Privacy policy

• Identification and contact data: first name, last name, email, phone number.
• Delivery data: full address, city, county, postal code — required to issue the courier waybill.
• Banking data: IBAN and account holder, used exclusively to pay for the device.
• Device data: model, storage capacity, cosmetic condition, declared defects, IMEI/serial number.
• Generated documents: handover report, self-declaration statement, and applied digital signature.
• Technical data: IP address, device and browser type, pages visited, partner referral code (if you came through a referral).

We do not collect special category data and do not access the content of the devices we receive.

• Contract performance (Art. 6(1)(b) GDPR): device evaluation, waybill issuance, document generation, payment.
• Legal obligations (Art. 6(1)(c)): invoicing, accounting records, obligations related to purchasing second-hand goods.
• Legitimate interest (Art. 6(1)(f)): fraud prevention, verifying device provenance, platform security.
• Consent (Art. 6(1)(a)): commercial communications, if you subscribed. You can withdraw it at any time.

• Courier companies, for the delivery and return of devices.
• Cloud infrastructure and transactional email providers, under data processing agreements.
• Partners in the collection network, strictly for the device handed in through them.
• Banks and accounting providers, for payment and tax reporting.
• Public authorities, only upon a justified legal request.

We do not sell or rent personal data to third parties.

• Accounting and transaction documents: 10 years, per tax legislation.
• User account and request history: until account deletion, then up to 30 days in backups.
• Unfinished requests: 12 months.
• Marketing data: until consent is withdrawn.

We use strictly necessary cookies for authentication and to keep your evaluation session, plus attribution cookies for partner codes. Analytics cookies are used only in aggregate, to understand how the configurator is used. You can block them from your browser, at the risk of authentication no longer working.

Data is transmitted encrypted (HTTPS), stored in infrastructure with role-based access restrictions, and administrative access is limited to those who need it. Banking data is visible only for payment processing.

You have the right to access, rectify, erase, restrict, receive a portable copy of, object to processing of your data, and not to be subject to automated decisions with significant effects. Procedure details are in the GDPR policy. Write to us at contact@vindetelefon.ro; we reply within 30 days.

The service is intended for people over 18. We do not knowingly process minors' data; if we identify such data, we delete it.