Privacy Policy
1. Data Controller
The controller of personal data collected through the damaged.style website ("Site") is DAMAGED ("we"). Full identification details of the controller are available in the Site's Terms and Conditions. For any question regarding the processing of your data, you may contact us at: contact@damaged.style.
2. What Data We Collect and Why
a) Data you provide directly, when you place an Order or contact us. The Site does not offer the option to create an account — each Order is processed individually, as a guest, with no associated account history. We collect: first and last name, email address, delivery address and, where applicable, billing address, phone number; the content of the Order (products, sizes, quantities); any information voluntarily submitted through the contact form or by email.
If you start an Order but do not complete it (abandoned cart), we may retain the email address entered up to that point, in order to send you a reminder by email about the unfinished order.
b) Payment data. Your full card details are entered directly into the secure infrastructure of our payment processor, Stripe, and are not collected, stored, or accessible by DAMAGED. We only keep a reference to the transaction (amount, date, status) necessary to manage the Order.
c) Data collected automatically through the Site, as you browse it: technical data (IP address, device and browser type, pages visited, time spent, traffic source), collected through traffic analysis tools, if and when implemented on the Site (for example, Google Analytics or other similar traffic/performance analysis tools), in order to understand how the Site is used, which pages you visit, and to improve it; cookies and similar technologies — detailed separately in the Cookie Policy, available on the Site once implemented.
We do not collect special categories of data (racial/ethnic origin, political opinions, health data, etc.) and we do not request such information through any form on the Site.
3. Legal Basis for Processing
We process your data on the basis of the following grounds set out in Article 6 of Regulation (EU) 2016/679 (GDPR):
- performance of the contract — for processing and delivering Orders and related communications;
- our legitimate interest — for traffic analysis and Site improvement, fraud prevention, and sending a reminder about an unfinished Order (abandoned cart); this legitimate interest is always weighed against your fundamental rights and freedoms, and you may object to this processing at any time;
- consent — for non-essential analytics/marketing cookies, given explicitly through the cookie banner displayed on your first visit (see Cookie Policy);
- legal obligation — for retaining accounting and financial documents in accordance with Romanian tax legislation.
4. Who We Share Data With (Processors)
We do not sell or rent your data to third parties for their own marketing purposes. We share data, strictly to the extent necessary, with the following categories of processors/service providers, who process the data in accordance with our instructions and the data processing agreements concluded with them: Our production and fulfillment partner — for manufacturing and shipping standard, made-to-order products. Receives: name, delivery address, Order content. The courier we choose for Mystery Box orders — for the direct shipment of these orders, handled personally by DAMAGED. Receives: name, delivery address, phone number. Our payment processing provider — for processing payments. Receives payment data, processed directly by the provider, without passing through our systems. Our database/storage provider — for storing Order data. Receives all data associated with the Order. Our email delivery provider — for transactional emails (order confirmation, notifications, abandoned cart reminder). Receives the email address and the content of the communication. Our traffic analysis tool — for analyzing traffic and behavior on the Site. Receives technical browsing data and cookie-type identifiers.
5. International Data Transfers
Some of the processors/tools used (in particular the traffic analysis tools, if and when implemented) may process data outside the European Economic Area, including in the United States. Such transfers are carried out on the basis of appropriate safeguards provided for under the GDPR — Standard Contractual Clauses approved by the European Commission and/or other compliance mechanisms applicable to the respective provider. You may request further information about these safeguards at the contact address indicated in Chapter 1.
6. Retention Period
We retain your data for as long as necessary for the purpose for which it was collected, namely:
- data related to Orders and associated accounting/financial documents — in accordance with the mandatory periods set out in Romanian tax legislation (generally 10 years);
- data from an abandoned cart (if no completed Order resulted) — for a reasonable period, sufficient to send you the related reminder, after which it is deleted;
- analytics data — in accordance with the retention period configured in the account of the analytics tools used, currently the standard period for such services;
- data from the contact form — for as long as necessary to resolve your request, plus a reasonable period thereafter.
7. Your Rights
Under the GDPR, you have the right to request, in relation to your data:
- access to the data and information about the processing;
- rectification of inaccurate or incomplete data;
- erasure of data ("the right to be forgotten"), under the conditions provided by law;
- restriction of processing, in certain situations;
- data portability, in a structured, commonly used, machine-readable format;
- objection to processing based on our legitimate interest, including abandoned cart reminders or behavioral analytics;
- withdrawal of consent at any time, for processing based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise these rights, you may contact us at the address indicated in Chapter 1. We will respond within the timeframe provided by law (in principle, 30 days).
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro — if you believe that the processing of your data infringes applicable legislation.
8. Data Security
We apply appropriate technical and organizational measures to protect data against unauthorized access, loss, or accidental destruction, including restricting access to data only to persons who need it to perform their duties, and using providers that meet recognized security standards.
9. Cookies
The Site uses technical cookies necessary for its operation and analytics cookies. On your first visit, a consent banner allows you to choose which categories of cookies you accept, other than those strictly necessary; your choice is retained for subsequent visits and can be changed at any time. Full details on the categories of cookies used, the purpose of each, and how you can withdraw your consent are available in a separate Cookie Policy, accessible on the Site.
10. Changes to This Policy
We may periodically update this Privacy Policy to reflect legal or operational changes. The date of the last update is shown in the heading. We recommend that you review this document periodically.
11. Contact
For any question regarding the processing of your personal data, you may contact us at: contact@damaged.style.