Privacy (GDPR)
1. Data Controller
TCP GLOBAL EOOD Popești-Leordeni Branch, with its registered office in Popești-Leordeni, 26 Amurgului St., Unit 7, Ilfov County, registered under CUI RO53112331, hereinafter referred to as the “Controller”.
Contact: ask@dppstore.eu
Data Protection Officer (DPO): Given the volume and nature of its activities, the company is not legally required to appoint a DPO. Any requests regarding personal data may be sent directly to the email address above.
2. What Data We Process
We process only the data strictly necessary for the operation of the online store and the team program, and to fulfill your orders:
Identification and contact information: First name, last name, email address, phone number.
Billing and shipping information: Full shipping address, billing address, bank details (in the event of product returns).
Company information (if applicable): Company name, Tax Identification Number (CUI), registered office address (information that may indirectly contain personal data).
Partner company registration data (team program): Company name, VAT number, address, contact person, company e-mail, phone, the company’s e-mail domain.
Team member account data: First name, last name, work e-mail address, password (stored encrypted by the Wix platform), associated company (derived from the e-mail domain).
Terms and Conditions acceptance log: E-mail address, account identifier, company, date and time, version of the Terms accepted, language.
Program participation data: Discount codes issued, the product chosen in a campaign, date of the pick, orders placed.
Communication log: E-mails sent by the platform (recipient, subject, delivery status).
Browsing and technical data: IP address, browser type, pages visited on our website, via cookies (details in the Cookie Policy).
3. Purposes and Legal Bases
Order processing and delivery: Receiving, validating, and shipping products, and managing returns.
Legal basis: Performance of a contract to which you are a party (Art. 6(1)(b) of the GDPR).
Invoicing and tax obligations: Issuing tax invoices, maintaining accounting records, and reporting to government authorities (ANAF).
Legal basis: Compliance with a legal obligation of the Controller (Art. 6(1)(c) of the GDPR).
Team program eligibility check: When an account is created we check whether the e-mail domain belongs to an active partner company, so that only team members of registered companies get access.
Legal basis: Performance of the contract and the Controller’s legitimate interest in protecting the private program (Art. 6(1)(b) and (f) of the GDPR).
Proof of acceptance of the Terms and Conditions: We keep the acceptance log to be able to prove the conclusion of the contract and the applicable conditions.
Legal basis: Legal obligation and legitimate interest (Art. 6(1)(c) and (f) of the GDPR).
Program administration: Issuing and checking discount codes, limiting the campaign pick to one product per person, preventing abuse.
Legal basis: Performance of the contract and the Controller’s legitimate interest (Art. 6(1)(b) and (f) of the GDPR).
Account and order communications: Confirmations, discount codes, campaign notifications, sent through our e-mail provider.
Legal basis: Performance of the contract (Art. 6(1)(b) of the GDPR).
Customer support: Resolving complaints, questions, or requests submitted via email.
Legal basis: The Controller’s legitimate interest in providing quality services to its customers (Art. 6(1)(f) of the GDPR).
Direct marketing: Sending newsletters, special offers, or stock alerts (only if you have explicitly subscribed).
Legal basis: Your freely given consent (Art. 6(1)(a) of the GDPR).
4. Data Retention Period
We retain your data only for as long as necessary to fulfill the stated purposes:
Billing data and financial-accounting documents: These are retained for 10 years, in accordance with Romanian tax and accounting regulations.
Customer account data and order history: These are retained for the duration of the account’s existence or until you request its deletion, but for no less than the period necessary to defend our rights in court (the general statute of limitations of 3 years).
Terms acceptance log and program participation data: For the life of the account and 3 years after it is closed (general limitation period), or longer where the law requires.
Partner company data: For the duration of the participation in the program and 3 years after it ends.
Marketing data (newsletter): This data is retained until you withdraw your consent (by unsubscribing via the dedicated link at the bottom of the email).
5. Data Recipients (Who Else Has Access to the Data)
In order to conduct our online business, we share certain data with trusted partners under strict confidentiality agreements:
IT and Hosting Service Providers: The Wix.com platform, on which the site, member accounts, store and database run (which may store or transfer data outside the EU/EEA, ensuring adequate safeguards based on standard contractual clauses and recognized adequacy decisions).
E-mail service provider: Brevo (Sendinblue SAS, France) – the provider through which the platform’s e-mails are sent (confirmations, codes, notifications); a processor with servers in the EU.
Courier and Shipping Companies: For the physical delivery of packages (name, phone number, address).
Payment processors: For secure card transactions (card details are entered directly into the processor’s platform; our store does not collect or store them).
Accounting services: For recording invoices and maintaining tax records in Romania.
6. Your Rights Under the GDPR
As a data subject, you have the following rights, which you may exercise by submitting a written request to ask@dppstore.eu:
Right of access: To find out what data we process about you and under what conditions.
Right to rectification: To correct or complete inaccurate or incomplete data.
Right to erasure (“right to be forgotten”): To request the erasure of your data (unless this conflicts with legal retention obligations, such as tax-related ones).
Right to restriction of processing: To temporarily block the processing of your data in certain cases provided for by law.
Right to data portability: To receive your data in a structured format or to request its direct transfer to another controller.
Right to object: To object to processing based on our legitimate interest for reasons related to your particular situation.
Right to withdraw consent: At any time, for marketing communications (without affecting the lawfulness of prior processing).
Right to file a complaint: With the National Supervisory Authority for the Processing of Personal Data (ANSPDCP) by visiting the official ANSPDCP website.
7. Data Security
We implement rigorous technical and organizational measures to protect your data against accidental loss, unauthorized access, destruction, or alteration. Our website uses the SSL (HTTPS) encryption protocol to secure all data flows, and access to the database in the Wix dashboard is restricted exclusively to authorized personnel and verified contractual partners.
Legal References: Regulation (EU) 2016/679 (GDPR); Law No. 190/2018 on measures to implement the GDPR in Romania.
Last updated: 2 November 2026.