Privacy policy

The privacy of your data matters to us. This policy explains what data we collect, why, and how we protect it, in line with Regulation (EU) 2016/679 (GDPR).

1. Data controller

Cojocea Andreea Persoană Fizică Autorizată, tax ID (CUI) 54712598, registered office at Bulevardul Dunărea, nr. 19A, Galați, jud. Galați, email dreyacandles@gmail.com.

2. What data we collect

• Identification and contact details: name, email, phone;
• Delivery and billing address;
• Order details (products, amounts) — we do not store card details, these are processed securely by Stripe;
• Technical data: IP address, browser type, cookies.
• Photos you optionally attach to the contact form (for example a product damaged in transit). We keep them in a private space that only Dreya Candles can access, and use them solely to resolve your report;
• Your email address, if you subscribe to the newsletter;
• Your name and the text of your review, if you leave a product review.

3. Why we use it

Every purpose has its own legal basis, stated next to it (Regulation (EU) 2016/679, art. 6).

• Processing and delivering orders — basis: performance of the contract we enter into with you;
• Communication about your order (confirmations, updates) — basis: performance of the contract;
• Meeting legal obligations, such as invoicing and keeping accounting records — basis: our legal obligation;
• The "back in stock" notice, if you ask for it on the page of a sold-out product — basis: your consent, given by asking for the notice: we use your address once, for that product only, and don't add you to any list;
• Sending the newsletter, only if you have subscribed. The legal basis is your consent, which you may withdraw at any time through the unsubscribe link in every message or by writing to us. We do not use the address for anything else and we do not pass it on;
• Publishing product reviews. The review is displayed publicly on the product page together with the name you enter in the form — a first name or an initial is fine. No other account data is shown. The review can be deleted at your request;
• Improving the experience on the site, from browsing statistics — basis: your consent, given on the cookie banner. If you decline, we measure nothing.

4. Who we share data with

Data may only be shared with providers needed to deliver the service: the payment processor (Stripe), the courier company, the email provider (Resend) and the infrastructure providers the shop runs on — Supabase (database, accounts and files) and Vercel (website hosting). All of them process the data only on our instructions. We do not sell your data.

If you choose to sign in with Google, we use "Sign in with Google" through Supabase: Google gives us your email address and, where available, your name and profile picture, strictly in order to create or open your account. We never receive your Google password. Signing in with Google is optional — email and password work just as well.

On the sign-in pages we use Cloudflare Turnstile, an anti-bot check that receives your IP address and some technical information about your browser, strictly to tell a person from an automated program. Cloudflare states that it does not use this data for advertising, nor to track you across other websites. The check appears only when signing in or creating an account — not while you browse, in the cart or at checkout.

If you consent on the cookie banner, browsing statistics also reach Google (Google Ireland Limited), which may transfer them to the United States under the European Commission's adequacy decisions. Without your consent nothing goes there. Details and how to withdraw, in the Cookie policy.

5. How long we keep data

We keep order data for the period required by tax law (as a rule 10 years for accounting documents). All other data we keep for as long as needed for the purpose it was collected for. Photos attached to a contact message are permanently deleted together with the message, once the report is resolved. The newsletter address is kept until you unsubscribe, and reviews stay published for as long as the product is on the site or until you ask us to remove them.

6. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability. You can exercise these rights by writing to us at dreyacandles@gmail.com. You can also contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): dataprotection.ro.

7. Cookies

We use cookies to make the site work. Details on the Cookie policy page.