Information on the processing of personal data under Regulation (EU) 2016/679 (GDPR).
The controller
- Name
- FECCO HOLDING S.R.L.
- Registered seat
- Sat Cetariu, comuna Cetariu, str. Cetariu nr. 317, județul Bihor, România
- info@vapelio.eu
What we process, why and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Fulfilling the order | name, e-mail, phone, delivery address, pickup point, order contents | performance of a contract (Art. 6(1)(b)) | 5 years from performance (limitation period) |
| Invoicing and accounting | billing name and address, items, amount | legal obligation (Art. 6(1)(c)) | 8 years (Accounting Act) |
| Contact and complaints | name, e-mail, phone, content of the complaint | legal obligation / legitimate interest | 5 years for complaints |
| Card payment | identifiers needed for payment (no card data is processed by us) | performance of a contract | per the payment provider’s rules |
| Running and securing the shop | session identifier, IP address, log data | legitimate interest (Art. 6(1)(f)) | up to 12 months |
Processors
- Hosting provider (data centre within the European Union) – storage required to operate the shop.
- General Logistics Systems Romania S.R.L. (Str. Ștefan cel Mare nr. 3, 557260 Șelimbăr, Sibiu County, Romania; VAT RO21611392) – delivery; receives name, address or pickup point, phone number and e-mail. Delivery is performed through the GLS group’s national partner network.
- Stripe Payments Europe, Ltd. – card payment processing.
- Accounting partner – storage and processing of invoices.
Your rights
- Information about and access to the data processed.
- Rectification, erasure, restriction of processing.
- Data portability for data processed to perform the contract.
- Objection to processing based on legitimate interest.
- Withdrawal of consent, without affecting the lawfulness of prior processing.
How to exercise them
Send your request to info@vapelio.eu. We reply within one month. If you disagree with the reply you may lodge a complaint with the Romanian data protection authority (ANSPDCP, Bucharest) as the controller’s lead authority, or with the supervisory authority of your habitual residence, and you may also go to court.
We do not use your data for automated decision-making or profiling, and we do not transfer it to third countries except where the processors above require it, subject to appropriate safeguards.
Senast uppdaterad: 2026. 08. 14.