Privacy policy

Last updated 13 September 2026. Written to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Controller

What we collect, why, and on what basis

Data	Why	Legal basis	Kept for
Name, e-mail, phone, delivery and billing address	To take your order, deliver it, and answer you about it	Art. 6(1)(b) — performance of the contract	10 years, as accounting records
Order contents, amount, currency, country	To fulfil the order and to issue and keep the invoice	Art. 6(1)(b) and 6(1)(c) — legal obligation to keep accounting and tax records	10 years (Romanian accounting law)
Company name and EU VAT number, and the VIES validation reference	To invoice a business correctly and to evidence that the number was valid	Art. 6(1)(c) — legal obligation	10 years
Card details	To take payment	Art. 6(1)(b)	We never receive or store them. They go straight to Stripe.
Messages you send us, and photographs attached to a custom-paint enquiry	To answer you and prepare a quote	Art. 6(1)(b) before a contract, otherwise Art. 6(1)(f) — our interest in answering enquiries	2 years from the last message
Cart contents, chosen language, chosen delivery country	To make the site work as you left it	Art. 6(1)(f) — strictly necessary for a function you asked for	Stored in your own browser; we never receive it
Analytics and advertising identifiers (Meta pixel)	To measure which advertising works	Art. 6(1)(a) — your consent, and only if you give it	Per Meta's retention; withdraw consent any time

Who else processes it

We use a small number of processors. Each acts on our instructions under a data processing agreement, and none of them may use your data for their own purposes.

Stripe Payments Europe, Ltd. (Ireland)

Payment processing. Receives your name, e-mail, address and card details directly. Stripe is a controller in its own right for fraud prevention — see stripe.com/privacy.

Supabase (EU region)

The database holding orders and their fulfilment status. Hosted in the European Union.

Cloudflare, Inc.

Hosting, content delivery and security for this website. Served from Cloudflare's European edge.

Resend (Sweden / EU)

Sends the transactional e-mails: order confirmation, shipping notice, invoice.

The carrier for your parcel — GLS, DPD or DHL

Receives the name, address and phone number needed to deliver. They are separate controllers for their own delivery records.

Our accountant

Receives the invoice data needed to keep the books. The extract they get carries no names, e-mail addresses or delivery addresses.

Meta Platforms Ireland Ltd. — only with your consent

Advertising measurement. If you accept marketing cookies, we send Meta a hashed form of your e-mail and phone number so it can match a purchase to an advert. Decline, and nothing is sent.

Transfers outside the EU

We choose EU-based processing wherever it is available. Where a provider is US-owned — Cloudflare, Stripe, Meta — transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

Automated decision-making

None that produces legal effects for you. Stripe runs automated fraud scoring on payments; if a payment is declined on that basis you can contact us and a person will look at it.

Your rights

Under Articles 15 to 22 GDPR you may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• erase it — though we must keep invoice data for the statutory ten years, so an erasure request on a completed order is honoured for everything except the accounting record;
• restrict or object to processing based on our legitimate interests;
• receive it in a portable format;
• withdraw consent at any time, which does not affect processing already carried out.

Write to contact@revfairings.com. We answer within one month, free of charge. We may ask you to confirm your identity — usually by writing from the address the order was placed with.

Complaining to a regulator

You may lodge a complaint with our supervisory authority, the Romanian ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest — dataprotection.ro.

You may equally complain to the data protection authority of the Member State where you live or work, or where you believe the infringement took place. You do not have to come to Romania to be heard.

Security

The site is served over HTTPS. Card data never touches our systems. The order database is not reachable from the public internet — every read and write goes through our own server-side code, and administrative access is limited to one authenticated account.

Children

This shop is not intended for anyone under 16, and we do not knowingly process their data.

Changes

If this policy changes materially we update the date at the top and, where the change affects processing you have consented to, ask you again.