Privacy Policy (GDPR)
Last updated: 13 October 2026
1. Controller and contact details
The controller is [LEGAL BUSINESS NAME, LEGAL FORM AND CUI], registered at [FULL REGISTERED ADDRESS], which operates www.mossaic.ro and sells products under the Mossaic brand. Contact contact@mossaic.ro for all privacy matters. [ADD DPO CONTACT DETAILS IF ONE IS APPOINTED.] Shopify and other service providers may be processors or independent controllers for specific activities according to their applicable arrangements.
2. Data we may collect
Depending on how you interact with us, we may collect:
- Contact enquiries: your name, e-mail address, optional company, project category, message and voluntarily supplied details.
- Quotes and project calculator: dimensions, chosen moss and frame options, budget estimate, drawings, photos, installation details and other information provided for quotation.
- Shop orders: name, contact details, billing/delivery addresses, order lines, transaction references, invoices, order history, returns and support messages.
- Customer accounts, if enabled: identifiers, account details, preferences and associated orders.
- Marketing, if enabled: e-mail, marketing preferences, time/source of consent, evidence of sign-up and unsubscribe events.
- Technical information: IP address, security and access logs, device/browser details, cookie choices and, only where lawful, analytics or advertising information.
Please avoid sending unnecessary sensitive personal information. We do not intentionally request it in enquiry forms.
3. Why we process data, legal bases and retention
| Activity | Legal basis | Retention / criteria |
|---|---|---|
| Responding to contact and quote requests | GDPR Article 6(1)(b), steps at the individual's request before contract, or Article 6(1)(f) for general professional correspondence | [VERIFY PERIOD, e.g. 24 months after last interaction unless an order/dispute occurs] |
| Purchases, fulfilment, invoices, returns | Article 6(1)(b) contract and Article 6(1)(c) legal obligations | Contract term plus applicable statutory accounting, tax and claim periods |
| Complaints, fraud and security | Article 6(1)(c) legal obligation or Article 6(1)(f) legitimate interest, as applicable | [VERIFY ACTUAL PERIOD AND NEED] |
| Promotional e-mails | Usually Article 6(1)(a) consent; limited existing-customer exceptions only when the law permits them | Until opt-out/withdrawal and [SET INACTIVITY REVIEW PERIOD]; necessary consent evidence may be kept for legal defence |
| Non-essential analytics and advertising cookies | Consent, Article 6(1)(a) where personal data is processed, and applicable ePrivacy rules | As stated in the verified cookie inventory and your choices |
| Essential site security | Article 6(1)(f) legitimate interests and/or applicable obligations | [VERIFY, e.g. 30–90 days for routine logs unless an incident requires more] |
Replace all bracketed retention fields with the practices and technical settings actually used before publication. We retain personal information only as long as necessary for the applicable purpose or legal obligation.
4. Contact form versus marketing
We use an enquiry primarily to answer it. Submitting a form is not consent to receive newsletters. For promotional campaigns, we offer a separate, optional, initially unchecked opt-in where needed. You may unsubscribe at any time through the message link or by contacting us. Withdrawal does not affect prior lawful processing. Any limited exception for marketing similar products to existing customers is subject to the requirements of Romanian Law 506/2004, including an easy and free opt-out at collection and in each message.
5. Who receives information
Depending on the services actually deployed, personal information may be shared with hosting, e-mail and CRM suppliers, marketing software, Shopify, payment providers, couriers, accountants, technical support and lawfully configured analytics or advertising providers. [LIST REAL PROVIDERS AND CHECK DATA PROCESSING AGREEMENTS.] We do not disclose personal data to third parties for their independent marketing without an appropriate legal basis.
Our integrated store may use Shopify as processor and, for certain optional functions, as an independent controller. See Shopify's Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers. If Shopify Network Intelligence / Enhanced Services are enabled, add the further required advertising, Shopify-processing and opt-out disclosures, including https://privacy.shopify.com.
6. Transfers outside the EEA
Some providers may process information outside the European Economic Area. Where applicable, transfers rely on a permitted GDPR mechanism, such as an adequacy decision or standard contractual clauses, with supplementary safeguards when necessary. [VERIFY ACTUAL COUNTRIES, PROVIDERS AND TRANSFER TOOLS.] Ask us for information about relevant safeguards.
7. Your rights
Subject to GDPR conditions, you may request access, correction, deletion, restriction, portability, object to legitimate-interest processing and withdraw consent. You may also have rights regarding decisions made solely by automated means with significant effects. Write to contact@mossaic.ro. We generally respond within one month, subject to statutory extensions in complex cases, and may reasonably verify identity.
You may complain to Romania's data protection authority, ANSPDCP: https://www.dataprotection.ro/, or seek judicial redress.
8. Security and children
We use safeguards proportionate to risks, such as access controls, secure communications and limited staff access. No service can promise absolute security. Our services are not specifically aimed at children, and we do not intentionally target minors with promotional communications.
9. Cookies and amendments
See the Cookie Policy for tracking information and available controls. If processing materially changes, we will update this notice and provide any additional notice or request any consent legally required. Questions: contact@mossaic.ro.