Privacy Policy – www.xenon-bright.ro

SC BOZAVA MOB DESIGNE SRL ("Xenon Bright"), headquartered at 49C Elizeului Street, Tulcea, Romania, VAT No. RO28388523, Trade Register No. J36/187/2011, acting as the Data Controller, is committed to respecting and protecting the personal data of data subjects in accordance with:

• Regulation (EU) 2016/679 ("GDPR"), in particular Articles 5–6, 12–22, 24–25, and 32–36;
• Romanian Law No. 190/2018 implementing the GDPR;
• Romanian Law No. 506/2004 (ePrivacy);
• the regulations issued by the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

1. Principles and Legal Basis for Processing

Personal data is processed in accordance with the principles set out in Article 5 GDPR, namely lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

The legal bases for processing include:

• Article 6(1)(b) GDPR – performance of a contract, including orders, deliveries, invoicing and warranty services;
• Article 6(1)(c) GDPR – compliance with legal, tax and accounting obligations;
• Article 6(1)(f) GDPR – legitimate interests, including fraud prevention, website security and customer support;
• Article 6(1)(a) GDPR – explicit consent for marketing communications, newsletters, personalised recommendations and profiling.

2. Categories of Personal Data Collected

Identification data

• First name and last name;
• Postal address;
• Personal Identification Number, only where legally required;
• Email address;
• Telephone number.

Payment information

Payment details are securely processed by external payment service providers, including MobilPay, Revolut, Klarna and TBI Pay. Xenon Bright does not store complete payment card information.

Technical data

• IP address;
• Browser and device information;
• Cookies;
• Website usage and browsing behaviour for functional, analytical and marketing purposes.

Additional information

• Profile photo, if voluntarily uploaded;
• User preferences and settings voluntarily provided by the customer.

We do not intentionally collect special categories of personal data as defined by Article 9 GDPR, nor do we knowingly process personal data relating to children under the age of 16 without explicit parental consent.

3. Purposes of Processing

• Performance and execution of purchase contracts, including delivery, payments and warranty services – Article 6(1)(b) GDPR;
• Compliance with legal, accounting and tax obligations – Article 6(1)(c) GDPR;
• Direct marketing, newsletters and personalised recommendations – Articles 6(1)(a) and 6(1)(f) GDPR;
• Website security and fraud prevention – Article 6(1)(f) GDPR;
• Internal analytics and service improvement – Article 6(1)(f) GDPR;
• Handling customer complaints, warranty claims and support requests – Articles 6(1)(b), 6(1)(c) and 6(1)(f) GDPR.

4. Data Retention Period

5. Your Rights

Under Articles 15–22 GDPR, you have the right to:

• access your personal data – Article 15 GDPR;
• request correction of inaccurate data – Article 16 GDPR;
• request erasure, also known as the "Right to be Forgotten" – Article 17 GDPR;
• request restriction of processing – Article 18 GDPR;
• receive your data in a portable format – Article 20 GDPR;
• object to processing, including direct marketing – Article 21 GDPR;
• not be subject solely to automated decision-making without meaningful human intervention – Article 22 GDPR.

To exercise any of these rights, please contact us at: office@xenon-bright.ro

We will respond within 30 days, in accordance with Article 12 GDPR. Where requests are particularly complex or numerous, this period may be extended by up to two additional months, and you will be informed accordingly.

6. Data Sharing and Protection

Personal data may be shared with:

• logistics and courier service providers;
• payment processors;
• IT service providers;
• marketing service providers;
• accounting and legal service providers;
• Romanian public authorities where required by law, including ANAF and ANSPDCP.

International data transfers outside the European Economic Area are carried out only where appropriate safeguards are in place, including the European Commission Standard Contractual Clauses pursuant to Article 46 GDPR.

To protect your information, we implement appropriate technical and organisational security measures, including:

• TLS/SSL encryption;
• restricted internal access;
• password-protected systems;
• regular backups;
• security monitoring and auditing.

In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours where required by Articles 33 and 34 GDPR and, where legally necessary, inform affected individuals without undue delay.

7. Cookies and ePrivacy Policy

In accordance with Romanian Law No. 506/2004 and the GDPR, Xenon Bright uses functional cookies, analytical cookies and marketing cookies.

Where legally required, cookies are installed only after obtaining your prior consent. You may withdraw your consent at any time through our Cookie Settings.

Further information is available in our Cookie Policy.

8. Liability

Failure to comply with the GDPR may result in administrative fines of up to EUR 20 million or 4% of the worldwide annual turnover, whichever is higher.

The Romanian supervisory authority, ANSPDCP, may also issue warnings, corrective measures or administrative sanctions in accordance with Romanian legislation.

9. Changes to this Privacy Policy

We reserve the right to update or amend this Privacy Policy at any time.

Any changes become effective upon publication on our website. The latest version will always remain available on this page.

10. Contact Information

Data Controller:
SC BOZAVA MOB DESIGNE SRL

Email for Privacy / Data Protection:
office@xenon-bright.ro

Supervisory Authority:
Romanian National Supervisory Authority for Personal Data Processing – ANSPDCP

Address:
28–30 General Gheorghe Magheru Boulevard,
Sector 1, Bucharest, Romania

Telephone:
+40 318 059 211 / +40 318 059 212

Email:
anspdcp@dataprotection.ro

By using the services provided by Xenon Bright, you acknowledge that you have read, understood and expressly accepted this Privacy Policy.