Privacy & GDPR Policy

SOTEO S.R.L., registered in Sat Turnu, Pecica, Arad, Romania (email: office@soteo.eu), acts as the Data Controller under the General Data Protection Regulation (GDPR) (EU) 2016/679. We collect and process personal data—specifically your first name, last name, billing and shipping address, email address, phone number, payment details, and transaction history—solely for the purposes of contract execution, order fulfillment, billing, and tax compliance.

The legal bases for processing your personal data are: Article 6(1)(b) of the GDPR (processing is necessary for the performance of a sales contract); Article 6(1)(c) of the GDPR (processing is necessary for compliance with legal accounting, fiscal, and tax obligations under Romanian law); and Article 6(1)(f) of the GDPR (our legitimate interest in preventing fraud, securing transactions, and optimizing storefront usability).

Your personal data is strictly confidential. We only share it with trusted service providers essential to operate our storefront and fulfill transactions, including payment processors, shipping couriers, cloud hosting providers, and technical database administrators. No personal data is sold to third parties or used for profiling or automated decision-making.

We retain transaction records, invoices, and payment details for a mandatory period of 5 years to comply with Romanian fiscal regulations and accounting legislation. Customer account profiles are stored until you request deletion. Marketing data and newsletter subscriptions are processed exclusively based on your explicit consent (Art. 6(1)(a) GDPR) and are deleted immediately if you withdraw consent.

Under the GDPR, you have the right to access, rectify, or request the erasure of your data ('right to be forgotten'), restrict or object to processing, request data portability, and withdraw consent at any time. To exercise these rights, please email us at office@soteo.eu. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) in Romania.