We consider protecting the right to privacy and personal data protection to be a fundamental commitment of Gift Express. Therefore, we will dedicate all necessary resources and efforts to process your personal data in full compliance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), as well as with any other applicable legislation in Romania.
Since one of the essential principles of this legal framework is transparency, we have prepared this document to inform you about how we collect, use, transfer, and protect your personal data when you interact with us in connection with our products and services, including through our website or mobile applications.
We reserve the right to periodically update and amend this Privacy Policy to reflect any changes in the way we process your personal data or any changes in legal requirements. In the event of any such changes, we will publish the amended version of the Privacy Policy on our website. For this reason, we recommend that you periodically review the content of this Privacy Policy.
Who we are and how you can contact us
Gift Express is the commercial name of SC Fun Design SRL, a Romanian legal entity, with its registered office in Timișoara, 27 Divizia 9 Cavalerie Street, registered with the Trade Register under no. J35/1813/2003, unique tax registration number RO15651694 (hereinafter referred to as “Gift Express”, “we”, “us” or “our”).
For the purposes of data protection legislation, we act as the data controller when processing your personal data.
As we are always open to receiving your feedback and providing any additional information you may need regarding the processing of your personal data, we encourage you to contact the Gift Express Data Protection Officer at contact@giftexpress.ro, or by mail or courier at:
Str. Divizia 9 Cavalerie nr. 27, Timișoara, Jud. Timiș, Romania
with the indication: For the attention of the Gift Express Data Protection Officer.
Data Subject Rights
1. Data Controller
The controller of the personal data processed through www.giftexpress.ro is SC Fun Design SRL, with unique tax registration number RO15651694.
For questions regarding the processing of personal data or for exercising your rights, you may contact us using the contact details provided on the website.
2. What personal data we process
Depending on how you use the Gift Express website and services, we may process the following categories of personal data:
- first and last name;
- email address;
- telephone number;
- billing address;
- delivery address;
- data necessary for account identification and authentication;
- an identifier associated with your Facebook/Meta or Google account when you use authentication through these services;
- information regarding placed orders;
- products ordered;
- information regarding billing, payment, delivery, returns and complaints;
- information provided when you contact us;
- technical data necessary for the operation and security of the website, such as IP address, device type, browser and information regarding website access;
- information regarding cookie preferences, where applicable.
We do not collect or process more data than is necessary for the purposes described in this Privacy Policy.
3. Purposes for which we process personal data
Personal data is processed for the following purposes:
3.1. Creating and managing your account
The data necessary for your account is used for:
- creating and managing your Gift Express account;
- identifying the user;
- authenticating the user;
- maintaining the authentication session;
- securing the account;
- preventing unauthorized access.
3.2. Processing orders
We process the necessary data for:
- registering and processing orders;
- confirming orders;
- preparing the ordered products;
- communicating with the customer regarding the order;
- managing order changes and cancellations;
- handling returns;
- resolving complaints and requests related to orders.
3.3. Order billing
The necessary data is used for:
- issuing invoices and documents related to orders;
- maintaining accounting records of orders;
- complying with tax and accounting obligations;
- retaining financial and accounting documents in accordance with applicable legislation.
3.4. Order delivery
The necessary data is used for:
- preparing and shipping orders;
- providing the necessary information to the courier service;
- delivering products to the address indicated by the customer;
- contacting the customer regarding delivery, when necessary.
For delivery purposes, we may provide the courier company with the data strictly necessary for delivery, such as the recipient's name, delivery address and telephone number, when the telephone number is available and necessary for delivery.
3.5. Payment processing
When payment is made through a payment service provider, the data necessary to complete the transaction may be transmitted to that provider.
Gift Express does not request or store passwords, PIN codes or banking account authentication credentials of customers.
Bank card details are processed by the payment service provider, when online payment is available, in accordance with that provider's terms and conditions.
3.6. Communication with customers
Contact details may be used for:
- confirming orders;
- providing information regarding orders;
- communicating regarding delivery;
- responding to customer questions and requests;
- handling returns and complaints;
- necessary communications regarding requested services.
3.7. Website security
Certain technical data may be processed for:
- securing the website;
- preventing unauthorized access;
- preventing fraud and misuse;
- detecting and investigating security incidents;
- maintaining the proper operation of the website.
3.8. Compliance with legal obligations
Data may be processed where necessary to comply with legal obligations, including tax, accounting, commercial or record-keeping obligations.
3.9. Establishing, exercising and defending legal rights
Data may be processed, in accordance with applicable law, for the establishment, exercise or defense of legal rights and legitimate interests before competent authorities or courts.
4. Facebook / Meta Login
Gift Express offers the possibility of signing in to your account through Facebook Login, provided by Meta.
When you use Facebook Login, Gift Express may receive certain information associated with your Facebook/Meta account, depending on the information available and the permissions granted.
The data received through Facebook Login may include:
- the unique identifier associated with your Facebook/Meta account;
- first and last name;
- email address, if provided by Facebook/Meta;
- telephone number, if provided by Facebook/Meta;
- other basic information necessary to identify and manage the account, if provided during the authentication process.
Purposes for which Facebook/Meta data is used
Data received through Facebook Login is used only for purposes necessary to provide Gift Express services, including:
- identifying the user;
- signing in to the Gift Express account;
- creating and managing the account;
- associating the Facebook/Meta account with the Gift Express account;
- processing orders;
- billing orders;
- delivering orders;
- communicating with the customer regarding orders, billing and delivery;
- securing the account and preventing unauthorized access.
The email address and telephone number received from Facebook/Meta are used only if these data are provided by Facebook/Meta and only to the extent necessary for processing, billing and delivering orders or for communicating with the customer in connection with such orders.
Gift Express does not request access through Facebook Login to data that is not necessary to provide its services.
Data received through Facebook Login is not sold, rented or commercially provided to third parties.
Gift Express does not use data received through Facebook Login for personalized advertising or user profiling for advertising purposes.
5. Use of Facebook/Meta data for orders
When a user authenticated through Facebook Login places an order, Gift Express may use the data available from the account associated with the authentication, including the name, email address and/or telephone number, if these have been provided by Facebook/Meta.
This data may be used for:
- identifying the customer;
- processing the order;
- issuing documents related to the order;
- billing;
- preparing and shipping the order;
- delivering the products;
- contacting the customer regarding the order or delivery.
For delivery purposes, the data necessary to complete the delivery may be provided to the courier company, such as the name, delivery address and telephone number, when available and necessary for delivery.
The data is used only to the extent necessary to fulfill these purposes.
6. Google Login
Gift Express may allow authentication through Google.
Data provided through this method is used only to the extent necessary to identify, authenticate and manage the Gift Express account.
If information such as the user's name or email address is provided by Google during the authentication process, it may be used to manage the account and, when the user places an order, to process, bill and deliver that order.
Gift Express does not request access to data that is not necessary to provide its services.
7. Legal basis for processing
Depending on the purpose of the processing, personal data may be processed on the following legal bases:
- performance of a contract or taking steps at the user's request prior to entering into a contract;
- compliance with a legal obligation;
- the legitimate interests of the controller, where applicable and where such interests do not override the rights and freedoms of the data subject;
- the user's consent, where required.
For processing, billing and delivering an order, certain data is necessary for the performance of the contract and for compliance with legal obligations.
Providing such data may be necessary to complete and deliver an order.
8. Who may receive personal data
Personal data may be disclosed only when necessary to fulfill the purposes described in this Privacy Policy or to comply with legal obligations.
Depending on the circumstances, recipients may include:
- hosting and IT infrastructure service providers;
- payment service providers;
- courier and delivery companies;
- accounting and tax service providers, where applicable;
- technical service providers necessary for the operation of the website;
- public authorities and institutions, where disclosure is required by law.
Only the data necessary to perform the relevant service is provided to these recipients.
Gift Express does not sell or rent customers' personal data.
9. Data provided to courier companies
For delivery purposes, certain necessary data may be provided to the courier company.
This may include:
- recipient's name;
- delivery address;
- telephone number, when available and necessary for delivery;
- email address, where applicable, for sending the parcel pickup PIN as an alternative to the telephone number;
- information regarding the shipment.
The data is provided exclusively for the purpose of processing and completing the delivery.
10. Cookies and similar technologies
The Gift Express website may use cookies and similar technologies for:
- proper operation of the website;
- user authentication;
- maintaining sessions;
- storing certain preferences;
- website security;
- statistical analysis of website usage, where applicable.
Cookies that are strictly necessary for the operation of the website may be used in accordance with applicable legislation.
For other categories of cookies, where required, their use is based on the user's preferences.
11. Data security
Gift Express applies appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration or unauthorized disclosure.
Access to data is limited to persons and service providers who need such data to perform their duties or services.
12. Data retention period
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or for as long as retention is required by applicable law.
Data relating to orders and financial/accounting documents is retained in accordance with the periods required by tax and accounting legislation.
Data associated with a user account may be retained for as long as the account remains active, except for data that we are legally required to retain for a longer period.
After the applicable retention period expires, the data will be deleted, anonymized or archived in accordance with applicable law.
13. Account and data deletion
Users may request deletion of their account and personal data by contacting Gift Express using the contact details available on the website.
For an account created or used through Facebook Login, the user may also request deletion of data associated with Facebook/Meta authentication.
Following a valid request, Gift Express will delete data that is no longer necessary to provide the services or comply with a legal obligation.
Certain data may continue to be retained where there is a legal obligation to retain it or where retention is necessary for the establishment, exercise or defense of legal rights.
14. User rights
Under applicable law, users have the following rights:
- the right to access their personal data;
- the right to rectification of inaccurate or incomplete data;
- the right to erasure of data;
- the right to restriction of processing;
- the right to object to certain processing activities;
- the right to data portability, under the conditions provided by law;
- the right to withdraw consent where processing is based on consent;
- the right to lodge a complaint with the competent data protection authority.
To exercise these rights, you may contact us using the contact details available on the website.
15. Data protection complaints
If you believe that the processing of your personal data violates applicable data protection legislation, you may contact us to clarify and resolve the matter.
You also have the right to lodge a complaint with the competent supervisory authority.
In Romania, the competent authority is:
National Supervisory Authority for Personal Data Processing (ANSPDCP)
Website: www.dataprotection.ro
Without affecting your right to contact the supervisory authority at any time, we kindly ask you to contact us first, and we promise to make every effort necessary to resolve any issue amicably.
16. Children's data
Gift Express does not intentionally seek to collect personal data from persons who do not have the legal capacity to use the services provided.
If you believe that personal data belonging to a person who was not entitled to use the services has been provided to Gift Express, you may contact us so that we can verify the situation and, where appropriate, delete the data.
17. Changes to the Privacy Policy
Gift Express may update this Privacy Policy to reflect legislative, technical or operational changes.
The current version will be published on this page and will indicate the date of the latest update.
We recommend that you periodically review this page to stay informed about any changes.
18. Contact
For questions regarding data protection, to exercise your rights, or to request deletion of your account and data associated with Facebook/Meta authentication, you may contact us using the contact details published on:
Data deletion
You may request that we delete your personal data, but only where:
- the data is no longer necessary for the purposes for which it was collected; or
- you have withdrawn your consent, where the processing was based on consent; or
- you exercise a valid legal right to object; or
- the data has been processed unlawfully; or
- we are legally required to delete it.
We are not required to comply with a request to delete your personal data where processing is necessary:
- to comply with a legal obligation; or
- for the establishment, exercise or defense of a legal claim.
There are certain other circumstances in which we may not be required to comply with a request for deletion, although the two circumstances above are the most likely situations in which such a request may be refused.
Please note that, before exercising this right, you should download from your Gift Express account and save all documents relating to orders placed with Gift Express, regardless of whether the invoice was issued to you or to another individual or legal entity (such as invoices and warranty certificates). If you do not do so before exercising your right to deletion, you will lose access to these documents and Gift Express may be unable to provide them to you afterwards, as the deletion of the data and the Gift Express account, together with all associated data and documents, is an irreversible process.
Restriction of processing
You may request that we restrict the processing of your personal data, but only where:
- the accuracy of the data is contested, allowing us to verify its accuracy; or
- the processing is unlawful, but you do not want the data to be deleted; or
- we no longer need the data for the purposes for which it was collected, but you need it to establish, exercise or defend a legal claim; or
- you have exercised your right to object and verification of whether our legitimate interests prevail is still pending.
We may continue to use your personal data following a request for restriction where:
- we have your consent; or
- this is necessary for the establishment, exercise or defense of a legal claim; or
- this is necessary to protect the rights of Gift Express or another natural or legal person.
Data portability
You may request that we provide your personal data in a structured, commonly used and machine-readable format, or request that such data be transferred directly to another data controller, but only where:
- the processing is based on your consent or on the conclusion or performance of a contract with you; and
- the processing is carried out by automated means.
Objection
You may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on our legitimate interests, where you consider that your fundamental rights and freedoms override those interests.
You may also object at any time to the processing of your data for direct marketing purposes (including profiling), without having to provide a reason. In such cases, we will cease this processing as soon as reasonably possible.
Automated decision-making
You may request not to be subject to a decision based solely on automated processing, but only where that decision:
- produces legal effects concerning you; or
- similarly significantly affects you.
This right does not apply where the automated decision:
- is necessary for entering into or performing a contract with you;
- is authorized by law and appropriate safeguards exist for your rights and freedoms; or
- is based on your explicit consent.