1. Who We Are
The website therravia.com (the “Site”) is operated by SPRISE S.R.L., with its registered office at Bld. Uverturii, No. 102A, Ground Floor, Sector 6, Bucharest, Romania, registered with the Trade Register under no. J40/17479/2020, VAT ID RO43464314 (the “Controller”, “we”, “us”). The Controller processes your personal data in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable national legislation.
For any matters related to data protection, you can contact us at [email protected]
2. What Data We Collect
Order data: first name, last name, shipping and billing address, email address, phone number, products ordered, and order history;
Account data (if you create an account on the Site): email address, password (stored in encrypted form), and information saved in your profile;
Payment data: card payments are processed exclusively by our payment processor; we do not store your card details;
Billing data for legal entities: company name, VAT ID, Trade Register number, and registered office address;
Communication data: content of messages sent by email or communicated by phone to customer support;
Newsletter data: your email address, if you subscribe;
Technical data: IP address, browser and device type, pages viewed, and cookies (see Section 8).
3. Purposes and Legal Bases for Processing
Processing and delivering orders, managing payments, returns, and warranties – legal basis: performance of a contract (Article 6(1)(b) GDPR);
Issuing and retaining invoices, tax and accounting reporting – legal basis: legal obligation (Article 6(1)(c) GDPR);
Customer support and handling complaints – legal basis: performance of a contract and our legitimate interest in providing quality services (Article 6(1)(b) and (f) GDPR);
Sending commercial communications (newsletter) – legal basis: your consent (Article 6(1)(a) GDPR), which may be withdrawn at any time using the unsubscribe link included in each email;
Fraud prevention, establishment or defence of legal claims, and Site security – legal basis: legitimate interest (Article 6(1)(f) GDPR);
Analytics and marketing through non-essential cookies – legal basis: consent provided through the cookie banner (Article 6(1)(a) GDPR).
Providing the data required to process your order is necessary for entering into the contract. Failure to provide this information will make it impossible for us to fulfil your order.
4. Who We Share Your Data With
Your personal data may be disclosed, strictly to the extent necessary, to the following categories of recipients acting as processors or independent controllers:
Courier companies, for order delivery;
Payment processors, for card payments;
IT service providers, web hosting providers, and Site maintenance providers;
Email and email marketing service providers (for newsletters);
Accounting and legal service providers;
Public authorities, where required by law.
We do not sell or rent your personal data to third parties.
5. Transfers of Data Outside the EEA
As a general rule, data is processed within the European Union / European Economic Area (EEA). If certain service providers (for example, hosting or analytics providers) process data outside the EEA, such transfers are made only where appropriate safeguards are in place under the GDPR, such as adequacy decisions or Standard Contractual Clauses approved by the European Commission.
6. How Long We Retain Your Data
Order and invoice data – for the period required by applicable tax and accounting legislation;
Account data – until your account is deleted at your request;
Newsletter data – until you withdraw your consent (unsubscribe);
Customer support correspondence – for the period necessary to resolve your request and subsequently for the duration of any applicable limitation periods;
Cookies – according to the lifespan of each cookie (see Section 8).
7. Your Rights
Under the GDPR, you have the following rights:
The right to access your personal data;
The right to rectify inaccurate or incomplete data;
The right to erasure (“right to be forgotten”), subject to applicable legal requirements;
The right to restriction of processing;
The right to data portability;
The right to object, including to processing for direct marketing purposes;
The right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.
To exercise these rights, please submit a request to [email protected]. We will respond within one month of receiving your request. This period may be extended by an additional two months in complex cases, in which case you will be informed accordingly.
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru No. 28-30, Sector 1, Bucharest, www.dataprotection.ro, or to seek judicial remedies before the competent courts.
8. Cookies
The Site uses cookies and similar technologies:
Strictly necessary cookies – these ensure the proper functioning of the Site, including the shopping cart, login session, and checkout process. These cookies do not require consent and cannot be disabled;
Analytics and marketing cookies – these help us understand how the Site is used and allow us to display relevant offers. They are activated only with your consent, provided through the cookie banner, and may be disabled at any time through the cookie settings.
You can also manage or delete cookies through your browser settings. Blocking strictly necessary cookies may affect the functionality of the Site.
9. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure, including encrypted connections (SSL/TLS), restricted access to data, encrypted password storage, and working exclusively with service providers that offer appropriate security safeguards.
10. Minors
The Site is intended for persons aged 18 or older. We do not knowingly collect personal data from minors. If we become aware that we have collected such data without the consent of the person holding parental responsibility, we will delete it as soon as possible.
11. Changes to This Policy
We may update this Policy periodically. The current version, together with the date of the latest update, will always be published on this page. Significant changes will be communicated to users through appropriate means.
12. Contact
Controller: SPRISE S.R.L.
Bld. Uverturii, No. 102A, Ground Floor, Sector 6, Bucharest, Romania
Email: [email protected]