Data Protection (GDPR)
A short, practical guide to your data at AAFIT: what we process, on what basis, for how long — and how you exercise your rights. For full details, see the Privacy Policy.
In short
At AAFIT (a brand of AWA FLOT S.R.L.) we process your data transparently and only for clear purposes — to process your orders, issue your invoice, deliver and support you. We do not sell your data.
Controller: AWA FLOT S.R.L. · Bd. Pipera nr. 1/VII, Etaj 6, Camera 4, Voluntari, Ilfov, 077190 · CUI RO48354568 · Reg. Com. J29/1364/2023
Data protection contact: comenzi@aafit.ro
Your rights and how to use them
Under GDPR you have the rights below. Exercise them directly in your AAFIT account ("My account") or by e-mail to comenzi@aafit.ro.
| Your right | What it means | How to use it |
|---|---|---|
| Access | Find out what data we hold and get a copy | "My account" or e-mail request |
| Rectification | Correct inaccurate or incomplete data | Edit in "My account" or write to us |
| Erasure | We delete your data, unless legally required to keep it | "My account" → Delete account |
| Restriction | Temporarily limit how we use your data | E-mail request |
| Portability | Receive your data in a machine-readable format | "My account" → Export data |
| Objection | Object to legitimate-interest processing and, anytime, to marketing | "Unsubscribe" link or e-mail |
| Withdraw consent | Withdraw consent (newsletter, cookies) anytime | "Unsubscribe" / "Cookie settings" |
| Automated decisions | Not subject to solely automated decisions with significant effects | We use none |
Timing: we reply within one month (extendable by up to 2 months for complex requests). Exercising your rights is free. We may verify your identity.
Processing register (summary)
| Data category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Identification + contact | Order intake, delivery and support | Performance of contract (Art. 6(1)(b)) | Contract + legal term |
| Order and payment data | Processing and delivering the order | Performance of contract (Art. 6(1)(b)) | Contract + legal term |
| Billing data | Invoicing, tax obligations | Legal obligation (Art. 6(1)(c)) | Legal archiving term |
| Account data | Creating and managing the account | Performance of contract (Art. 6(1)(b)) | Until account deletion |
| Newsletter / marketing | Communications, offers, recommendations | Consent (Art. 6(1)(a)) | Until unsubscribe |
| Analytics/marketing cookies (GA4, Meta, TikTok) | Statistics, optimisation, advertising | Consent via banner (Art. 6(1)(a) + Law 506/2004) | Per Cookie Policy |
| Traffic and transaction data | Fraud prevention, security | Legitimate interest (Art. 6(1)(f)) | As needed + limitation (~3 years) |
Who we share data with
Only partners necessary to run the store, under confidentiality contracts: GLS (delivery), SmartBill (invoicing), Stripe / PayPo / Klarna / TBI Bank (payments), Brevo (e-mail), Google / Meta / TikTok (analytics and advertising, consent only; Google Login), hosting/IT providers, advisers and public authorities where legally required. We do not sell your data.
Transfers outside the EU/EEA
Data stays primarily in the EU/EEA. Some providers (Google, Meta, TikTok) may process data outside the EU/EEA (e.g. the USA), with GDPR safeguards: adequacy decisions (Art. 45) or Standard Contractual Clauses (Art. 46).
A question or complaint?
Write to us first at comenzi@aafit.ro — we resolve issues quickly. If you still believe we process your data unlawfully, you may contact ANSPDCP: B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest; +40.318.059.211; anspdcp@dataprotection.ro; www.dataprotection.ro. You may also go to the competent courts.
