Legal
Privacy Policy
Last updated: 13 August 2026
This policy explains what we do with your personal data when you visit laesthete.ro, buy from us, write to us, or subscribe to our letter. We keep it short and specific on purpose.
1. Who is responsible
The controller of your personal data is:
- AESTHETE CONCEPT SRL, trading as L'AESTHETE
- CUI: 49489997 · Trade Register: J2024000638234
- Registered office:
- Email: contact@laesthete.ro · Telephone: +40 740 087 777
2. What we collect, why, and on what basis
| Data | Why | Legal basis (GDPR art. 6) | Kept for |
|---|---|---|---|
| Order data — name, email, telephone, delivery address, items, amounts, order and payment references | To take payment, deliver your order, handle returns and support you | Performance of a contract (art. 6(1)(b)) | 10 years — Romanian accounting and tax law (Legea 82/1991) |
| Card details | To take payment | Performance of a contract (art. 6(1)(b)) | Never reaches us — handled entirely by Stripe |
| Contact-form messages — name, email, subject, message | To answer your enquiry | Legitimate interest in responding to you (art. 6(1)(f)) | 2 years from last contact |
| Newsletter email address | To send you our letter | Your consent (art. 6(1)(a)) — withdrawable at any time | Until you unsubscribe |
| Back-in-stock email address | To tell you once when a product returns | Your consent (art. 6(1)(a)) | Deleted after we notify you, or on request |
| Basket contents and delivery-region choice, stored in your browser | To keep your basket between visits | Strictly necessary for a service you requested | Stays on your device until you clear it |
| Server logs kept by our hosting and backend providers | Security, fraud prevention, keeping the site running | Legitimate interest in a secure service (art. 6(1)(f)) | As set by those providers, typically weeks |
We do not use your data for profiling or automated decision-making, and we never sell it.
3. Who processes it for us
We use a small number of carefully chosen processors. Each acts on our instructions under a data processing agreement.
- Stripe Payments Europe, Ltd. (Ireland) — payment processing. Stripe is an independent controller for fraud prevention and its own regulatory duties. See stripe.com/privacy.
- Supabase — database and backend. Our data is hosted in the EU (Frankfurt).
- Resend — sending transactional and newsletter email.
- Netlify — website hosting and content delivery.
- Google Fonts — typefaces are requested from Google's servers when the page loads, which discloses your IP address to Google.
Some of these providers are established outside the EEA or use sub-processors that are. Where data is transferred outside the EEA it is protected by the European Commission's Standard Contractual Clauses or an adequacy decision.
4. Your rights
Under the GDPR you may ask us to: give you access to your data; correct it; erase it; restrict how we use it; provide it in a portable format; or object to processing based on legitimate interests. Where processing rests on your consent, you may withdraw that consent at any time — this does not affect processing carried out before you withdrew it.
Write to contact@laesthete.ro and we will respond within one month. Every newsletter also carries a one-click unsubscribe link.
Note that we cannot erase order records we are legally required to keep for accounting purposes until that period expires; we restrict them instead.
5. Complaints
If you believe we have mishandled your data, please tell us first. You also have the right to complain to the Romanian supervisory authority, ANSPDCP — dataprotection.ro.
6. Security
The site is served over HTTPS. Access to order data is restricted to authenticated administrators and enforced at the database level. Card data never touches our systems.
7. Children
Our products and this site are intended for adults. We do not knowingly collect data from children under 16.
8. Changes
If we change this policy we update the date at the top. Material changes affecting your rights will be communicated directly where we can.