Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how erossa.com collects, uses, and protects your personal data, in accordance with the EU General Data Protection Regulation (GDPR).

Who is responsible for your data (data controller)

The data controller for erossa.com is ARBORE REAL ESTATE SRL, a Romanian company with its registered office at Drum Pădurea Neagră 1-17, Sector 1, 014044 Bucharest, Romania, company registration number (CUI) 43079742, Trade Register no. J2020012061402, EUID ROONRC.J2020012061402. Contact for any data protection matter: [email protected].

We collect the following categories of personal data:

  • Account data: name, email address, and password (stored encrypted), if you create an account.
  • Order data: billing and shipping address, phone number (if provided), items purchased, and order history, needed to process and deliver your order.
  • Payment data: handled directly by our payment provider at checkout. We do not store your full card number on our own servers.
  • Communications: any information you send us via our contact form or email, such as customer service requests.
  • Technical data: IP address, browser type, and basic browsing activity, collected automatically for security and site functionality (see “Cookies” below).
  • To process, fulfil, and ship your order, and to handle returns or warranty claims (performance of a contract).
  • To respond to customer service or contact form requests (performance of a contract / legitimate interest).
  • To protect the website against fraud, abuse, and security threats (legitimate interest).
  • To comply with legal obligations, such as tax and accounting record-keeping (legal obligation).
  • To send you marketing emails, only if you’ve opted in (consent — you can withdraw this at any time).
  • Statistics and marketing cookies (Microsoft Clarity, Google Analytics, sbjs_*) — legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, using the “Manage consent” button or our Cookie Policy page. Withdrawing does not affect processing that took place before.
  • Dreamlove (Gesio), Spain — receives your name, delivery address, phone number, email and the items you ordered. Why: they ship your parcel directly to you. Where: EU.
  • Banca Transilvania (iPay), Romania — receives the payment data. Why: it processes your card payment. Your card details never pass through or stay on our servers. Where: EU.
  • Consultoría EHERO, Spain — has technical access to the store when assisting us. Why: maintaining the software that connects our store to our supplier. Where: EU.
  • Hetzner, Germany — hosts our server and stores our encrypted backup copies. Why: infrastructure. Where: EU.
  • Cloudflare — sees the site’s traffic and forwards emails sent to [email protected]. Why: security and speed. Where: USA/EU.
  • Google (reCAPTCHA), USA — receives your IP address and how you interact with the sign-in and registration forms. Why: to tell real customers apart from automated attacks on accounts. Where: USA.
  • Gazduire.net, Romania — sends the emails about your order. Why: confirmations and notifications. Where: EU.
  • Google and Microsoft — see “Transfers outside the European Union”. Why: statistics and receiving your emails. Where: USA.

We do not sell your data to anyone.

  • Invoices and the data on them — 5 years from 1 July of the year after the financial year in which they were issued. Why: Romanian accounting law requires it.
  • Your account and saved addresses — for as long as you keep the account; deleted on request.
  • Messages sent through the contact form — 12 months, so we can pick up a conversation.
  • Security logs (IP addresses) — 30 days, to detect attacks.
  • Backup copies — the last 10 copies, encrypted, to recover the site after an incident.
  • Inactive accounts — deleted after 36 months without a sign-in. Your orders stay, because accounting law requires them; only the account goes.
  • Unpaid and failed orders — 1 month. An order that was never paid has no further use, and it holds your name, address and phone number.
  • Cancelled orders — 6 months, long enough for any dispute or return.

When you ask us to delete your data, we delete your account and contact details and anonymise your orders: only the amount and the products remain, without your name or address. Invoices remain, because the law requires us to keep them.

Strictly necessary (no consent needed, because the site cannot work without them):

  • Cart and checkout (WooCommerce) — woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*.
  • Your account session, if you are logged in.
  • cmplz_* — remembers your cookie choices.
  • Google reCAPTCHA — runs only on the sign-in and registration forms in your account area, to block automated attacks. It receives your IP address and how you interact with the form. Because it protects the account itself, it is treated as strictly necessary and runs before any cookie choice.

Statistics (only if you accept):

  • Microsoft Clarity (_clck, _clsk) — shows us how the site is used, so we can improve it. Data processed: IP address, browser type, pages visited, session recordings. Clarity does not run on the cart, the checkout, the order confirmation page or anywhere in your account area, so those pages are never recorded. Everywhere else, text you type into form fields is masked by Microsoft Clarity before the recording leaves your browser, so we see that a field was filled in, not what you wrote.
  • Google Analytics 4 (_ga, _ga_*) — traffic statistics. Data processed: IP address, pages visited, where the visit came from.

Marketing (only if you accept):

  • Order attribution (WooCommerce, sbjs_*) — records where your visit came from, so we can tell which orders came from which source.

If you decline, these services do not load at all.

You can change your choice at any time, using the “Manage consent” button in the site footer or on our Cookie Policy page.

The full, up-to-date list of cookies is in our Cookie Policy.

Some of our service providers are based in, or have servers in, the United States. When your data reaches them, the transfer is based on the Standard Contractual Clauses approved by the European Commission and/or the EU–US Data Privacy Framework.

  • Microsoft (Clarity) — receives your IP address, browser and pages visited. Purpose: usage statistics.
  • Google (Analytics) — receives your IP address and pages visited. Purpose: statistics.
  • Google (reCAPTCHA) — receives your IP address and interaction signals from the account forms. Purpose: fraud prevention. This runs as a strictly necessary security measure, before any cookie choice, because without it the sign-in form is open to automated attacks.
  • Google (Gmail) — receives the emails you send to [email protected]. Purpose: replying to you.
  • Cloudflare — receives your IP address and the pages you request, and forwards emails sent to [email protected]. Purpose: delivering and protecting the site.
  • Defiant (Wordfence) — receives IP addresses involved in attacks. Purpose: security.

You can ask us at any time for a copy of the safeguards that apply, by writing to [email protected].

Under GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your data (“right to be forgotten”), subject to legal retention requirements.
  • Restriction — you can ask us to pause the use of your data, for example while we check a correction you asked for, or while we assess an objection you made.
  • Receive a copy of your data in a portable format (“data portability”).
  • Withdraw consent at any time for anything based on consent (e.g. marketing emails, statistics cookies).
  • Lodge a complaint with your national data protection authority if you believe your data has been mishandled.

To exercise any of these rights, contact us via our Contact page.

Right to object

Where we rely on our legitimate interests, you can object at any time, on grounds relating to your particular situation. If you object to direct marketing, we stop immediately, and you do not need to give a reason.

To object, write to us at [email protected] or use our Contact page.

If you are unhappy with how we handle your data, you can write to us at any time at [email protected]. You also have the right to lodge a complaint with a supervisory authority: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania, [email protected], www.dataprotection.ro — or the data protection authority of the EU country where you live or work.

We use industry-standard security measures to protect your data, including encrypted (HTTPS) connections site-wide, a web application firewall, and restricted access to production systems.

Backup copies are kept only at Hetzner, in Germany. They are encrypted with AES-256 before they leave our server, and we keep the last 10 copies. No backup of this site is stored outside the European Union.

We may update this Privacy Policy from time to time. The version in effect is the one published on this page.

back to top