Privacy Policy

General Information

This Privacy Policy explains how Lano Furniture – Siwik Cezary (hereinafter referred to as the "Controller" or the "Seller"), acting as a data controller, collects, uses, and protects your personal data when you use the lanomobila.ro website and place orders through it. We are committed to respecting the privacy of our customers' and visitors' data, in compliance with Regulation (EU) 2016/679 (GDPR), Law No. 190/2018, and applicable Romanian legislation (including Law No. 365/2002 on e-commerce and Law No. 506/2004 on data protection in the electronic communications sector).

1. 1. Data Controller and Contact Details

Your data controller is Cezary Siwik, operating under the trade name "Lano Furniture" Siwik Cezary, with the identification details mentioned above (NIP: 6190013551, REGON: 100363308, Cod de TVA: RO54580918). For any questions or requests related to your personal data, you can contact us at:

• Postal address: Tyble 43C, 98-420 Sokolniki, Poland (Controller's headquarters).
• Email: reclamatii@lanomobila.ro (dedicated address for customer communication, including data protection matters). We do not have a formally appointed Data Protection Officer (DPO) (as it is not mandatory for the size of our activity), but any request related to data privacy will be treated as a priority by our team.

2. 2. What Personal Data We Collect

The personal data we collect may include:

• Identification and contact data: full name, delivery and/or billing address, phone number, email address. These are collected when you place an order or create an account on the site, as they are necessary for order processing and contacting you.
• User account data: If you create an account, we store your password (encrypted), order history, preferences (e.g., favourite products if the site offers this option), and any reviews left.
• Transactional data: details about placed orders – ordered products, quantities, order value, payment method used, payment status, transaction ID (in the case of online payments), etc.
• Technical and usage data: IP address, browser and operating system used, cookie identifiers, viewed pages, time spent on the site, actions performed (e.g., adding to cart). This information is collected via cookies and similar technologies to help us improve the site experience and for traffic analysis (see also the Cookie Policy).
• Communication data: any information you provide when you contact us (via the contact form, email, or telephone) – for example, the content of messages, details provided for support (may also include supplementary identification data if applicable).
• Special/sensitive data: We do NOT intentionally collect or process special categories of personal data through the site (such as health data, political opinions, religious beliefs, etc.), nor data regarding criminal convictions. Please do not disclose such information during the ordering processes or in communications with us.

The site is not intended for children under 16; we do not knowingly process the data of minors under this age without verifiable parental consent. However, if a minor uses the site to place false orders or subscribe to the newsletter, we will delete the data as soon as we become aware.

3. 3. Purposes and Legal Bases for Data Processing

We assure you that we process personal data only for legitimate purposes and either based on your consent or under other legal bases permitted by the GDPR. Here are the main purposes for which we process your data, along with the corresponding legal basis for each purpose:

• Order processing and contract execution: We use identification and contact data to process and deliver your orders, to issue invoices, to accept payments, and to provide you with the purchased products. Legal basis: performance of the distance contract between you and us. Providing this data is necessary for the conclusion and performance of the contract; refusal to provide it may prevent order finalisation. Additionally, in accordance with financial and accounting legal obligations, we must include certain data (name, address) on the invoice and keep it for a period of time (e.g., invoices are archived for 5 or 10 years, according to tax legislation). Legal basis for storing invoices: legal obligation (tax legislation).
• Creation and administration of the customer account: If you choose to create an account on the site, we will process your contact data (email, name) to register you and allow access to the account, as well as to keep the history of orders and preferences. Legal basis: performance of a contract (the site's Terms and Conditions constitute the contract for the user account). You can request the account closure at any time; if you do not use it for a long period (e.g., 10 years), the account may be archived or deleted for security.
• Customer communication and support services: We may use your email address and phone number to send you notifications regarding the status of your orders (confirmations, delivery notifications) or to contact you in case of order issues. We will also use the data provided in your correspondence to us to respond to your requests (e.g., product inquiries, return requests, complaints). Legal basis: our legitimate interest in ensuring quality customer support services and maintaining customer satisfaction. In the case of communications related to ongoing orders (e.g., informing about delayed delivery), the basis may also be the performance of the contract (information necessary for delivery).
• Direct marketing (newsletter, promotional offers): If you have voluntarily subscribed to our newsletter (for example, you ticked that you wish to receive offers and news), we will use your email address to periodically send you commercial communications about Lano Furniture products and promotions. Legal basis: your explicit consent. You can withdraw your consent at any time, either by clicking the "Unsubscribe" link in the emails received or by contacting us directly. Unsubscribing will not affect the lawfulness of processing carried out prior to the withdrawal of consent. Please note that simply creating an account on the site does not automatically sign you up for the newsletter – we will only send you promotional messages if you have separately opted for it.
• Personalised marketing and analytics: We may analyse your browsing behaviour on the site (pages visited, products viewed, products added to the basket but not ordered) to understand your interests and suggest relevant products. For example, we may use your order history to recommend complementary products or use analytical cookies to see which categories are most visited, thereby improving the site structure. We may also use remarketing tools (e.g., Facebook Pixel, Google Ads) to show you personalised adverts on other platforms, based on the products viewed on our site. Legal basis: our legitimate interest in promoting our products to existing and potential customers and optimising our site (as we address adults exclusively, these commercial profiling practices have a low impact on privacy). Where required by law, we will obtain consent for the use of certain marketing cookies – see details in the Cookie Policy. You can object to profiling for direct marketing purposes at any time by contacting us.
• Compliance with legal obligations: We also process your data to comply with applicable legal obligations. Examples: keeping financial and accounting records (invoices) for the duration required by law; providing information to public authorities when we are obliged (e.g., to ANAF, consumer protection authorities, or police, if they legally request certain information during investigations). Legal basis: legal obligation.
• Defence of our rights and legitimate interests: In the event of disputes, legal claims, or inspections, we may process and use relevant information about transactions and communications with you to defend ourselves in court or before authorities. Legal basis: legitimate interest (protecting our assets and rights). For example, we will keep evidence of orders, payments, and deliveries as proof, usually for the general limitation period (3 years) or as long as necessary in a dispute.

We will not use your personal data for purposes other than those stated above without informing you and, where applicable, without obtaining your prior consent.

4. 4. Disclosure of Data to Third Parties (Recipients)

We respect the confidential nature of the data and do not sell or transfer our customer data lists to third parties. However, for the operation of our online activity and the fulfilment of our contractual obligations towards you, it is necessary to share certain data with trusted third parties, as follows:

• Courier/Logistics services: To deliver the ordered products, we will transmit the necessary delivery information to the selected courier: recipient's name, delivery address, contact phone number, and, if applicable, email address for delivery notifications. The courier companies we collaborate with (e.g., Fan Courier, Sameday, DHL – the current list can be consulted on the site) are obliged to use this data exclusively for the delivery service and to protect it according to law.
• Electronic payment processors: If you pay online by card, you will be redirected to the payment processor's page (e.g., MobilPay, EuPlatesc, or another indicated provider) where you will enter your card details. We do not access this data, but the processor (data processor) receives information about your order (order ID, payment amount). Payment processors are considered data processors under the GDPR and have a legal obligation to ensure data security and transaction confidentiality. We may only receive a transaction ID and the payment status (accepted/rejected) from them.
• IT and hosting service providers: Our site is hosted on the servers of a third-party service provider (hosting provider). We may also use providers for site maintenance, software development, email services (e.g., the platform through which we send newsletters). These third parties may have incidental access to some data (e.g., stored email addresses, databases) strictly for the technical operation of the site. We ensure that all these providers are bound by confidentiality clauses and data protection obligations.
• Marketing and analytics services: We may share limited information with third-party platforms for marketing, as mentioned – for example, we may securely upload the list of email addresses of customers who have consented to marketing into the Facebook Ads or Google Ads platform to create target audiences (custom audiences). This processing is secured, and large platforms act as joint or independent controllers in these cases. We also use Google Analytics to collect aggregated traffic data (Google acts as a data processor). These platforms may transfer data outside the EU (usually to the US), but adequate safeguards are implemented (standard protection clauses, IP anonymisation for Analytics, etc.). We will detail this in the international transfer section.
• Public authorities and other institutions: In cases where the legislation obliges us or if it is necessary for the defence of a right in court, we may disclose personal data to competent authorities (e.g., Police, Prosecution Service, courts of law, ANPC, ANSPDCP) or to our consultants (lawyers, accountants – under the obligation of confidentiality) when strictly necessary. For example, ANAF may request information about sales, courts may request records of transactions in case of disputes, etc.
• Personalised marketing and advertising adaptation (Google Customer Match) – if you have expressed consent to this (Art. 6(1)(f) of the GDPR). Personal data, in the form of your email address, may be used to run personalised marketing campaigns within the Google advertising ecosystem (e.g., in the Google search engine, YouTube, Gmail). This process involves sending an encrypted version of your email address to Google, which compares the received data with its user base to determine if you have an account in Google services. If the match is successful, you will be added to a customised audience list, which will allow us to target you with personalised advertising communications. Personal data is processed until the moment you withdraw your consent.

All our partners and suppliers who process personal data act either as a data processor (processing data on our behalf and according to our instructions – e.g., couriers, payment processors) or as joint/independent controllers (e.g., authorities, or platforms like Facebook which have their own purposes). In any situation, we only transmit the data strictly necessary for the purpose and ensure that there is a legal basis for disclosure.

5. 5. Transfer of Data Abroad

In principle, we store and process your data within the European Union. The main servers and infrastructure are located in the EU. However, certain third-party services we use may involve the transfer of some data outside the European Economic Area (EEA). Examples:

• Email marketing services – If we use an international newsletter sending platform (e.g., MailChimp, which has servers in the US), your email address and name may be transferred to the US to that provider. We will ensure that the respective provider adheres to compliance mechanisms (e.g., Standard Contractual Clauses approved by the European Commission) and that adequate security measures are in place.
• Analytics and advertising tools – Google Analytics and Facebook Pixel involve the storage and processing of some data (such as truncated IP addresses, cookie identifiers) on servers in the US. These companies are obliged to ensure an adequate level of protection. Google, for example, has adopted Standard Contractual Clauses and other measures for transfer. We will activate options such as IP anonymisation in Google Analytics for added security.
• Cloud storage/back-up services – If we use global cloud services (e.g., Amazon AWS, Microsoft Azure) for data storage or backup, some data may be replicated on servers outside the EU. We choose, as much as possible, data centre locations in the EU, but there is the possibility of global backup. Here too, we rely on standard contractual guarantees and security certifications of the providers.

In any scenario of external transfer, we will ensure that one of the safeguards provided for in Article 46 of the GDPR (standard clauses, corporate rules, or other approved mechanisms) applies, or that the destination country has received an adequacy decision from the European Commission (e.g., the eventual adherence of the UK to an adequacy regime, if applicable). We will inform the data subjects and obtain explicit consent for the transfer if the law requires it in specific situations (as a rule, consent is necessary for repeated transfers to recipients without safeguards, but we avoid such situations).

6. 6. Data Storage Period

We keep personal data only for the period necessary to fulfil the stated purposes or according to legal obligations. The storage period may vary depending on the nature of the data:

• Customer account data: for the duration of the account's existence and another 1 year after the account deletion (for potential legitimate interests such as managing any disputes). In addition, certain order information may be stored according to law in records (see invoices below). If an account remains inactive (no login) for a very long period (e.g., 10 years), we will delete or anonymise it, following a prior notification.
• Order and invoice data: transaction records (including invoices containing personal data) are kept for a minimum of 5 years or even 10 years, as the case may be, according to financial and accounting legislation. For example, invoices issued after 01.07.2023 are kept for 5 years in the archive, those before for 10 years, according to the updated Fiscal Code.
• Delivery data: the information transmitted to couriers may be kept by them in their systems according to their own policies (usually 6-12 months). We do not separately store the delivery address except in the context of the order and the invoice.
• Marketing data (newsletter): until consent is withdrawn. Once you have unsubscribed, you will no longer receive communications, but we will keep proof of the initial consent and the unsubscription for a period of time (3 years) in case we need to demonstrate compliance (legitimate interest).
• Access logs and analytics data: data collected via Google Analytics is anonymised and aggregated; reports do not contain direct personal data. Any server logs that may include IPs are generally kept for 30-90 days by the hosting provider, for security (attack detection).
• Correspondence and complaints: emails and requests sent to us may be archived for a period of up to 3 years (to be able to check communication history in case of follow-up or dispute). Warranty complaints will be kept for 2 years (according to the legal warranty period).

Upon the expiration of the relevant storage periods, we will securely delete or anonymise personal data so that it can no longer be associated with a person. If certain data is necessary after expiration for the establishment, exercise, or defence of a right in court, we may keep that data strictly for this purpose, for the duration necessary to finalise the legal action.

7. 7. Data Subject Rights

According to the GDPR, you benefit from a series of rights in connection with your personal data. We fully respect them and are committed to facilitating their exercise. These rights include:

7. Right of access to data: you have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to that data and information about how we process it. Essentially, you can ask us for a copy of the personal data we hold about you (in electronic format).
8. Right to rectification: if you notice that the data we hold is inaccurate or incomplete, you have the right to ask us to correct or complete it without undue delay. (Example: a wrong email address, misspelt name, etc.).
9. Right to erasure ("right to be forgotten"): in certain situations, you have the right to ask us to erase personal data concerning you. For example, if the data is no longer necessary for the purposes for which it was collected, you have withdrawn your consent and there is no other legal basis, you object to the processing and there are no overriding legitimate grounds, the processing was unlawful, etc. Note that the right to erasure is not absolute – there are exceptions (we will not be able to delete data that we are legally obliged to keep for a certain period, such as invoices). But we will respond and, if applicable, grant the request.
10. Right to restriction of processing: you can request the temporary restriction of the processing of your data in certain cases – for instance, if you contest the accuracy of the data (we restrict processing until the data is verified and corrected) or if you have objected to the processing (we restrict it while we check if our legitimate interests override yours). During restriction periods, the data will only be stored, not actively processed (except where you consent or it is legally required).
11. Right to data portability: you have the right to receive the personal data you have provided to us and which is processed by automated means, in a structured, commonly used, and machine-readable format (e.g., CSV). You also have the right to request that we transmit this data directly to another controller, where technically feasible. This right applies only to data processed based on consent or the performance of a contract. In practice, we could offer it to you if you want to export your order history or account information to another provider.
12. Right to object: you can object, on grounds relating to your particular situation, to processing based on our legitimate interest. You can ask us to stop processing your data for those purposes. If it's about direct marketing, we will comply automatically (the right to object is absolute for marketing). If it's about other purposes based on legitimate interest, we will assess whether we have compelling legitimate grounds that override your interests, rights, and freedoms and we will inform you of the outcome. For example, you can object to profiling for marketing at any time – we will cease without objection. However, if you object to data processing for fraud prevention in a secure system, we might argue a stronger interest.
13. Right not to be subject to a decision based solely on automated processing, including profiling: We assure you that we do not make decisions that significantly affect you, based exclusively on automated processing (without human intervention). The profiling we do (e.g., personalised marketing) does not produce legal effects on you and does not significantly affect you – it is limited to personalising advertising. If you still feel that you are targeted by an automated decision with an impact (unlikely in our context), you have the right to ask for human intervention, express your point of view, and challenge the decision.
14. Right to lodge a complaint with the supervisory authority or the courts: If you consider that we have violated your data protection rights, you have the right to lodge a complaint with the supervisory authority – in Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), website: www.dataprotection.ro. You can also address the competent courts of law. Of course, we hope to resolve any dissatisfaction amicably before this course of action is necessary.

How can you practically exercise your rights? You can contact us at any time at reclamatii@lanomobila.ro with a request in this regard. We will respond to your request without undue delay and, in any case, within one month of receipt. This period may be extended by a maximum of two further months if necessary (depending on the complexity and number of requests), but if this happens, we will inform you of the reason. We will grant your request free of charge, except in cases where the requests are manifestly unfounded or excessive (repetitive) – then, according to the GDPR, we may charge a reasonable fee based on administrative costs or refuse the request. Any refusal will be reasoned, and we will also offer you the available remedies.

8. 8. Data Security

We take the security of your data seriously and have implemented appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Secured HTTPS connection: All traffic on the lanomobila.ro website is encrypted via the SSL/TLS protocol, meaning that the transmitted data (e.g., information entered during the order) is encrypted during communication between your browser and the server.
• Secure storage and limited access: Our databases are protected by strong passwords and limited access only to authorised personnel and our technical suppliers (data processors) who need access for system administration. We ensure that data sharing with third parties (e.g., couriers, payment processors) is done securely (through encrypted channels or secure platforms).
• Measures against security breaches: Systems are regularly updated to address any known vulnerabilities. We monitor access and actions within the system to detect unauthorised activity. We have procedures for regular data backup, so that, in case of incidents, we can restore the data.
• Internal policies and training: Our personnel who manage customer data (e.g., customer relations team, technical team) are trained regarding data confidentiality and sign confidentiality agreements. Access to data is granted strictly on a "need-to-know" basis (each employee sees only the data necessary for their role).
• Pseudonymisation and anonymisation: Where possible, we pseudonymise data (e.g., unique identifiers instead of clear names in certain systems) or anonymise data that no longer needs to be in an identifiable format (e.g., we can anonymise an inactive account by deleting personal data).
• Incident response plan: We have an action plan in the unlikely event of a security breach. If we detect a data security breach that poses a risk to your rights and freedoms, we will notify the supervisory authority within the legal term (72h) and will also inform you if necessary, according to Art. 33-34 GDPR.

Please remember that while we make every effort to protect data, no system is infallible. We also encourage you to protect your account – choose a unique and robust password, do not disclose it to others, and log out after using the account on public devices. If you suspect any unauthorised use of your account or if you have received unsolicited messages seemingly from us requesting personal data, please contact us immediately.

9. 9. Cookies and Similar Technologies

Our site uses cookies and similar technologies (e.g., pixels, local storage) to ensure functionality, analyse traffic, and provide you with a personalised experience. For detailed information, consult the Cookie Policy, available on the site. In brief:

• We use strictly necessary cookies for the site's operation (e.g., maintaining the logged-in session, remembering products in the basket), which cannot be disabled as the site would not function correctly without them.
• We use analytical cookies (e.g., Google Analytics) to understand how you interact with the site – these help us improve our services. The data collected is usually aggregated and does not directly identify you.
• We use marketing/advertising cookies (e.g., from Facebook, Google) that allow us to show you relevant offers on other sites, based on the products viewed on our site. These cookies can identify your browser and create a profile of your preferences.
• Upon your first visit, we request your consent for non-essential cookies (analytical and marketing) via a banner. You can choose to accept them all or to customise them. Consent can be withdrawn at any time through the cookie settings on our site (you can always find a "Cookie Settings" link in the footer) or directly from your browser.

For information about the precise types of cookies used, their duration, and the exact method of control, please read the separate Cookie Policy.

10. 10. Changes to the Privacy Policy

We may periodically update this policy to reflect changes in how we process data or changes in regulations. When we make significant changes, we will publish the new version on the site and modify the "last updated" date at the beginning. If the changes are substantial and affect your rights, we will try to inform you proactively (for example, by email or notification upon logging into your account). We encourage you to check this page from time to time to stay up to date with any updates. Continued use of our services after the new policy comes into effect represents acceptance of the changes.

11. 11. Contact

For any questions, concerns, or requests regarding the confidentiality of your data, you can contact us at reclamatii@lanomobila.ro (or use the contact form on the site). We will respond promptly. The protection of your data is important to us, and we will do everything possible to ensure transparency and fairness in everything we undertake in connection with it.

Last updated: May 2025