PRIVACY POLICY

LAST UPDATED: 13 AUGUST 2026

This policy explains what personal data we collect when you visit www.1zero1.ro or purchase from us, why we collect it, who we share it with and what rights you have. It constitutes the information provided under Articles 13 and 14 of Regulation (EU) 2016/679.

1ZERO1 S.R.L.
Operational address: Str. Bariera Valcii 337G, ground floor, Craiova, Dolj, 200716, Romania
VAT ID: RO43885372  ·  Trade Register No.: J16/712/10.03.2021
Email: dpo@1zero1.ro  ·  Phone: 0750 424 442
Website: www.1zero1.ro

1. Who is responsible for your data

1ZERO1 S.R.L. is the controller of the personal data described in this policy. For any questions regarding how we use your data, or to exercise the rights described in Section 8, write to dpo@1zero1.ro or to Str. Bariera Valcii 337G, ground floor, Craiova, Dolj, 200716, Romania.

2. What data we collect

Data you provide to us

  • Identification and contact data - first and last name, email address, phone number, delivery address and billing address.
  • Order data - products purchased, sizes, order value, order history, returns and the reason for return.
  • Account data - email address, saved addresses, order history and other information associated with the customer account.
  • Communications - the content of emails, chat messages and social media messages that you send us, as well as our responses.
  • Marketing preferences - whether you have subscribed to the newsletter and what you have given your consent to.
  • Data relating to business customers - for clinics and teams: company name, VAT identification number and the representative's contact details.

We do not collect

We do not intentionally request your Romanian personal identification number (CNP), health information or other special categories of data. The fact that you work in a medical profession does not, in itself, constitute information about your health. Please do not send us medical information or other sensitive data in the messages you send us.

Data collected automatically

  • Technical data - IP address, device and browser type, operating system, language, time zone and approximate location inferred from your IP address.
  • Usage data - pages and products viewed, date and time of access, the source from which you reached the Website, and your interactions with the Website.
  • Cookies and similar identifiers - described in our Cookie Policy.

Data received from third parties

  • Payment confirmation and fraud prevention signals from payment processors. We do not receive or store your full card number.
  • Delivery status information from our courier partners.
  • Profile data transmitted by social media platforms when you choose to sign in through them, within the scope of the permissions you grant.

3. Why we use your data and our legal basis

Purpose Legal basis Retention period
Processing and delivery of orders, management of returns and refunds, customer support Performance of a contract - Art. 6(1)(b) For the duration of the order and, afterwards, for up to 3 years following its completion, insofar as necessary for resolving complaints or protecting our rights. Data contained in accounting documents is retained in accordance with applicable statutory retention periods.
Issuing and retaining invoices and accounting documents Legal obligation - Art. 6(1)(c) 5 years, calculated from 1 July of the year following the end of the financial year in which the documents were prepared, in accordance with Romanian Accounting Law No. 82/1991.
Managing your account Performance of a contract - Art. 6(1)(b) Until the account is closed. After the account is closed, data that is no longer necessary is deleted or anonymised, except for data that we are legally required to retain or that is necessary for the establishment, exercise or defence of a legal claim.
Sending newsletters and commercial communications Consent - Art. 6(1)(a) Until you unsubscribe or withdraw your consent. The need to retain subscriber data is reviewed periodically.
Personalisation of content and advertising, measurement of campaign performance Consent expressed through the cookie banner - Art. 6(1)(a) In accordance with the retention periods specified in the Cookie Policy and the settings of the platforms used.
Traffic analysis and improvement of products and services Consent, respectively legitimate interest for aggregated data - Art. 6(1)(f) A maximum of 14 months for user-level and event-level data collected through Google Analytics, according to the service configuration. Aggregated data may be retained for longer periods if it no longer allows an individual to be identified.
Fraud prevention and Website security Legitimate interest - Art. 6(1)(f) For the period necessary to prevent and investigate security incidents or fraud, followed by the applicable statutory retention periods.
Establishment, exercise or defence of legal claims Legitimate interest - Art. 6(1)(f) Until expiry of the applicable statutory limitation period, which is generally 3 years unless the law provides for a different period.

Where we rely on legitimate interest, we have assessed that our interest in operating and protecting our business does not override your rights and freedoms. You may object to such processing at any time (see Section 8).

4. Automated decisions and profiling

We automatically analyse your browsing and purchase history to personalise content, product recommendations and marketing messages. This profiling does not produce legal effects concerning you and does not similarly significantly affect you: it influences what we show you, not the price you pay or whether your order is accepted. We do not profile minors. You may object at any time to profiling for marketing purposes and withdraw your consent for the cookies on which personalised advertising is based.

5. Who we share your data with

We do not sell your personal data. We share it only with the categories of recipients listed below, each acting either as a processor on the basis of a written data processing agreement or as an independent controller, where indicated.

Recipient Purpose Role
E-commerce platforms and hosting services Operation of the online store, management of orders, customer accounts and technical infrastructure Processor
Payment processors and financial institutions Payment processing, transaction management and fraud prevention Processor / independent controller, depending on the service
Courier companies and logistics services Delivery and return of parcels, as well as communication regarding delivery status Independent controller
Email marketing and customer communication platforms Newsletters, commercial communications, transactional messages and notifications Processor
Advertising platforms and social networks Advertising, remarketing, audience measurement, social features and campaign performance evaluation Joint controller / independent controller, depending on the service
Analytics and traffic measurement platforms Traffic analysis, measurement of interactions with the Website and improvement of services Processor / independent controller, depending on the service
Providers of applications and services integrated into the store Services such as reviews, chat, customer support, loyalty programmes, product recommendations, automations and other store functionalities Processor / independent controller, depending on the service
IT, security and fraud prevention service providers Technical maintenance, infrastructure security, incident identification and fraud prevention Processor / independent controller, depending on the service

6. Transfers outside the European Economic Area

Some of our providers may process personal data outside the European Economic Area. Where such a transfer takes place, we use the safeguards provided under Chapter V of the GDPR, such as an adequacy decision, Standard Contractual Clauses or other applicable legal mechanisms.

You may request a copy of the safeguards applied to a particular transfer by writing to dpo@1zero1.ro.

7. Sign-in with Facebook (Meta)

If you choose to create an account or sign in using Facebook, we receive the following information from Meta: your name, email address and profile picture. We use this data exclusively for creating and managing your account.

Deletion of data obtained through Facebook. Any user, from any country, may request the deletion of this data as follows:

  • send an email to dpo@1zero1.ro with the subject line "Facebook Data Deletion", stating the email address associated with the account; or
  • go to Facebook: Settings & privacy > Settings > Apps and websites > select 1ZERO1 > Remove. You may then also request the deletion of data already transferred by using the email address above.

We delete the data within a maximum of 30 days from the request.

8. Your rights

Under the GDPR, you have the following rights regarding your data:

  • Right of access - to obtain confirmation that we process data about you, a copy of that data and information about how it is used. The first copy is free of charge.
  • Right to rectification - to obtain correction of inaccurate data and completion of incomplete data.
  • Right to erasure - to obtain deletion of your data in the circumstances provided under Article 17. This right is not absolute: we may be required to retain certain data, for example accounting documents.
  • Right to restriction of processing - particularly while the accuracy of data is being verified or an objection is being considered.
  • Right to object - to object to processing based on legitimate interest. In the case of direct marketing, we will stop such processing immediately and without exception.
  • Right to data portability - to receive the data you provided in a structured, commonly used and machine-readable format and transmit it to another controller.
  • Right to withdraw consent - at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
  • Right to human intervention - to request that automated processing concerning you be reviewed by a person.

To exercise these rights, write to dpo@1zero1.ro. We respond within one month; where the request is complex or we receive a large number of requests, we may extend the period by two additional months and will inform you accordingly. We may request additional information to confirm your identity before acting on your request.

9. Personalised advertising and the Do Not Track signal

We use your data to display advertising and marketing communications that we consider relevant to you. You can opt out of targeted advertising through the settings of the relevant platforms - Facebook , Google , Microsoft - or through the Digital Advertising Alliance portal at optout.aboutads.info . You can also withdraw your consent for advertising cookies at any time through the Website's cookie settings.

Please note that we do not modify our data collection and usage practices when we receive a "Do Not Track" signal from your browser.

10. Complaints

If you believe that we have not handled your data properly, please let us know first so that we can try to resolve the matter. You also have the right to lodge a complaint with a supervisory authority.

The competent authority in Romania is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru No. 28-30, Sector 1, 010336 Bucharest - dataprotection.ro .

If you live or work in another Member State of the European Union, you may also contact the supervisory authority in that Member State.

11. Security

We apply technical and organisational measures appropriate to the risk, including encryption of traffic to and from the Website, encrypted storage of passwords, limiting access to persons who need the data to perform their duties and contractual security commitments from our processors. No system is completely secure; if a personal data breach occurs that is likely to result in a high risk to your rights, we will inform you without undue delay.

12. Minors

The Website is not directed at children and we do not knowingly collect personal data from persons under the age of 16. If you believe that a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy to reflect changes to our practices or applicable law. The date of the current version is shown at the top of the page. Where a change is significant, we will inform registered customers by email before it takes effect.

Data protection contact: dpo@1zero1.ro  ·  +40750 424 442

1ZERO1 S.R.L. - Str. Bariera Valcii 337G, Craiova, Dolj, 200716, Romania - VAT ID RO43885372