GDPR policy

• Lawfulness, fairness and transparency — we clearly tell you what we collect and why.
• Purpose limitation — data collected for a transaction is not reused for incompatible purposes.
• Data minimization — we only ask for what's necessary for evaluation, shipping, documents and payment.
• Accuracy — you can correct your account data at any time.
• Storage limitation — we delete or anonymize data once legal retention periods expire.
• Integrity and confidentiality — encryption in transit, role-based access, logging of administrative access.

• Access — you can request a copy of the data we hold about you.
• Rectification — correcting inaccurate or incomplete data.
• Erasure ("the right to be forgotten") — except for data we must retain due to tax and accounting obligations.
• Restriction of processing — during the review of a dispute.
• Portability — receiving your data in a structured, commonly used, machine-readable format.
• Objection — to processing based on legitimate interest and, at any time and unconditionally, to direct marketing.
• Withdrawal of consent — for commercial communications, without affecting the lawfulness of prior processing.
• Complaint — to ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing, dataprotection.ro) or to a court.

• Send an email to contact@vindetelefon.ro with the subject "GDPR Request".
• Specify the right invoked and, if applicable, the transaction or device you're referring to.
• For identity verification we may ask for confirmation from the email address associated with your account. We do not request ID copies unless strictly necessary.
• We reply within a maximum of 30 calendar days; this can be extended by 60 days for complex requests, with prior notice.

Exercising your rights is free of charge. Repetitive or abusive requests may be charged a reasonable fee or refused with justification.

We work with hosting, database, transactional email and courier providers, under processing agreements compliant with Art. 28 GDPR. Data is stored within the European Union. If a transfer outside the EEA becomes necessary, it is carried out only under the Standard Contractual Clauses approved by the European Commission.

The indicative offer is calculated automatically based on your answers in the configurator, but it does not produce final legal effects: the final offer is validated by a human operator after the physical inspection. You can dispute the result and request a re-evaluation at any time.

In the event of a security breach that poses a risk to data subjects' rights, we notify ANSPDCP within 72 hours of discovery and directly inform the affected users, describing the incident, its likely consequences and the measures taken.

We recommend a factory reset before shipping. Regardless, every device that enters our stock is fully wiped and disconnected from previous accounts before repair or resale.