Privacy and personal data

Data controller and data contact

OUTDOOR GEAR SRL · Tax identification number (CUI) RO32536423 · Trade Register J13/2548/2013.
Registered office and correspondence: str. Amurgului nr. 1, Corbu, Constanța County, Romania.
E-mail: contact@alphaboat.ro · Telephone: 0728872588.

This notice concerns personal data processed through Alphaboat. For requests concerning personal data, write to contact@alphaboat.ro.

Data used and legal basis for processing

• Enquiries and quotations: name, e-mail, telephone number and message content, to respond and take the requested pre-contractual steps (Article 6(1)(b) GDPR); for other enquiries, the legitimate interest in responding and documenting the relationship (point (f)).
• Orders and accounts, where available: identification, addresses, billing details, products, payment and transport, to perform the contract and provide the requested services (point (b)). We do not collect the card security code in our form.
• Invoicing and mandatory records: data required by tax, accounting and consumer protection legislation (point (c)), including statutory reporting to authorities.
• Returns, warranties and complaints: contract details, the reported issue and information needed to resolve it, based on the contract, legal obligations and, where applicable, the legitimate interest in defending rights (points (b), (c) or (f)).
• Security: IP address, technical data, access times and logs relevant to fraud prevention, troubleshooting and service protection (legitimate interest, point (f)), to the extent necessary.
• Optional services: statistics, browsing history, marketing or external content, only if they are active and you have selected the corresponding category. Consent can be withdrawn (point (a)); providers and storage are described in the cookies policy.
• Commercial communications: only as permitted by law, on the applicable legal basis communicated at collection. Refusal or unsubscribing does not affect messages required for an order, return or legal obligation.

Data comes mainly from you, from your use of the website and from updates provided by payment or transport providers. For a recipient designated by the purchaser, we use only the data needed for delivery; that recipient may request information and exercise their rights.

Required fields are indicated in the forms. Without essential data, we cannot provide the requested service. Do not send a personal identification number (CNP), copies of documents, medical data or other sensitive information unless it is necessary and has been requested from you with justification.

Who may receive the data

Internal access is limited to people who need the data for their duties. Hosting and technical support, e-mail, accounting and professional service providers may receive data, as may the carriers and payment providers involved in the request. Authorities may receive it as permitted by law. We do not sell personal data.

Providers receive the data needed for the purpose and have legal and contractual obligations appropriate to their role. For any optional service, consult the current list of services and providers. Being listed does not mean that the service loads before consent.

If processing involves a transfer outside the European Economic Area, it must be based on the applicable GDPR mechanisms, such as an adequacy decision or standard contractual clauses and, where necessary, supplementary measures. You can request information about the destination and a copy or description of the safeguards at the contact address.

How long we retain data

• Enquiries and quotations: for as long as needed to respond and negotiate; after closure, only the data needed for a legal obligation or to defend a right, for the applicable period.
• Account: for the duration of its administration; closure does not result in deletion of documents that must be retained separately for orders, accounting or disputes.
• Accounting documents: the general period under the Accounting Law is 5 years, calculated from 1 July of the year following the financial year in which they were drawn up, subject to any applicable special periods.
• Contracts, returns and warranties: for the duration of performance, the related obligations and the relevant limitation periods; a dispute or preservation obligation may justify limited retention until it ends.
• Cookies: specific durations appear in the dedicated policy; the preference is retained according to the displayed setting, and proof of the choice is retained for 365 days by the consent module.

The criteria apply to categories of data, rather than through unlimited retention of the entire profile. You can request clarification of the period applicable to your data. Data is deleted when there is no longer a basis for retention; we do not promise automatic deletion of all data immediately after account closure.

Rights and how to exercise them

Under the conditions of the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection. For processing based on legitimate interest, you may object on grounds relating to your situation; for direct marketing, you may object at any time. Consent may be withdrawn without affecting lawful earlier processing.

Write to contact@alphaboat.ro. We respond within one month of receipt; an extension of up to two months, permitted because of complexity or the number of requests, will be explained to you within the first month. We may request only the additional information strictly necessary if there are reasonable doubts about identity. Requests are generally free of charge; the only exceptions are those provided for by the GDPR.

You may lodge a complaint with ANSPDCP and seek a judicial remedy. We do not use solely automated decisions that produce legal effects or similarly significant effects on you.

Cookies, security and updates

Consent to optional cookies is separate from acceptance of contractual terms. You can refuse optional cookies or change your choice in “Cookie settings”. Read the policy and manage your preferences.

We apply technical and organisational measures appropriate to the risk, including access control and protection of communications. Nothing stated here guarantees absolute security or removes the controller’s obligations in the event of an incident.

We update the notice when processing changes. The version date appears at the beginning; a new purpose requiring consent is not authorised simply by amending this text.