PRIVACY AND PERSONAL DATA PROTECTION POLICY

Last updated: April 2026

1. Who We Are

This Privacy Policy explains how EKO JEWELRY S.R.L., hereinafter referred to as “EMPOLI”, “we”, “us” or “the Company”, collects, uses, stores and protects the personal data of users, visitors and customers who access www.empoli.ro or interact with our products and services.

The personal data controller is:

EKO JEWELRY S.R.L.

Registered office: 87 Nicolae Caramfil Street, 4th Floor, Sector 1, Bucharest

Store and correspondence address: Bucur Obor Shopping Centre, 2 Șoseaua Colentina, Sector 2, Bucharest, Romania

Trade Register No.: J2017001071238

Tax Identification Number: RO35467000

General contact email: contact@empoli.ro

Email for personal data requests: gdpr@empoli.ro

Telephone: +40 758 990 999

2. Who This Policy Applies To

This Policy applies to all persons who:

access www.empoli.ro;

create a customer account;

place an online order;

purchase EMPOLI products;

submit a return, cancellation, warranty, servicing or repair request;

subscribe to the newsletter;

participate in campaigns, promotions or events organised by EMPOLI.

3. Personal Data We Collect

Depending on how you interact with EMPOLI, we may collect the following categories of personal data:

3.1. Identification and Contact Details

first and last name;

email address;

telephone number;

delivery address;

billing address;

information required to issue an invoice.

3.2. Customer Account Data

email address used for authentication;

password, securely stored through the Shopify platform;

order history;

saved or viewed products;

information entered in the customer account.

EMPOLI does not have access to your password in a readable form.

3.3. Order Data

products ordered;

order value;

selected payment method;

payment status;

delivery status;

order history;

information regarding returns, cancellations, exchanges or refunds;

documents relating to the order, including invoices, warranty certificates, shipping documents or other documents required for delivery.

3.4. Payment Data

For online orders, payment may be processed through Shopify Payments or NETOPIA Payments, depending on the payment method selected.

We may process information such as:

selected payment method;

transaction status;

transaction value;

transaction identifier;

technical information required to confirm the payment;

refund information, where applicable.

EMPOLI does not store complete bank card details, CVV or CVC codes, PIN codes or other sensitive banking authentication information. These details are entered directly into the secure interfaces of the payment processors.

For instalment payments processed through NETOPIA Payments, the information required to verify, authorise and process the transaction may be processed by NETOPIA Payments and/or the card-issuing bank in accordance with their own privacy policies.

3.5. Delivery Data

For the delivery of orders, we may disclose the following information to courier companies:

first and last name;

delivery address;

telephone number;

email address, where required for delivery notifications;

parcel value, where relevant for transport;

shipment or AWB number;

information required for handing over the parcel.

3.6. Returns, Cancellations, Warranties and Servicing Data

To manage requests relating to returns, cancellations, warranties, repairs or servicing, we may collect:

order details;

product details;

warranty certificate;

tax invoice;

description of the reported issue;

photographs of the product, where required;

contact details needed to communicate the outcome;

bank details required for the refund, where the refund cannot be made using the original payment method.

3.7. Personalisation Data

Where you request personalised products, engravings, adjustments or other special services, we may process the information provided by you for the purpose of creating the requested product or providing the requested service.

This information may include engraving text, initials, names, dates, messages or other information voluntarily provided by the customer.

3.8. Communications with Us

When you contact us, we may process:

your first and last name;

email address;

telephone number;

the content of your message;

communication history;

information required to address your request.

3.9. Marketing and Commercial Communications Data

Where you subscribe to our newsletter or give your consent to receive commercial communications, we may process:

your first and last name;

email address;

telephone number, where provided for commercial communications;

communication preferences;

newsletter interaction history;

products viewed or purchased, to the extent permitted by the consent provided and your cookie settings.

You may unsubscribe at any time by using the unsubscribe link included in our emails or by contacting us at gdpr@empoli.ro.

3.10. Technical Data and Data Collected Through Cookies

When you access the website, we may collect technical information such as:

IP address;

device type;

browser used;

operating system;

pages accessed;

duration of the visit;

traffic source;

interactions with the website;

information collected through cookies, pixels or similar technologies.

Non-essential cookies, including analytics, marketing or personalised advertising cookies, are used based on the consent expressed through the cookie banner, where required.

For further information, please refer to our Cookie Policy.

4. Sources of Personal Data

We collect personal data:

directly from you when you complete forms, create an account, place an order or contact us;

through www.empoli.ro;

through Shopify, the platform used to operate the online store;

through payment processors used to confirm transactions;

through courier companies in connection with order deliveries;

through analytics, marketing and advertising tools, only where permitted by law and by the consent provided;

through direct communications with our customer support team.

5. Purposes for Which We Process Personal Data

We process personal data for the following purposes:

creating and managing customer accounts;

receiving, confirming and processing orders;

processing online payments;

issuing invoices;

delivering ordered products;

managing returns, cancellations, refunds and exchanges;

managing warranties, repairs and after-sales services;

communicating with customers regarding products and orders;

preventing fraud and protecting the website;

complying with tax, accounting and legal obligations;

sending newsletters and commercial communications, where consent has been provided;

displaying personalised advertising, only where consent has been provided for marketing cookies;

analysing website performance and improving the shopping experience;

managing complaints, notifications or disputes.

6. Legal Basis for Processing

We process your personal data on the basis of one or more of the following legal grounds:

performance of a contract, where we process information required to place, process, deliver and complete an order;

compliance with a legal obligation, where we issue invoices, retain accounting documents or respond to requests from public authorities;

consent, where you subscribe to the newsletter, accept non-essential cookies or participate in certain campaigns;

legitimate interests, for the prevention of fraud, website security, protection of our rights, improvement of our services and communication with existing customers within the limits permitted by law;

the establishment, exercise or defence of legal claims, where required in connection with complaints, disputes or investigations.

7. What Happens If You Do Not Provide Your Data

The provision of certain personal data is necessary for placing and processing orders.

Where you do not provide the required information, we may be unable to:

process your order;

collect payment;

issue an invoice;

deliver the product;

manage a return, cancellation, warranty or servicing request;

respond to a request submitted by you.

Providing personal data for marketing purposes is optional. Refusing to receive commercial communications will not affect your ability to purchase products through the website.

8. Recipients of Personal Data

To operate the online store and fulfil our obligations towards customers, we may disclose personal data to the following categories of recipients:

Shopify, the eCommerce platform provider;

payment processors, including Shopify Payments and NETOPIA Payments;

banks and financial institutions involved in payment authorisation;

courier companies, including GLS, Fan Courier, DHL or other delivery partners used by EMPOLI;

invoicing, accounting and inventory-management service providers;

IT, hosting, security, maintenance and technical support providers;

email marketing and communication service providers, where you subscribe to the newsletter;

analytics and advertising platforms, including Google, Meta, TikTok or similar tools, only where they are enabled and the required consent has been provided;

legal advisers, accountants, auditors or other professional advisers, where required;

public authorities, courts or competent institutions, where we are legally required to do so.

We do not sell your personal data to third parties.

9. Data Processing Through Shopify

The website www.empoli.ro is built and operated through the Shopify platform.

By using the online store, certain information required for processing orders, managing customer accounts, operating the shopping cart, processing payments and administering the store may be processed through Shopify’s infrastructure.

Depending on the circumstances, Shopify may act as a data processor or as an independent data controller for certain processing activities carried out in accordance with its own policies and legal obligations.

10. Personal Data Processing for Online Payments

Online payments are processed through specialised and secure service providers. EMPOLI does not request or store complete bank card details.

Available payment methods may include:

full online payment through Shopify Payments;

full online payment through NETOPIA Payments;

payment in interest-free instalments through NETOPIA Payments for eligible cards and banks;

digital wallets such as Apple Pay or Google Pay, where available at checkout.

Payment data is securely processed by the payment processors and financial institutions involved. EMPOLI only receives the information required to confirm the payment and process the order.

11. Transfers of Personal Data Outside the European Union or EEA

In certain circumstances, personal data may be processed or accessed by service providers located outside the European Union or the European Economic Area, particularly in connection with technology platforms, cloud services, analytics, marketing or eCommerce infrastructure.

In such cases, EMPOLI seeks to ensure that transfers are made on the basis of appropriate safeguards, including:

adequacy decisions adopted by the European Commission;

standard contractual clauses approved by the European Commission;

legally recognised international data-transfer mechanisms;

additional technical and organisational safeguards, where required.

12. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected or for as long as required by law.

In general:

order-related data is retained for the period required to perform the contract and subsequently in accordance with tax, accounting and legal obligations;

supporting and accounting documents are retained for the periods established by the applicable legislation;

customer account data is retained for as long as the account remains active or until you request its deletion, except for information that we are legally required to retain;

newsletter data is retained until consent is withdrawn or you unsubscribe;

information regarding returns, warranties and complaints is retained for the period required to address the relevant request and subsequently in accordance with the applicable statutory retention periods;

information collected through cookies is retained for the periods indicated in the Cookie Policy and in the settings of the platforms used.

Once the applicable retention periods expire, personal data will be deleted, anonymised or archived in accordance with the law.

13. Your Rights

Under applicable data protection legislation, you have the following rights:

the right to be informed about how your personal data is processed;

the right to access the personal data we hold about you;

the right to rectify inaccurate or incomplete personal data;

the right to erasure, subject to the conditions established by law;

the right to restrict processing;

the right to data portability;

the right to object to certain processing activities, including direct marketing;

the right to withdraw your consent where processing is based on consent;

the right not to be subject to a decision based solely on automated processing where such a decision produces legal effects or significantly affects you;

the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing.

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

14. How to Exercise Your Rights

To exercise your rights regarding personal data, you may contact us at:

gdpr@empoli.ro

Alternatively, you may submit a written request to:

EKO JEWELRY S.R.L.

Bucur Obor Shopping Centre

2 Șoseaua Colentina, Sector 2

Bucharest, Romania

To process your request, we may ask for additional information to verify your identity.

We will respond within a maximum of 30 days from receiving your request. In complex cases or where we receive a large number of requests, this period may be extended in accordance with the applicable legislation, and you will be informed accordingly.

15. Right to Lodge a Complaint

Where you believe that your personal data has not been processed in accordance with the applicable legislation, you have the right to lodge a complaint with:

The Romanian National Supervisory Authority for Personal Data Processing

28–30 General Gheorghe Magheru Boulevard

Sector 1, Bucharest, Romania

Website: www.dataprotection.ro

Before submitting a complaint, we recommend contacting us at gdpr@empoli.ro so that we may attempt to resolve the matter promptly and amicably.

16. Newsletter and Commercial Communications

Newsletters and commercial communications are sent only under the conditions permitted by law.

Where you have subscribed to the newsletter or have consented to receive commercial communications, we may send you information regarding:

new collections;

EMPOLI products;

seasonal campaigns;

events;

customer benefits;

personalised recommendations, where you have consented to receive such communications.

You may unsubscribe at any time using the unsubscribe link included in each email or by sending a request to gdpr@empoli.ro.

17. Cookies, Analytics and Online Advertising

The website www.empoli.ro may use cookies and similar technologies for:

ensuring the correct operation of the website;

retaining products in the shopping cart;

authenticating customer accounts;

analysing website traffic;

improving the shopping experience;

measuring campaign performance;

displaying relevant advertising.

Strictly necessary cookies may be used without consent because they are essential for the operation of the website.

Analytics, marketing and advertising cookies are used only on the basis of the consent expressed through the cookie banner, where consent is required by law.

You may change your cookie preferences at any time using the settings available on the website or through your browser settings.

18. Personalised Advertising and Third-Party Platforms

Where you accept marketing cookies, we may use tools such as Google Ads, Meta Ads, TikTok Ads or other similar platforms to measure campaign performance and display more relevant advertising.

These platforms may process information such as online identifiers, website interactions, products viewed or actions performed on the website.

EMPOLI does not fully control how these platforms process information when acting as independent data controllers. We recommend reviewing the privacy policies of the relevant platforms for further information.

19. Data Security

We treat the security of personal data responsibly and implement appropriate technical and organisational safeguards to protect it against:

unauthorised access;

accidental loss;

destruction;

alteration;

unauthorised disclosure;

improper use.

These safeguards may include, where appropriate:

restricted access to personal data;

secure passwords and authentication;

encrypted connections;

access monitoring;

security updates;

cooperation with service providers that apply appropriate data protection standards.

However, no method of electronic transmission or storage is completely free from risk.

Where a security incident may affect the rights and freedoms of individuals, we will take the measures required under the applicable legislation.

20. Children’s Personal Data

The EMPOLI website and products are not specifically directed at children under the age of 16.

We do not knowingly collect personal data relating to children under the age of 16 without the consent of their legal representative.

Where we discover that such information has been collected without an appropriate legal basis, we will take steps to delete it.

21. Links to Other Websites

The website www.empoli.ro may contain links to other websites, social media platforms or external services.

EMPOLI is not responsible for the privacy policies, content or practices of third-party websites. We recommend reviewing the privacy policy of every website you access.

22. Confidentiality of Communications

Any information submitted to EMPOLI through email, contact forms, telephone or other channels will be used for the purpose for which it was provided and, where applicable, to address your request.

We will not publish, sell or distribute the content of your communications to third parties, except where this is required to provide the services, comply with legal obligations or defend our rights.

23. Changes to This Privacy Policy

EMPOLI reserves the right to update this Privacy Policy periodically to reflect legislative, technical, operational or commercial changes.

The updated version will be published on www.empoli.ro and will take effect from the date of publication unless otherwise stated.

We recommend reviewing this page periodically to remain informed about how we protect your personal data.

24. Contact

For questions, requests or concerns regarding this Privacy Policy or the way EMPOLI processes personal data, you may contact us using the following details:

Data protection email: gdpr@empoli.ro

General email: contact@empoli.ro

Telephone: +40 758 990 999

Correspondence address: Bucur Obor Shopping Centre, 2 Șoseaua Colentina, Sector 2, Bucharest, Romania