Privacy Policy

Last updated: 20 May 2026

This privacy policy describes how Balas Cristian (the operator) collects, uses, and protects your personal data when you use the QR Shop platform available at https://foto-video.home.ro/qr-shop

1. Who we are

The personal data operator is:

Balas Cristian
Str. Fagului nr. 11, Nădrag, Timiș County, Romania
Email: contact@foto-video.home.ro

2. What data we collect

We collect the following categories of personal data:

• Account data: username, email address, encrypted password

• Profile data: name, profile picture (avatar)

• Social login data: Google or Facebook account ID, associated email address, profile picture — provided by you through Google / Facebook login

• Order data: ordered products, delivery address (if applicable), order type

• Technical data: IP address, browser type, date and time of access

3. How we use the data

• Creating and managing your account

• Processing orders placed through the platform

• Sending order-related notifications

• Improving the platform and its security

• Complying with legal obligations

4. Google and Facebook Login

The platform offers the possibility to log in using your Google or Facebook account. When you choose this option:

• We receive from Google / Facebook: email address, name, and profile picture

• We do not receive or store your Google / Facebook account password

• The data is used exclusively for creating and identifying your account on our platform

• You can request the dissociation of your social account from the platform account and the deletion of associated data at any time

For more information on how Google and Facebook process your data, please consult their privacy policies:

• https://policies.google.com/privacy

• https://www.facebook.com/privacy/policy/

5. Data Deletion (Facebook)

According to Facebook platform requirements, you can request the deletion of your data collected through Facebook login at any time. To do this:

• Send an email to contact@foto-video.home.ro with the subject „Facebook Data Deletion”

• Or revoke app access directly from Facebook settings: Settings → Security and Login → Apps and Websites

We will process the request within 30 days.

6. Cookies and Sessions

We use strictly necessary session cookies for the platform's operation (authentication, shopping cart). Optional cookies (functional, analytical) are activated only with your explicit consent, expressed through the cookie settings modal available on the site. We do not use advertising cookies. There are no ads on the platform.

7. Sharing Data with Third Parties

We do not sell, rent, or share your personal data with third parties, except in cases provided by law or for technical services strictly necessary for the platform's operation (e.g., email services for notifications).

8. Data Security

We implement appropriate technical and organizational measures to protect data: HTTPS connections, Argon2id encrypted passwords, CSRF protection, role-based access restrictions.

9. Your Rights (GDPR)

According to the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — to request a copy of the data we hold about you

• Right to rectification — to correct inaccurate data

• Right to erasure — to request the deletion of data („right to be forgotten”)

• Right to data portability — to receive your data in a structured format

• Right to object — to object to data processing

To exercise these rights, please contact us at the address below.

10. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — account creation, order processing and delivery

• Consent (Art. 6(1)(a)) — Google / Facebook login, functional and analytics cookies

• Legitimate interest (Art. 6(1)(f)) — security logs (IP address, activity) to prevent fraud and ensure platform security

• Legal obligation (Art. 6(1)(c)) — compliance with fiscal and accounting obligations under Romanian law

11. Data Retention Periods

We retain your personal data only for as long as necessary for the purpose for which it was collected:

• Active account data (username, email, password) — for the duration of the account + 30 days after deletion

• Order history — 5 years (legal accounting obligation)

• Access and security logs (IP, activity) — 90 days

• Session cookie (QRSHOP_SESSION) — until browser close or 8 hours of inactivity

• Consent cookie (qrshop_consent) — 1 year

• Social login data (Google / Facebook ID) — for the duration of the account

Upon expiry of the retention period, data is irreversibly deleted or anonymised.

12. Third-party Processors and Sub-processors

The platform uses the following service providers who may process personal data as authorised processors. Data is transferred exclusively for the purpose of providing technical services, not for commercial purposes:

• Google LLC — OAuth login, reCAPTCHA protection — policies.google.com/privacy

• Meta Platforms Inc. (Facebook) — OAuth login — facebook.com/privacy/policy

• home.ro (Evonetic SRL) — hosting services, data stored on servers in Romania / European Union — home.ro/politica-de-confidentialitate

13. International Data Transfers

Some of the third-party processors mentioned above (Google LLC, Meta Platforms Inc.) are companies based in the United States of America. Data transfers are carried out with appropriate safeguards, in accordance with:

• Standard Contractual Clauses (SCC) adopted by the European Commission — Decision 2021/914/EU

• EU–US Data Privacy Framework (where the provider is certified)

Platform hosting (home.ro) is located on servers in Romania / European Union — core data does not leave EU territory.

14. Contact

Balas Cristian
Str. Fagului nr. 11, Nädrag, Timiš County, Romania
Email: contact@foto-video.home.ro

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): https://www.dataprotection.ro