Orders — name, email, phone, delivery and billing address, the shirts you bought. To fulfil and deliver your order, email you its confirmation and handle returns (performance of a contract, GDPR art. 6(1)(b)).
Invoices and accounting records — to meet our tax and accounting obligations (legal obligation, art. 6(1)(c)).
Payments — handled by Stripe. We receive the payment status, never your card details.
Messages — what you send us by email or through the contact and withdrawal forms, to reply and handle your request (art. 6(1)(b) or our legitimate interest in answering you, art. 6(1)(f)).
Newsletter — your email address, your language and the date and time you confirmed, only if you subscribe and confirm through the link we email you (double opt-in; consent, art. 6(1)(a)). Every newsletter has a one-click unsubscribe link, and you can withdraw consent at any time.
Technical data — our hosting provider processes IP addresses and request logs to deliver the site and keep it secure, and tells us which country a visit comes from so we can show prices in your currency; we don't store it (legitimate interest, art. 6(1)(f)).
We don't use analytics or advertising trackers, we don't sell your data, and we make no automated decisions about you. Our fonts are hosted on our own server.
Who receives your data
Stripe — payment processing.
Vercel — website hosting.
The courier delivering your order — name, address and phone.
Resend — sends our emails: order and withdrawal confirmations and the newsletter, and keeps the newsletter list.
Our email inbox provider — for messages we exchange.
Some of these providers are based in the United States. Transfers outside the European Economic Area rely on the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
Order and accounting records are kept for as long as Romanian accounting law requires (up to 10 years). Messages are kept for up to 2 years after our last exchange. Newsletter data is kept until you unsubscribe; after that we keep only the record that you opted out, so we don't email you again.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing, data portability, and you can object to processing based on legitimate interest or withdraw your consent at any time. Email hello@vintagefootballshirts.ro; we reply within one month. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro).