Privacy Policy

Ether Collection S.R.L. ("D'Ether", "we", "us", or "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your personal information when you visit our website dether.ro ("Website") or purchase our products, in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Romanian Law 190/2018.

1. Data Controller

The data controller responsible for your personal data is:

• Company: Ether Collection S.R.L.
• Address: Aleea Teișani 89, Camera 1, Sector 1, București, Romania
• Tax ID (CIF): 51198965
• Trade Register: J2025005844004
• Email: [email protected]
• Phone: +40 729 602 982

2. What Data We Collect

We may collect and process the following categories of personal data:

2.1 Data you provide directly

• Identity data: first name, last name.
• Contact data: email address, telephone number, delivery address, billing address.
• Account data: username, password (encrypted), order history, preferences.
• Payment data: payment card details, bank account information (processed securely by our payment providers; we do not store full card numbers).
• Communication data: correspondence with us, including emails, contact form submissions, and customer service interactions.
• Newsletter/waitlist data: email address provided for marketing communications or product launch notifications.

2.2 Data collected automatically

• Browsing data: IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, time spent on pages, and clickstream data.
• Cookie data: information collected through cookies and similar technologies (see our Cookie Policy for details).
• Location data: approximate geographical location inferred from your IP address.

3. Purposes of Processing

We process your personal data for the following purposes:

• Order fulfilment: processing, shipping, and delivering your orders; managing payments and refunds; communicating order status updates.
• Account management: creating and managing your customer account; authenticating your identity.
• Customer service: responding to your enquiries, complaints, and support requests.
• Marketing and newsletters: sending promotional communications, product launch announcements, and newsletters (only with your explicit consent).
• Analytics and improvement: analysing Website usage to improve our products, services, and user experience; conducting market research.
• Legal compliance: fulfilling our legal obligations, including tax reporting, fraud prevention, and responding to lawful requests from authorities.
• Security: protecting the Website against fraud, abuse, and unauthorised access.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)): processing is necessary to fulfil our contractual obligations, including order processing, delivery, and payment handling.
• Consent (Art. 6(1)(a)): for marketing communications, newsletters, waitlist sign-ups, and non-essential cookies. You may withdraw your consent at any time.
• Legitimate interest (Art. 6(1)(f)): for Website analytics, security, fraud prevention, and improving our services, provided that such interests are not overridden by your fundamental rights and freedoms.
• Legal obligation (Art. 6(1)(c)): to comply with applicable laws, including tax legislation, consumer protection, and accounting requirements.

5. Data Retention Periods

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

After the applicable retention period expires, personal data will be securely deleted or anonymised.

6. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We may share your data with the following categories of recipients, only to the extent necessary:

• Payment processors: to securely process your transactions (e.g., Stripe, or other payment gateway providers). These processors are PCI DSS compliant and act as independent data controllers for payment data.
• Delivery and courier partners: to fulfil and deliver your orders (name, address, phone number, and order details are shared as necessary).
• Hosting and IT service providers: for website hosting, maintenance, and email delivery. These providers process data on our behalf under data processing agreements.
• Analytics providers: for website analytics (e.g., Google Analytics), using anonymised or pseudonymised data where possible.
• Legal authorities: when required by law, court order, or to protect our rights, property, or safety.

All third-party service providers are bound by contractual obligations to protect your data and use it only for the specified purposes.

7. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). In cases where data is transferred to countries outside the EEA (for example, when using certain service providers), we ensure that appropriate safeguards are in place, including:

• European Commission adequacy decisions (Art. 45 GDPR).
• Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR).
• Binding Corporate Rules where applicable.

You may request a copy of the applicable safeguards by contacting us at the details provided below.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): you may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): you may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): you may request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to restriction of processing (Art. 18): you may request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): you may request your data in a structured, commonly used, and machine-readable format, and have it transmitted to another controller.
• Right to object (Art. 21): you may object to the processing of your personal data based on legitimate interest or for direct marketing purposes.
• Right not to be subject to automated decision-making (Art. 22): you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days, or inform you if an extension is necessary (up to a further 60 days for complex requests).

9. Right to Withdraw Consent

Where we process your personal data based on your consent (e.g., marketing communications, non-essential cookies), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You can withdraw consent by:

• Clicking the "unsubscribe" link in any marketing email.
• Adjusting your cookie preferences through the cookie settings on our Website.
• Contacting us directly at [email protected].

10. Right to Lodge a Complaint

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Romanian supervisory authority:

• Authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, Romania
• Email: [email protected]
• Website: www.dataprotection.ro

We encourage you to contact us first so we can attempt to resolve your concern before you escalate to the supervisory authority.

11. Cookies

Our Website uses cookies and similar technologies. For comprehensive information about the types of cookies we use, their purposes, durations, and how to manage your cookie preferences, please refer to our Cookie Policy.

12. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our servers.
• Encrypted storage of passwords using industry-standard hashing algorithms.
• Regular security updates and vulnerability assessments of our systems.
• Access controls limiting data access to authorised personnel only, on a need-to-know basis.
• Secure payment processing through PCI DSS-compliant third-party providers.
• Regular data backups with encrypted storage.

While we strive to protect your personal data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you and the relevant authorities promptly in the event of a data breach as required by the GDPR.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on our Website.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

• Privacy Contact: Ether Collection S.R.L.
• Address: Aleea Teișani 89, Camera 1, Sector 1, București, Romania
• Email: [email protected]
• Phone: +40 729 602 982