Facebook Instagram Envelope Phone

Privacy Policy

Last updated: 14 October 2026

This policy explains what personal data DEFNE SELOS SRL (“Defne Selos”, “we”) processes when you visit www.defne.ro (the “Site”), contact us or take part in our contests and campaigns: why we use it, who we share it with, how long we keep it and what rights you have under Regulation (EU) 2016/679 on data protection (the “GDPR”).

This English version is provided for convenience. If there is any discrepancy between the two versions, the Romanian version prevails.

1. Who the data controller is

The data controller is DEFNE SELOS SRL, tax ID (CIF) 30391750, Trade Register no. J23/1873/2012, with its registered office at Șos. Petrăchioaia nr. 113, office no. 6, ground floor, Afumați, Ilfov County, Romania.

For any question about your personal data, you can write to us at it@defne.ro or call us on +40 733 996 617.

2. What data we process

  • Contact details and message content – when you write to us via the form on the Site or by email, or call us: your name, email address, phone number, the company you represent (if you tell us) and the content of your message.
  • Contest and campaign data – when you take part in our contests on Facebook and Instagram: your name or username, your answers and, if you are selected as a winner, the data needed for validation, delivery of the prize and compliance with tax obligations, as described in the rules of each campaign.
  • Browsing data – only if you accept statistics cookies: information about how you use the Site (pages visited, length of visit, device and browser type, approximate location), collected through Google Analytics.
  • Technical and security data – IP address, date and time of access and information about requests sent to the Site, collected automatically by the hosting server and the Site’s security systems.

3. Why we use the data and on what legal basis

  • To respond to your requests (wholesale quotes, product questions, partnerships) and for our business relationship with our partners. Legal basis: Art. 6(1)(b) GDPR – steps taken at your request before entering into a contract, or performance of a contract – and Art. 6(1)(f) GDPR – our legitimate interest in responding to the requests we receive.
  • To run contests and award prizes, including handling any complaints. Legal basis: Art. 6(1)(b) GDPR – participation in the contest under its rules – and Art. 6(1)(f) GDPR – our legitimate interest in running campaigns properly. We may record phone calls with winners, as evidence of what was agreed, only with their consent (Art. 6(1)(a) GDPR).
  • For marketing communications (information about new products, campaigns and contests), only if you have given your consent. Legal basis: Art. 6(1)(a) GDPR – consent, which you can withdraw at any time.
  • For statistics on how the Site is used, through Google Analytics, so we can understand which pages are useful and improve the Site. Legal basis: Art. 6(1)(a) GDPR – consent given through the cookie banner.
  • For the security of the Site – protection against cyber attacks, abusive access and unsolicited messages (spam). Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in keeping the Site secure.
  • To comply with legal obligations – for example, declaring and paying tax on prizes, keeping accounting records, archiving documents and, where the law requires it, publishing the names of winners. Legal basis: Art. 6(1)(c) GDPR.
  • To defend our rights before courts or other authorities. Legal basis: Art. 6(1)(f) GDPR.

4. Cookies and Google Analytics

The Site uses functional cookies, which it needs in order to work, and, only if you consent, statistics cookies through Google Analytics 4, a service provided by Google Ireland Limited. Google Analytics does not load until you accept statistics cookies.

Google Analytics shows us, in aggregate, how the Site is used. We do not use this data to identify you or for personalised advertising. The data may be transferred to Google LLC in the USA; the transfer is based on the European Commission’s adequacy decision on the EU–US Data Privacy Framework, under which Google LLC is certified.

You can give or withdraw your consent at any time from the “Manage consent” tab shown in the corner of the page. The full list of cookies, with the purpose and duration of each, is in our Cookie Policy (EU).

5. Social media

The Site contains links to our Facebook and Instagram pages, and our contests take place on these platforms. Data you publish there (for example, comments on contest posts) is also processed by Meta Platforms Ireland Limited, in accordance with its own privacy policies.

6. Who we share the data with

We do not sell your data. We may share it, strictly to the extent necessary, with:

  • providers who help us operate the Site and our communications, acting as processors: the web hosting provider, the email service provider, Google (for Google Analytics) and the providers of the Site’s security solutions;
  • partners involved in organising contests and awarding prizes, in accordance with the rules of each campaign;
  • public authorities and courts, where the law requires us to or to defend our rights.

7. How long we keep the data

  • Messages and requests – for as long as necessary to respond to them and for any business relationship that follows, then in line with the statutory limitation and archiving periods.
  • Winners’ data – 3 years from the date the prize is claimed or from the end of the claim period; accounting and tax documents are kept for the period required by law.
  • Security data – for a short period, as long as necessary to protect the Site.
  • Cookies – for the duration stated in the Cookie Policy (EU).

After these periods, the data is deleted or anonymised.

8. Your rights

  • Right of access – to find out whether we process data about you and to receive a copy of it.
  • Right to rectification – to correct inaccurate data or complete incomplete data.
  • Right to erasure – to ask for your data to be deleted when it is no longer necessary, when you withdraw your consent and there is no other legal basis, when it has been processed unlawfully or when the law requires its deletion.
  • Right to restriction of processing, under the conditions set out in the GDPR.
  • Right to data portability – to receive your data in a structured, commonly used and machine-readable format, or to ask for it to be sent to another organisation, where technically feasible.
  • Right to object – to object at any time to processing for marketing purposes and, on grounds relating to your particular situation, to processing based on our legitimate interest.
  • Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
  • Right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, postcode 010336, Bucharest, Romania, anspdcp@dataprotection.ro, www.dataprotection.ro. You can also complain to the data protection authority of the EU country where you live or work.

To exercise your rights, write to us at it@defne.ro. We will reply within one month of receiving your request; in complex cases this period may be extended by a further two months, in which case we will let you know.

9. How we protect the data

We use appropriate technical and organisational measures to protect the data: an encrypted connection (HTTPS) across the whole Site, a firewall and login protection for the administration area, regular updates of the software we use, and access to data limited to the people who need it.

10. Changes to this policy

We may update this policy when the way we process data or the applicable law changes. The version in force is published on this page, together with the date of the last update.