Privacy policy

Who we are

Antohi Cosmina-Izabela PFA is the controller of personal data processed for www.cosminaizabela.ro, course sales and customer relations.

Contact us at contact@cosminaizabela.ro or 0754543138. Our registered address and full identification details are available in the Legal notice. This policy explains how data is processed; it is not blanket consent to its use.

What data we use and why

We receive data from you, from your use of the store and course, and from providers involved in orders, payments and service delivery.

  • Orders and payments: name, email, telephone, billing and tax details where necessary, purchased products, order value and status, discounts and payment references. We use these for steps you request before purchase, performance of the contract, and tax and accounting obligations.
  • Account and course: authentication, enrolment, access status and period, lesson progress and participation certificate details. We use these to provide the course and related support under the contract. Access is activated automatically after payment confirmation and is available for 365 days. Authentication uses email.
  • Statements and requests: statements concerning immediate course supply, their version and language, order and product references, messages and complaints. We use these to perform the contract, meet legal obligations and, where necessary, pursue the legitimate interest of establishing, exercising or defending legal rights.
  • Operation and security: IP address, browser and device information, activity and technical records. We use these to operate the service and pursue the legitimate interest of preventing fraud, abuse and incidents, after assessing necessity and the impact on your rights.
  • Communications and preferences: email, subscription choices, consents and interactions relevant to analytics, personalisation and marketing. We rely on consent where required; any other basis must meet applicable legal requirements.

Data necessary for orders, invoicing and access is required for the contract or by law; without it, we may be unable to process an order or provide the course. Optional marketing is not a condition of purchase. The course is digital, with no physical delivery; an address may be needed for invoicing. Do not send us passwords, authentication codes or full card details.

Who may receive data

Where necessary for the purpose and supported by a valid legal basis, data may be accessed by authorised staff and the following categories of recipients:

  • The e-commerce platform: for the store, accounts, basket, orders and notifications.
  • The course management platform: for enrolment, access, progress and participation certificates.
  • Payment processors: for transaction authorisation and processing, security checks and their own obligations.
  • Invoicing and accounting providers: for issuing, transmitting, recording and archiving documents required by law.
  • Hosting and communications/email providers: for infrastructure, correspondence and message delivery.
  • Technical and analytics providers, when used: for maintenance, security, assisted administration, including artificial intelligence tools, and usage measurement, within applicable permissions, necessity and choices.
  • Authorities and professional advisers: where a legal obligation exists or advice or the defence of rights lawfully justifies disclosure.

Providers may process data on our behalf or, for certain purposes of their own, as independent controllers. Their role depends on the service and processing. You may request information about the recipients of your data and applicable safeguards.

Platform-specific information: this store is hosted on Shopify. Its network features are enabled, and Shopify processes visit and purchase data, including together with interactions with other merchants and its own services, to provide enhanced analytics, personalisation and advertising services, subject to applicable choices. Information may be shared with Shopify and other third parties located in other countries. For details of its processing and how to exercise rights, including withdrawal of consent or objection, see the platform's consumer privacy policy and privacy rights portal.

Cookies and marketing

Necessary technologies support the basket, authentication, security and remembering preferences. Analytics, personalisation and advertising through optional technologies require consent where required by law. You can accept, decline or change your choices through “Cookie preferences” in the store footer. Further information about the platform's technologies is available in its cookie policy.

The newsletter and marketing option are separate from purchasing and from statements concerning course supply. Abandoned-checkout recovery is enabled; messages about baskets, browsing or products are subject to eligibility, preferences and applicable legal requirements. You can unsubscribe through the link in promotional messages or by contacting us. Withdrawing marketing consent does not stop messages needed for orders, authentication or support.

International transfers and security

Some services may involve processing outside the European Economic Area. Not all data or services have the same storage location. Transfers must comply with the GDPR through an adequacy decision or appropriate safeguards, such as standard contractual clauses, as applicable. You can request details and a copy of the applicable safeguards at contact@cosminaizabela.ro. Access is limited to authorised people and necessary purposes; no technical solution offers absolute security.

How long we retain data

Retention is determined by the purpose, necessity and applicable obligations:

  • Tax and accounting documents are kept for the period required by legislation applicable to the document type, taking account of any inspections and litigation.
  • Account, access, progress and certificate data is kept while needed for active purchases and related support. The 365-day access period is not a general deadline for deleting all data.
  • Contractual evidence, statements and complaints are retained with regard to the contract's duration, resolution of requests and statutory limitation periods, including suspensions or interruptions. Litigation may justify retaining necessary data until it is resolved.
  • Consent-based marketing use stops when consent is withdrawn; we respect objections to direct marketing. Minimum evidence of consent or unsubscribe choices may be kept separately to respect those choices and defend rights, without further promotional use.
  • Technical data is retained according to its function and necessity for security or respecting preferences. A cookie's duration does not determine the retention period for all related data.

When no retention purpose and legal basis remain, data is deleted or anonymised. The right to erasure does not override statutory archiving obligations.

Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and portability. You may object to processing based on legitimate interests and, at any time, direct marketing, including related profiling. You may withdraw consent without affecting the lawfulness of earlier processing.

Write to contact@cosminaizabela.ro. We may request only proportionate information needed to verify identity and respond within statutory time limits. You may complain to ANSPDCP or the competent authority without having to contact us first.

Automation and minors

Payment confirmation automatically triggers course enrolment. Payments may involve payment providers' checks. These operations and automated messages do not, by themselves, demonstrate a solely automated decision producing legal or similarly significant effects. Contact us about payment or access difficulties.

Minors may also use the course, subject to rules on capacity to enter into a contract and parental or guardian representation or approval where required. For online services offered directly to a child, consent-based processing follows GDPR Article 8 requirements concerning parental responsibility. These are distinct from contractual bases and legal obligations. A legal representative may contact us to exercise the child's rights. We do not request unnecessary data about minors.

Updates

We update this policy when processing changes and inform affected people where required by law. A policy change is not consent to a new purpose. External services reached through links have their own notices, without removing our responsibility for data we disclose.