Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), BOOSTER28 ADS S.R.L. is the data controller and is responsible for determining the purposes and means of processing your personal data.

2. What Data We Collect

We may collect and process the following categories of personal data:

2.1 Data You Provide Directly

• Identity data: first name, last name
• Contact data: email address, telephone number, delivery address, billing address
• Financial data: bank account details (for bank transfer payments), payment reference numbers
• Transaction data: details of products you have purchased, order history, payment amounts
• Communication data: any correspondence you send us (emails, contact form messages, support requests)
• Account data: username, password (encrypted), account preferences (if you create an account)

2.2 Data We Collect Automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution
• Usage data: pages visited, time spent on pages, click patterns, referring URL, exit pages
• Location data: approximate geographic location derived from your IP address
• Cookie data: information collected through cookies and similar tracking technologies (see our Cookie Policy)

2.3 Data from Third Parties

• Analytics data: aggregated and individual user behaviour data from Google Analytics
• Advertising data: conversion data and audience information from Google Ads
• Shipping data: delivery status and tracking information from our logistics partners

3. How We Collect Your Data

We collect personal data through the following methods:

• Directly from you: when you place an order, create an account, subscribe to our newsletter, fill in a contact form, or communicate with us via email or phone
• Automatically: when you browse our website, through cookies, server logs, and similar technologies
• From third parties: analytics providers (Google Analytics), advertising networks (Google Ads), and shipping carriers who provide delivery updates

4. Legal Basis for Processing

Under Article 6 of the GDPR, we process your personal data on the following legal bases:

Where we rely on your consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Purpose of Processing

We use your personal data for the following purposes:

• Order fulfilment: processing your orders, arranging delivery, sending order confirmations and shipping updates
• Customer service: responding to your inquiries, handling complaints, processing returns and refunds
• Account management: creating and managing your customer account, saving your preferences
• Marketing communications: sending promotional emails, product recommendations, and special offers (only with your explicit consent)
• Website improvement: analysing how visitors use our website to improve functionality, content, and user experience
• Advertising: measuring the effectiveness of our advertising campaigns, remarketing to previous visitors through Google Ads
• Fraud prevention: detecting and preventing fraudulent transactions and abuse
• Legal compliance: meeting our obligations under applicable tax, accounting, and consumer protection laws

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our specific retention periods are:

When personal data is no longer needed, we securely delete or anonymise it so that it can no longer be linked to you.

7. Who We Share Your Data With

We may share your personal data with the following categories of recipients, only to the extent necessary for the stated purposes:

7.1 Service Providers

7.2 Legal and Regulatory

We may disclose your data to:

• Tax authorities (ANAF Romania) as required by law
• Law enforcement agencies when legally obligated
• Courts or regulatory bodies in response to valid legal requests

7.3 No Selling of Data

8. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we ensure that appropriate safeguards are in place, including:

• Adequacy decisions: transfers to countries that the European Commission has determined provide an adequate level of data protection (e.g., the EU-US Data Privacy Framework)
• Standard Contractual Clauses (SCCs): contractual clauses approved by the European Commission that provide appropriate data protection guarantees
• Binding Corporate Rules: where applicable, approved internal rules that ensure adequate protection within a corporate group

Specifically, Google LLC (providing Google Analytics and Google Ads services) is certified under the EU-US Data Privacy Framework, which has been recognised by the European Commission as providing adequate protection for personal data transferred from the EU to the United States.

You may request a copy of the relevant safeguards by contacting us at info@habymart.shop.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic, and support our advertising efforts.

We use the following categories of cookies:

• Strictly necessary cookies: essential for the website to function (e.g., shopping cart, session management)
• Functional cookies: remember your preferences (e.g., language, region)
• Analytics cookies: help us understand how visitors interact with our website (Google Analytics)
• Marketing cookies: used to deliver relevant advertisements and measure campaign effectiveness (Google Ads)

Non-essential cookies are only placed after you have given your explicit consent through our cookie consent banner.

For detailed information about the specific cookies we use, their purposes, and durations, please read our full Cookie Policy.

10. Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Google Analytics uses cookies to collect information about how visitors use our website. This information includes:

• Pages visited and time spent on each page
• How you arrived at our website (referral source)
• Your approximate geographic location (country/city level)
• Your device type, browser, and operating system
• Interaction events (clicks, scrolls, form submissions)

We have implemented the following privacy measures:

• IP anonymisation: Google Analytics 4 does not log or store full IP addresses
• Data retention: set to 26 months
• Google Signals: disabled unless you have consented to marketing cookies
• Data sharing: we do not share Google Analytics data with Google for benchmarking or other purposes

Google Analytics data is only activated after you provide consent through our cookie banner. You can also opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on.

For more information, see Google’s Privacy Policy.

11. Google Ads and Remarketing

We use Google Ads services, including conversion tracking and remarketing, provided by Google Ireland Limited and Google LLC.

11.1 Conversion Tracking

When you click on a Google advertisement and visit our website, a conversion tracking cookie may be placed on your device (with your consent). This allows us to measure whether an ad click resulted in a purchase or other action on our website. We receive aggregate statistics only and cannot identify individual users from this data.

11.2 Remarketing

With your consent, we may use Google Ads remarketing to show you personalised advertisements on other websites within the Google Display Network and Google Search. This is based on your previous visits to our website. You can opt out of personalised advertising by visiting Google Ads Settings.

11.3 Google Consent Mode v2

We have implemented Google Consent Mode v2 on our website. This ensures that Google tags (Analytics and Ads) adjust their behaviour based on your cookie consent preferences. If you decline marketing or analytics cookies, Google tags will operate in a restricted mode that does not collect personal data or place tracking cookies.

12. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

13. How to Exercise Your Rights

To exercise any of the rights listed above, you may contact us by:

• Email: info@habymart.shop — subject line: “GDPR Data Request”
• Post: BOOSTER28 ADS S.R.L., Strada Lunga, Nr. 149, Ap. P3, 500059 Brașov, Romania

We will respond to your request within 30 days of receipt. If your request is complex or we receive a high volume of requests, we may extend this period by a further 60 days, in which case we will inform you within the initial 30-day period.

To verify your identity, we may ask you to provide additional information. We will not charge a fee for processing your request unless it is manifestly unfounded or excessive.

14. Right to Lodge a Complaint

If you believe that we have not handled your personal data correctly or that your data protection rights have been violated, you have the right to lodge a complaint with the competent supervisory authority.

You may also lodge a complaint with the supervisory authority in the EU Member State where you reside or work, or where the alleged infringement occurred.

15. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our website
• Encrypted storage of sensitive data (passwords, payment details)
• Access controls limiting data access to authorised personnel only
• Regular security updates and vulnerability assessments
• Secure hosting with reputable hosting providers that maintain industry-standard security certifications

While we strive to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any data breach in accordance with GDPR requirements (notification within 72 hours where required).

16. Children’s Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete that data as soon as possible. If you believe that a child has provided us with their personal data, please contact us at info@habymart.shop.

17. Links to Third-Party Websites

Our website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Post a prominent notice on our website
• Where required by law, notify you by email

We encourage you to review this Privacy Policy periodically. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us: