Privacy policy

Last updated: 31 October 2026

This policy explains how we use your personal data when you visit andraandreescu.com, order from us, write to us or withdraw from a purchase.

1. Who we are

The controller of your personal data is ANDREESCU ANDRA-CĂTĂLINA PERSOANĂ FIZICĂ AUTORIZATĂ (brand Andra Andreescu), registered in the Romanian Trade Register under no. F40/2617/17.06.2022, EUID ROONRC.F40/2617/2022, fiscal code (CUI) 46323000.
Address: Strada Dragoș Vodă 70, Sector 2, 020748 București, Romania.
Email: contact@andraandreescu.com · Phone: +40 746 125 898.

We have not appointed a data protection officer; the law does not require one for a business of our size. For any question about your data, write to contact@andraandreescu.com.

2. What we use, why, and on what legal basis

Your order. Name, delivery and billing address, email, phone number, the pieces you order, size or measurements, price, payment method and payment status. We use them to make and deliver your piece, to invoice it, to answer you, and to handle withdrawals, alterations and guarantee claims. Legal basis: the contract with you (art. 6(1)(b) GDPR); for invoicing and accounting, our legal obligations (art. 6(1)(c) GDPR).
We never see or keep your full card number: card details go directly to the payment provider.

Measurements for made-to-measure pieces. The body measurements you send us are used only to cut and fit your piece and to alter or remake it under the guarantee. Legal basis: the contract.

Cash on delivery (Romania only). Your name, address, phone number and the amount to collect are given to FAN Courier, which collects the payment from you and transfers it to us. Legal basis: the contract.

Invoices and RO e-Factura. Romanian law requires us to send every invoice to the Romanian tax authority (ANAF) through the RO e-Factura system. The invoice shows your name, address, the pieces and the amount. We do not ask for your personal numeric code (CNP); the invoice uses the code the law allows for customers who do not give one. Legal basis: legal obligation.

Withdrawal from a purchase. When you use “Withdraw from contract here”, you give your name, order number and email. We and our provider Revoq use them to record your withdrawal, to send you a receipt with its content, date and time, and to refund you. Legal basis: legal obligation (consumer law) and the contract.

Messages. When you email, call or use the contact form, we use what you send us to answer. Legal basis: the contract or steps before it, or our legitimate interest in answering you (art. 6(1)(f) GDPR).

Newsletter (only if you sign up). Your email and whether you open our emails, to send you news of the atelier. Legal basis: your consent (art. 6(1)(a) GDPR). Every email has an unsubscribe link.

Strictly necessary cookies and browser storage. The shop needs some cookies to keep your bag, run the checkout, remember your country, language and currency, keep the site secure and remember your cookie choice. Your favourites and your choice of one or two pieces per row are kept only in your own browser (local storage, keys “aa:favourites” and “aa:grid-view”); they are never sent to us and you can clear them in your browser. These need no consent, because they are strictly necessary for a service you ask for (Romanian Law 506/2004, art. 4(6)(b)). Legal basis for any personal data involved: our legitimate interest in a working, secure shop.

Analytics and advertising (only with your consent). If you accept them in the cookie banner:

  • Google Analytics 4, connected through Shopify’s Google & YouTube app with Google Consent Mode, measures how the site is used and how our Google advertising performs.
  • Meta Pixel and Conversions API, connected through Shopify’s Facebook & Instagram app, measure visits and purchases from our Instagram and Facebook advertising. With “advanced matching”, details you give at checkout (such as email, phone, name, city and country) are hashed (turned into a one-way code) and sent to Meta so that it can match the visit to a Meta account.
    Legal basis: your consent (art. 6(1)(a) GDPR and Law 506/2004, art. 4(5)). You can withdraw it at any time with “Cookie preferences” at the bottom of every page; this does not affect what happened before. If you decline, these tools do not run.

Security and fraud prevention. IP address, device and order data, to protect the shop and to check payments. Shopify and the payment provider screen orders for fraud. When you send the contact form or use the “Your privacy choices” page, hCaptcha (Intuition Machines, Inc., USA), which Shopify uses to keep out robots, receives your IP address and browser data. Legal basis: our legitimate interest in preventing fraud. We make no decision about you based solely on automated processing that has legal or similarly significant effects; if an order is flagged, we look at it ourselves.

Legal claims. Where needed, we use the order records to establish or defend legal claims. Legal basis: our legitimate interest.

You do not have to give us your data, but without the details needed for an order we cannot take or deliver it. The newsletter and the analytics and advertising cookies are optional.

3. Who receives your data

We share only what each recipient needs. We do not sell your personal data.

  • Shopify (Shopify International Limited, Ireland) hosts our shop, checkout and order emails and processes data for us (processor). Shopify also uses data about your visits and orders, together with data from other shops and from Shopify, for services such as fraud prevention, Shop Pay, the Shop app and, only if you accept marketing cookies, ad measurement and targeting (Shopify Network Intelligence). Shopify’s privacy policy for customers: shopify.com/legal/privacy/consumers. To withdraw consent or object to this processing by Shopify: privacy.shopify.com.
  • Google (Google Ireland Limited) hosts our email and work files (Google Workspace) and processes the messages and order documents we keep there for us (processor).
  • Payments. Card, Apple Pay and Google Pay payments are processed by Shopify Payments and its payment partners. Apple and Google also process your data under their own terms when you use their wallets. If you use Shop Pay, Shopify processes your Shop account data under its own privacy policy. If you choose PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) receives the data needed for the payment, as a separate controller.
  • Revoq, the withdrawal form on our site (BuschBytes, Jonas Busch, Cologne, Germany), processor. It stores withdrawal data in the European Union and deletes it 90 days after you send it. We keep our own copy as proof (see section 6). Revoq’s privacy policy: consumer-withdrawal.eu/privacy.
  • FAN Courier Express SRL (Romania): delivery in Romania, cash-on-delivery collection and returns.
  • DHL (DHL Express and its local companies): delivery outside Romania and returns. For countries outside the EU, DHL gives the customs authorities of the destination country the data needed for customs clearance.
  • Our accountant, and the invoicing software we use for invoices (SmartBill), process invoice and payment data for us (processors).
  • ANAF, the Romanian tax authority, receives every invoice through RO e-Factura (legal obligation). Other authorities, courts or our advisers receive data only where the law requires it or to defend a claim.
  • Google (Google Ireland Limited) for Google Analytics and advertising measurement, only with your consent. Google’s privacy policy: policies.google.com/privacy.
  • Meta (Meta Platforms Ireland Limited) for the Meta Pixel and Conversions API, only with your consent. We and Meta are joint controllers for collecting these data on our site and sending them to Meta (as the Court of Justice of the EU decided in case C-40/17, Fashion ID). Meta has agreed to handle the rights you have for that part, under its Controller Addendum; what Meta does afterwards is its own responsibility. Meta’s privacy policy: facebook.com/privacy/policy.
  • Our bank receives the payouts of your payments.

4. Transfers outside the European Economic Area

Some recipients (Shopify, Google, Meta, hCaptcha, payment providers) may process data in Canada or the United States. Canada has an adequacy decision of the European Commission; for the United States, transfers rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on the European Commission’s standard contractual clauses. When we ship outside the EU, the delivery and customs data go to the destination country because this is necessary to perform our contract with you (art. 49(1)(b) GDPR).

5. How we protect your data

Access to the shop admin is limited to the people who make and ship your piece, each with their own account. Our providers are bound by contract to keep data secure and confidential.

6. How long we keep your data

  • Invoices and accounting records: 5 years from the end of the year in which they were issued, as Romanian accounting and tax law requires.
  • Orders, messages, withdrawal receipts and complaints: until the 2-year legal guarantee has ended and the 3-year limitation period for claims after it has passed, then deleted.
  • Withdrawal data at Revoq: deleted by Revoq 90 days after you send it; our own copy is kept as above.
  • Measurements: with your order, as above; earlier on request, unless we need them for a guarantee claim or a dispute.
  • Newsletter: until you unsubscribe. We then keep only your email on a do-not-contact list, so we do not write to you again.
  • Google Analytics data: 14 months.
  • Cookies and browser storage: as listed on our Cookies page. Your favourites stay in your browser until you clear them.

7. Your rights

You have the right to:

  • access your data and get a copy (art. 15 GDPR);
  • have it corrected (art. 16);
  • have it erased (art. 17), unless we must keep it, for example on invoices;
  • restrict its use (art. 18);
  • receive it in a common electronic format, or have it sent to another company (portability, art. 20);
  • object to uses based on our legitimate interest, and at any time to direct marketing (art. 21);
  • withdraw your consent at any time (art. 7(3));
  • not be subject to a decision based solely on automated processing with legal or similarly significant effects (art. 22).

Write to contact@andraandreescu.com. We answer within one month; if a request is complex, we may extend this by two more months and tell you why. We may ask you to confirm your identity first.

You also have the right to complain to the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, Romania, anspdcp@dataprotection.ro, www.dataprotection.ro, or to the authority in the country where you live or work, and to go to court.

8. Children

Our shop is not meant for children under 16, and we do not knowingly collect their data.

9. Changes

When we change this policy, we publish the new version here with a new date. If a change matters to you, we tell you by email.

ANPC – SAL