Privacy policy

GENERAL TEMPLATE — complete the placeholders and review this document before treating it as your final policy.

Who operates this website [Legal company name], [registered address], [registration / VAT number] is the controller for personal data collected through Xline. Contact: [privacy email and postal address].

Information and purposes We process information you submit when contacting us, requesting a product, creating an account or placing an order. Specify the actual fields collected, services used and legal basis for each activity: [contract / steps before a contract], [legal obligations], [documented legitimate interests where applicable]. Do not list a service that is not used.

Optional website analytics Only after analytics consent, our own system records page paths without query strings, product identifiers, visit times, language, device category, referral domain and randomly generated browser and session identifiers. We count page views, consented browsers and clicks on WhatsApp links. A click does not prove that a message or purchase occurred. We do not store names, emails, full referral URLs, raw IP addresses or full browser user-agent strings in analytics. A temporary keyed hash derived from the request IP limits abusive requests and is removed after one day. Detailed analytics records are retained for 90 days. Browser identifiers last up to 180 days; session identifiers expire after 30 minutes of inactivity. Consent is the legal basis for optional analytics. Refusing it leaves the catalog available.

Your choices You can accept, refuse or change optional analytics and recently viewed products through Cookie preferences in the footer. Withdrawing consent stops future tracking and clears analytics identifiers on this browser. It does not automatically erase records already collected; contact us for a data request. Do Not Track signals are respected by our analytics.

Recipients and international transfers Our hosting and database providers support the website. Current infrastructure uses Vercel and Supabase. Complete [provider legal entities, processing locations, contractual safeguards and any international transfer mechanism] based on the actual contracts. Opening a WhatsApp link takes you to WhatsApp, whose own privacy terms apply.

Retention and security For enquiries, orders, accounts, invoices and other records, state [retention periods and reasons]. Access to administrative functions and detailed analytics is restricted. No security measure can guarantee absolute protection.

Your rights Subject to applicable conditions, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent without affecting prior lawful processing and complain to the competent supervisory authority. In Romania this is ANSPDCP (dataprotection.ro). Explain [identity verification procedure and response process].

Updates We will update this policy when our practices change. Complete [effective date] and provide an appropriate notice of material changes.