customers’ personal data

Provider: Hosting provider
What it does
Hosts the site, the database and backups.
Where
We will give you the details (company and server location) on request.
Transfer safeguards
—
Provider: Resend (Plus Five Five, Inc.)
What it does
Sends the site’s emails: order confirmations and updates, account emails, the newsletter and messages from the contact form.
Where
USA
Transfer safeguards
Certified under the EU-U.S. Data Privacy Framework
Provider: Banca Transilvania S.A. (BT iPay)
What it does
Processes card payments on the bank’s secure page.
Where
Romania
Transfer safeguards
Not applicable (EEA)
Provider: NETOPIA Payments (Netopia Financial Services S.A.)
What it does
Processes card payments on the processor’s secure page.
Where
Romania
Transfer safeguards
Not applicable (EEA)
Provider: Stripe (Stripe Payments Europe, Limited)
What it does
Processes card payments on Stripe’s secure page.
Where
Ireland; some data reaches Stripe, LLC in the USA
Transfer safeguards
Data Privacy Framework and the European Commission’s standard contractual clauses
Provider: SmartBill (Intelligent IT S.R.L.)
What it does
Issues invoices and, where required, submits them to the Romanian e-Factura system.
Where
Romania
Transfer safeguards
Not applicable (EEA)
Provider: FGO (i-Tom Solutions S.R.L.)
What it does
Issues invoices and, where required, submits them to the Romanian e-Factura system.
Where
Romania
Transfer safeguards
Not applicable (EEA)
Provider: Sameday (Delivery Solutions S.A.)
What it does
Delivers parcels to your address or to easybox lockers.
Where
Romania
Transfer safeguards
Not applicable (EEA)
Provider: Ecolet (Alsendo group)
What it does
Courier platform: passes the delivery details to the courier chosen for the parcel (for example DPD, FAN Courier, Cargus, GLS, Sameday or Poșta Română).
Where
Romania and the European Union
Transfer safeguards
Not applicable (EEA)
Provider: UploadThing (T3 Tools, Inc.)
What it does
Stores the images we publish on the site (products, articles). It receives no data about customers or visitors: images reach you through our own server.
Where
USA
Transfer safeguards
Not applicable: we do not send it customers’ personal data

7.Transfers outside the European Economic Area

Most of our providers process data in Romania or elsewhere in the European Economic Area (EEA). Some data leaves the EEA, only with the safeguards required by Chapter V of the GDPR:

Resend, for sending emails (USA): based on the adequacy decision adopted by the European Commission on 10 July 2023 for the EU-U.S. Data Privacy Framework, under which the provider is certified;
Stripe, if you pay through Stripe: some data reaches Stripe, LLC (USA), based on the same framework and the standard contractual clauses adopted by the European Commission;

You can ask for information about these safeguards, or a copy of them, by writing to contact@tivona.ro.

8.How we protect your data

We take technical and organisational measures appropriate to the risk, including:

the connection to the site is encrypted (HTTPS), and browsers are told to always use it;
passwords are stored only as cryptographic hashes, never in plain text;
you can turn on two-step verification; secret keys are encrypted, and trusted devices can be revoked from your account at any time;
after too many failed sign-in attempts, access is temporarily locked;
only authorised accounts can access the admin panel, and their permissions are checked again regularly;
card details never pass through our servers;
public forms are protected against automated submissions, and the personal links we email you (password reset, returns, reviews) expire.

If a personal data breach poses a risk to you, we notify ANSPDCP within 72 hours of becoming aware of it and, if the risk is high, we also tell you without undue delay (Articles 33 and 34 GDPR).

No transmission over the internet is completely secure. Please keep your password confidential and use two-step verification.

9.Your rights

Under the GDPR, you have the following rights over your personal data:

Access (Art. 15): To find out whether we process data about you and to receive a copy of it, together with information about how we use it.
Rectification (Art. 16): To correct inaccurate data or complete incomplete data. You can change much of it yourself in your account.
Erasure (Art. 17): To ask for your data to be erased (the “right to be forgotten”), for example when it is no longer needed or you withdraw consent. We cannot erase data the law requires us to keep (such as invoices) or that we need to defend legal claims.
Restriction (Art. 18): To ask us to limit how we use your data, for example while we check its accuracy or consider your objection.
Portability (Art. 20): To receive the data you gave us that we process by automated means, based on a contract or consent, in a structured, commonly used and machine-readable format, or to have it sent directly to another controller where technically possible.
Objection (Art. 21): To object, on grounds relating to your situation, to processing based on our legitimate interests. You can object to the use of your data for direct marketing at any time, without giving a reason.
Withdrawing consent (Art. 7): At any time, as easily as you gave it: using the unsubscribe link, the cookie button or by writing to us. Withdrawal does not affect processing carried out before it.
Automated decisions (Art. 22): We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The skin analysis only suggests products (section 4). Payment processors and banks may run their own automated fraud checks (such as 3-D Secure) under their own policies.

10.How to exercise your rights

To exercise any of your rights, write to us at contact@tivona.ro, ideally from the email address you use for orders or your account. You can also do some things yourself:

in your account you can change your profile details (Profile) and manage your password, two-step verification and trusted devices (Security);
you can unsubscribe from the newsletter using the link in every email;
you can change your cookie choice using the “Cookies” button in the bottom left corner of the page (shown after your first choice) or the “Change cookie preferences” button in our Cookie policy.

We reply without undue delay and within one month of receiving your request. If the request is complex or we receive many requests, this may be extended by two further months; in that case we tell you within the first month and explain why (Art. 12(3) GDPR).

Exercising your rights is free of charge. If a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse it, with an explanation. To make sure your data only goes to you, we may ask for additional information to confirm your identity.

When we correct or erase data or restrict its processing, we also inform the recipients we shared it with, where possible (Art. 19 GDPR).

11.Complaints to the supervisory authority

If you believe we process your data unlawfully, please write to us first so we can look into it. However, you always have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), even if you have not written to us first. In Romania, this is:

Supervisory authority

National Supervisory Authority for Personal Data Processing (ANSPDCP)

B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postcode 010336, Bucharest, Romania

anspdcp@dataprotection.ro · www.dataprotection.ro (opens in a new tab)

You can also complain to the supervisory authority in the Member State where you live, work or where the alleged infringement took place. You can also go to the competent court.

12.Children

The site is not aimed at children. Orders must be placed by people aged 18 or over, as set out in our Terms and conditions.

For online services that rely on consent (such as the newsletter or visit statistics), you can give consent yourself from the age of 16 (Art. 8 GDPR; Romanian law has not lowered this age). Below that age, consent must be given or authorised by a parent or guardian.

We also have products designed for teenagers. We recommend that they are chosen together with a parent, and that the parent places the order using their own details.

If you find out that a child under 16 has sent us data without parental consent, write to us at contact@tivona.ro and we will delete it.

14.Changes to this policy

We update this policy when the data we process, our providers or the law change. The new version is published on this page with the date of the last update. If a change is significant (for example, a new purpose or a new type of data), we will also tell you by email or with a visible notice on the site before it applies.