01Data controller

1.1. Your personal data is processed by the company below, as data controller, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law 190/2018.

1.2. For any question about your data, write to office@epalinca.ro.

1.3. The tasting room at Str. Petőfi Sándor 116, Săcueni is operated by ZEKULHYDA S.R.L., VAT no. 40648975, Trade Register no. J5/686/2019, Str. Petőfi Sándor 116, 417435 Săcueni, jud. Bihor, România. For the data sent through the tasting booking request (name, phone, e-mail, date, group size, message) the controller is ZEKULHYDA S.R.L., which uses it only to confirm and organise the visit. Questions can be sent to the same e-mail address.

02What we collect

2.1. When you place an order or send us a message we collect:

• identification and contact details: name, e-mail address, phone number;
• the delivery address and, if different, the billing address; for companies, the company's billing details;
• order details: products ordered, value, chosen payment method, order history;
• the content of messages sent through the contact form or the tasting booking request;
• technical data: IP address, browser and device type, pages visited, cookies (see the Cookie policy);
• your confirmation that you are at least 18 years old.

2.2. Card details never reach us: payment is processed directly and securely by the payment processor.

03Purposes and legal basis

• Taking, delivering and invoicing orders — performance of a contract (Art. 6(1)(b) GDPR);
• Issuing and keeping accounting documents — legal obligation (Art. 6(1)(c) GDPR, the Fiscal Code, the Accounting Law);
• Checking the minimum age of 18 — legal obligation (Laws 61/1991 and 148/2000);
• Replying to messages and bookings — steps taken at your request before entering into a contract;
• Newsletter and commercial communications — only with your consent, which you can withdraw at any time (Law 506/2004);
• Site security, fraud prevention, usage statistics — our legitimate interest (Art. 6(1)(f) GDPR).

04How long we keep data

4.1. Order data and accounting documents are kept for 10 years from the end of the financial year, as required by accounting law.

4.2. Contact-form messages are kept for at most 2 years after the last exchange. Newsletter data is kept until you unsubscribe.

4.3. Technical data and cookies are kept for the periods stated in the Cookie policy.

05Who we share data with

5.1. Data may be shared, only as far as necessary, with: courier companies (name, phone, delivery address), the payment processor, Shopify International Ltd. — the shop platform provider (with servers in the EU and, under standard contractual clauses, outside the EU), our accounting provider, the ANAF RO e-Factura system, and public authorities where the law requires it.

5.2. We never sell or rent your data.

06Your rights

6.1. You have the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, the right to object, the right to withdraw consent, and the right not to be subject to a decision based solely on automated processing.

6.2. Send requests to office@epalinca.ro; we reply within 30 days.

07Data security

7.1. The site uses encrypted connections (HTTPS), and access to order data is limited to the people who process it. We apply appropriate technical and organisational measures against unauthorised access, loss or disclosure.

7.2. The site is not intended for minors. We do not knowingly process data of anyone under 18.

08Changes

8.1. We may update this policy; the version in force is the one published on this page, with the update date shown at the top.

GRĂDINA VERDE S.R.L. · Str. Morii 24, Săcueni, jud. Bihor, 417435 · office@epalinca.ro