This policy applies to the English catalogue at www.tavolanera.eu.
2. What data do we process?
a) Quote requests and orders
name, e-mail address, phone number
company name and tax/VAT number, if provided
billing and delivery address
the content of the request/order and any message you write
There is no online checkout on www.tavolanera.eu. Where an order is paid by card after the
quote has been accepted, card data is handled directly by the payment service provider; we do not
see or store card numbers. We keep the payment data (amount, date, transaction ID).
We check the EU VAT number provided in the European Commission's VIES system and store the
result (the company name belonging to the number) with the order, as it proves the lawful VAT
treatment.
b) Artwork files
The file you upload is the basis of production. It is your intellectual property; we use it
only to fulfil your request or order. We do not publish it, pass it on or use it as a reference
without your separate, subsequent consent.
The file is not stored publicly: it can only be accessed via an expiring, signed link
generated by us.
c) Newsletter
Only with consent given via a separate checkbox: e-mail address and — if provided — the name
of your venue.
d) Technical data
The server logs technical request data (IP address, time, browser identifier) to keep the
service running and to prevent abuse. Cookies are covered by the
Cookie Policy.
3. Purpose, legal basis and retention
Answering quote requests and fulfilling orders — production, delivery,
communication, proof approval. Legal basis: steps prior to entering into a contract and
performance of the contract (GDPR Art. 6(1)(b)). Retention: 5 years from performance (general
limitation period). Quote requests that do not lead to an order are kept for the same period.
Storing artwork files — production and repeat orders with unchanged
artwork. Legal basis: GDPR Art. 6(1)(b). Retention: 2 years from performance, then deleted.
Invoicing and accounting — legal obligation (GDPR Art. 6(1)(c)).
Retention: 10 years under Romanian accounting rules.
Newsletter — consent (GDPR Art. 6(1)(a)), which can be withdrawn at any
time, including via the unsubscribe link in every e-mail. Retention: until withdrawal.
Operation and abuse prevention — legitimate interest (GDPR Art. 6(1)(f)).
Retention: up to 12 months.
4. Who can access the data? (processors)
Our staff and the following processors, to the extent necessary for their tasks:
Database, file storage: Supabase Pte. Ltd. (65 Chulia Street #38-02/03,
OCBC Centre, Singapore 049513; UEN 202005760H). Data is stored in the EU (Frankfurt).
E-mail delivery: Plus Five Five, Inc. ("Resend", 2261 Market Street #5039,
San Francisco, CA 94114, USA).
Hosting: Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, USA).
Delivery: DYNAMIC PARCEL DISTRIBUTION S.A. (registered office: Comuna Mogoșoaia, Str. Buiacului nr. 2, Corp A – Unitatea A1 și A2, jud. Ilfov, Romania; CUI RO 9566918) — data transferred: name, delivery address, phone, e-mail.
Accounting is done by our own staff; no external accounting firm acts as
a processor.
Analytics and marketing — only with your cookie consent: Google Ireland
Limited (Google Analytics 4), Meta Platforms Ireland Limited (Meta Pixel), Microsoft Ireland
Operations Limited (Microsoft Clarity). Without consent these scripts are not loaded.
Transfers outside the EEA. Some processors are registered outside the EEA:
Vercel Inc. and Plus Five Five, Inc. in the USA, Supabase Pte. Ltd. in Singapore. The website and
database run in the European (Frankfurt) region, so data is primarily stored in the EU. Transfers
are safeguarded by data processing agreements (DPA) with Standard Contractual Clauses (SCC) and,
where the provider is certified, the EU–U.S. Data Privacy Framework. The analytics and marketing
providers are European companies with US parent companies, so with your consent data may also
reach them outside the EEA; without consent this does not happen. We disclose data to
authorities only where required by law.
5. Your rights
Information and access to the data we hold, and a copy of it.
Rectification of inaccurate data.
Erasure and restriction within the limits of the law.
Data portability for data processed on the basis of contract or consent.
Withdrawal of consent: unsubscribe from the newsletter at any time.
Objection to processing based on legitimate interest.
Send your request to hello@tavolanera.hu; we reply within 30 days at the latest.
6. Remedies
If you believe your data is processed unlawfully, you may complain to the Romanian data
protection authority at the Supplier's seat, ANSPDCP (dataprotection.ro),
to the supervisory authority of your habitual residence or place of work (GDPR Art. 77), or go
to court.
7. Security
The site uses an encrypted connection (HTTPS). Requests and orders are stored in an
access-restricted database; artwork files are stored non-publicly and accessible only via signed,
expiring links. The administration interface is protected by a separate password.