Last updated: 21 July 2026
1. Who we are
This Privacy Policy describes how personal data of visitors to masonicforum.ro and customers of the Shop is processed. The data controller is:
- ARES GROUP S.R.L., CUI RO13356876, Trade Registry No. J40/8354/2000
- Registered office: Bucharest, Romania
- Correspondence address: Casa Presei Libere, Corp C3, Bucharest, 013701, Romania
- E-mail for data protection requests: adrian@digiro.net
We have not appointed a Data Protection Officer (DPO), as our activity does not fall within any of the situations requiring this under Article 37 of Regulation (EU) 2016/679 (we are not a public authority, and we do not carry out large-scale systematic monitoring or large-scale processing of special-category data). For any request concerning your data, you may contact us at the address above.
2. What data we collect
Depending on how you interact with the Site, we may collect: identification data (name, surname), contact data (delivery/billing address, e-mail, phone), customer account and order-history data, and payment-related technical data (note: full bank card data is entered and processed directly by the payment processors NETOPIA Payments and Stripe – we do not collect or store this data, only the transaction status/reference).
3. Purposes and legal basis for processing
| Purpose | Legal basis |
|---|---|
| Processing and delivering orders, managing your customer account | Performance of a contract (GDPR Art. 6(1)(b)) |
| Issuing invoices and accounting records | Legal obligation (GDPR Art. 6(1)(c); Accounting Law No. 82/1991) |
| Marketing communications (if you have subscribed) | Consent (GDPR Art. 6(1)(a)), withdrawable at any time |
| Fraud prevention and Site security | Legitimate interest (GDPR Art. 6(1)(f)) |
4. Who we share your data with
Your data may be shared with: the payment processors NETOPIA Payments and Stripe, the courier company SamedayCourier, the Site’s hosting/IT service provider, and, where applicable, the company’s accountant. We do not sell or rent your data to third parties for marketing purposes.
5. Transfers outside the European Economic Area
Our payment processor Stripe may transfer certain data to Stripe, Inc. in the United States and its sub-processors. This transfer relies on the EU Standard Contractual Clauses (Module 2, under European Commission Implementing Decision (EU) 2021/914), through Stripe’s Data Processing Agreement and Data Transfers Addendum.
6. Retention period
Financial-accounting records (invoices) are retained for 5 years from 1 July of the year following the financial year in which they were issued (Accounting Law No. 82/1991, as amended by Law No. 36/2023), and 10 years for annual financial statements. Customer account data is retained for the lifetime of the account, plus a reasonable period after the last activity. Marketing data is retained until consent is withdrawn.
7. Your rights
Under Regulation (EU) 2016/679, you have the right to: access your data, rectification, erasure, restriction of processing, data portability, object to processing, and to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, contact us at adrian@digiro.net. You may also use WordPress’s native personal-data export/erasure tools, available on request.
You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, Bucharest, www.dataprotection.ro.
8. Providing your data
Providing identification, contact and delivery data is necessary to process and deliver an order; without this data, we cannot fulfil your order.
9. Automated decisions
We do not use automated decision-making or profiling processes that produce legal effects concerning you or that similarly and significantly affect you.
10. Cookie Policy
For information about the cookies used on the Site (statistics, marketing, functional), see the Cookie Policy.
11. Changes to this policy
We reserve the right to update this Privacy Policy from time to time. The version in force is always the one published on this page.
