Privacy policy

Last updated: August 2026

Translation for information only — the Romanian version prevails.

1. The data controller

Your personal data is processed by EURO SAAF S.R.L., with its registered office at Strada Trandafirilor, nr. 137, sat Dezmir, comuna Apahida, județul Cluj, 407039, România, Tax ID (CUI / CIF) RO 33957960, Trade Register no. J2015000055125 — the operator of the MyEVCharger.ro website.

Data protection contact: contact@myevcharger.ro. We have not appointed a data protection officer (DPO), as we do not carry out large-scale processing that would require one.

2. What data we collect

We collect the data you provide to us directly during the ordering process, through the contact form or through the back-in-stock notification form:

  • First name and surname
  • Delivery and billing address
  • Email address
  • Phone number
  • Tax ID (CUI/CIF) (optional, for B2B invoicing)
  • Technical browsing data (IP address, browser, pages visited) — through cookies and Sentry

We do not collect or process bank card data — it is handled exclusively by Stripe Inc.

3. Purposes and legal basis of the processing

  • Processing and delivering orders — performance of the contract (Art. 6(1)(b) GDPR)
  • Communications about the status of the order (confirmation email, tracking) — performance of the contract (Art. 6(1)(b) GDPR)
  • Invoicing and accounting — legal tax obligations (Art. 6(1)(c) GDPR)
  • A single request for feedback after delivery (an email sent only once, 15 days after delivery, inviting you to leave a review on our Google profile) — legitimate interest in improving the service and in allowing other buyers to rate us (Art. 6(1)(f) GDPR). It is not a subscription: no further emails of this kind follow and we offer no benefit in exchange for a review. You may object at any time by replying to the email or by writing to us at the address below
  • Notification that a product is back in stock (a single email, sent only for the product you signed up for) — based on your consent (Art. 6(1)(a) GDPR), given by ticking the box in the form and confirmed through the link you receive by email. Without that confirmation we never write to you. It is not a subscription and no further emails follow: the address is deleted immediately after the notification is sent (for a further 7 days we keep only a record that a notification was sent, without any data that identifies you). As long as the sign-up is not confirmed we do not write to you at all, and the address is deleted automatically after 14 days — it is enough to ignore the confirmation email. After confirmation, consent can be withdrawn at any time through the “Delete my address” link in the notification email
  • Replying to contact requests — legitimate interest / performance of the contract (Art. 6(1)(b)/(f) GDPR)
  • Monitoring technical errors and performance (Sentry — may include the IP address and the technical data of the request; Vercel Speed Insights — cookieless, anonymous) — legitimate interest in ensuring the site works (Art. 6(1)(f) GDPR)
  • Technical logging of order operations (Axiom — payment, AWB, invoicing, email) — legitimate interest in diagnosing errors and proving that the order was carried out correctly (Art. 6(1)(f) GDPR)
  • Anonymous statistical analysis of usage (Vercel Web Analytics — cookieless) — based on your consent (Art. 6(1)(a) GDPR), given through the cookie banner; you may withdraw it at any time
  • Showing the location of our registered office on a map (Google Maps, embedded in the About us page) — legitimate interest in showing you where to find us (Art. 6(1)(f) GDPR). The map loads together with the page, so it is not conditional on the cookie banner; you can avoid it by blocking third-party cookies in your browser or by avoiding the About us page
  • Statistics on the use of the shop (Google Analytics 4 — which products are viewed, added to the cart and ordered) — based on your consent (Art. 6(1)(a) GDPR), given through the “Analytics cookies” category of the banner; without it, the _ga cookies are not set
  • Sales statistics — for every paid order we send to Google Analytics, from our server, the order number, the products, the value and the VAT, so that we know how many sales the shop makes and from which sources — legitimate interest (Art. 6(1)(f) GDPR). If you have accepted analytics cookies, the order is associated with your visit (the identifier in the _ga cookie); otherwise it is sent under a random identifier, with no link to your device. We do not send your name, address, email or phone number
  • Measuring the effectiveness of advertising campaigns (Google Ads — how many orders come from our ads) — based on your consent (Art. 6(1)(a) GDPR), given through the “Marketing cookies” category of the banner; you may withdraw it at any time, and without it the advertising cookies are not set

We do not use your data for direct marketing purposes without explicit consent.

4. Recipients of the data (processors)

We pass your data only to the partners needed to carry out the order, under data processing agreements (DPAs). The only exception in the list below is the Google Maps map: it receives no data from us, only your browser's IP address, directly, when the About us page is displayed.

  • Stripe Inc. (USA / Stripe Payments Europe Ltd., Ireland) — processing online payments. Card data remains exclusively with Stripe.
  • Sameday Courier S.R.L. (Romania) — delivering parcels; receives the name, the delivery address and the phone number.
  • Oblio Software S.R.L. (Romania) — issuing tax invoices and credit notes. Receives the name or company name, the billing address (the registered office for legal entities), the Tax ID (CUI/CIF) and the order lines; submits the invoices to the e-Factura system (ANAF), in accordance with tax obligations.
  • Resend Inc. (USA) — sending transactional emails (order confirmation, tracking). Receives the email address and the data in the email.
  • Sentry (Functional Software Inc.) (USA; event data is stored in the EU — Frankfurt region) — monitoring technical errors. May process the IP address and technical session data.
  • Axiom Inc. (USA; event data is stored exclusively in the EU — AWS EU Central 1) — technical logs of order operations. Receives only the order identifier, the delivery county (needed to diagnose address validation errors) and technical execution data; it does not receive your name, street, locality, postcode, email or phone number.
  • Google Ireland Ltd. (Ireland; part of the Google LLC group, USA) — measuring conversions from our Google Ads advertising campaigns, only with your consent (the “Marketing cookies” category). Receives technical identifiers from cookies, the IP address, the page visited, the order value and the order number; it does not receive your name, address, email or phone number. Consent signals are sent through Google Consent Mode v2, and in the absence of consent the advertising cookies are not set.
  • Google Ireland Ltd. (Ireland) — Google Analytics 4: statistics on the use of the shop, only with your consent (the “Analytics cookies” category) — receives the identifiers in the _ga cookies, the IP address, the pages visited and the products viewed or added to the cart; and the sales statistics for every paid order (the order number, the products, the value, the VAT), described in section 3. It does not receive your name, address, email or phone number. Data retention in Google Analytics is set to 14 months.
  • Google Ireland Ltd. (Ireland) — the embedded map on the About us page (Google Maps). Because it loads together with the page, Google receives your IP address and may set its own cookies when the page is displayed, independently of the cookie banner; we do not send it any data about you or about your order. The processing carried out by Google is described in its privacy policy.
  • Sanity AS (Norway) and Vercel Inc. (USA) — the site's infrastructure (hosting, CMS). They access the data stored in the orders database. Vercel also provides usage and performance statistics (Web Analytics, Speed Insights) that are anonymous and without cookies — usage analytics is turned on only with consent.

We do not sell your data and we do not pass it on to third parties so that they can contact you for commercial purposes. The only exception relating to advertising is the conversion measurement for our Google Ads campaigns, described above, which is turned on exclusively with your consent. The sales statistics sent to Google Analytics (section 3) contain no contact data, and for an order without your consent to marketing cookies they are sent with the consent signals denied, so they cannot be used for advertising purposes. The embedded map on the About us page is not advertising and we do not send it any data about you, but Google receives your IP address when that page is displayed.

5. International data transfers

Some of the processors listed (Stripe, Resend, Sentry, Vercel, Axiom, Google) have offices or infrastructure outside the European Economic Area (EEA), in particular in the USA. The transfers are made on the basis of the Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914) and/or the EU–US Data Privacy Framework, under the European Commission's adequacy decision of 10 July 2023 — the mechanism under which Google LLC is certified. Both ensure an adequate level of protection under the GDPR. In the case of Axiom, event data is stored and queried exclusively in the EU (AWS EU Central 1); only account administration operations remain in the USA.

6. Storage period

  • Data relating to orders and invoices: 5 years under Romanian tax legislation (Law no. 82/1991).
  • Data from contact messages: 1 year from the date of the communication or until the request is resolved.
  • The email address registered for back-in-stock notification: 14 days if the sign-up is not confirmed, 90 days after confirmation. It is deleted earlier — immediately — if the product comes back in stock and the notification is sent, or if you use the unsubscribe link in that email.
  • Technical error data (Sentry): 90 days, in line with Sentry's policy.
  • Technical logs of order operations (Axiom): 30 days, fixed retention.
  • Advertising conversion measurement cookies (Google Ads, e.g. _gcl_au): up to 90 days, set only with consent.
  • Google Analytics cookies (_ga, _ga_*): up to 13 months, set only with consent; data in Google Analytics is kept for 14 months.
  • The cookies set by the Google Maps map on the About us page are Google's and are subject to the periods in Google's policy; you can delete or block them in your browser settings.

7. Your rights

Under the GDPR, you have the following rights:

  • Access to the data processed
  • Rectification of inaccurate data
  • Erasure of data (“the right to be forgotten”)
  • Restriction of processing
  • Data portability
  • Objection to processing (in particular to processing based on legitimate interest)

To exercise these rights, contact us at contact@myevcharger.ro. We will reply within 30 days. You also have the right to lodge a complaint with ANSPDCP — dataprotection.ro.

8. Cookies

We use strictly necessary cookies for the site to work (shopping cart) and technical cookies for error monitoring. We also use analytics cookies (Google Analytics) and advertising conversion measurement cookies (Google Ads), but only if you turn them on in the cookie banner; they are off by default, and you can withdraw your consent at any time from “Cookie preferences” in the page footer. Separately from the banner, the About us page includes a Google Maps map that loads together with the page, and Google may set its own cookies at that moment. Full details in the Cookie policy.