• Privacy policy

Privacy policy

Effective date: 15 September 2026 (Europe/Bucharest)
This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use pawroutine.com, place an order, contact us, or otherwise interact with our store.

Data controller and contact details

Controller: VIZIR ALEXANDRU PERSOANA FIZICA AUTORIZATA
CUI: 54077186
Trade Register No.: F2026010148004
Registered address: B-dul Bucurestii Noi, 136, et. Parter, ap. 5, Sector 1, Bucuresti, Romania
Privacy email: contact@pawroutine.com
Customer support email: contact@pawroutine.com
Phone: +40 782 643 275

Our store is hosted by Shopify. When you visit or make a purchase, Shopify processes personal data to provide the storefront, checkout, payments, fraud prevention, analytics, and related platform services. When Shopify Network Intelligence is enabled, Shopify may process personal data about your interactions with our store, other merchants, and with Shopify to provide enhanced services. You can learn more about Shopify's privacy controls here: Shopify Privacy controls.

What personal data we collect

Depending on how you interact with the Website, we may process:

  1. Account and contact data: name, email, phone number, billing address, and shipping address.
  2. Order and transaction data: products purchased, quantities, prices, discounts, shipping method, invoices, payment status, and order history.
  3. Delivery and support data: shipment status, delivery tracking, communications, return or complaint details, and any photos or documents you provide.
  4. Device and usage data: IP address, browser type, device information, pages visited, timestamps, and similar online activity data, often collected through cookies and similar technologies.
  5. Marketing preferences: newsletter subscription status, cookie choices, and opt-in or opt-out records.

We do not intentionally collect special category data, and we ask that you do not send sensitive personal data in support tickets unless strictly necessary.

Purposes and legal bases

We process personal data only where we have a lawful basis, including:

  • Contract necessity to process orders, arrange delivery, handle returns, and provide customer service.
  • Legal obligation to comply with accounting, tax, consumer protection, fraud prevention, and other applicable legal requirements.
  • Legitimate interests to protect the Website, prevent fraud, improve operations, maintain security, and defend legal claims, where those interests are not overridden by your rights.
  • Consent for optional cookies, certain analytics, certain marketing communications, and similar processing where consent is required.

Who we share data with

We share personal data only where necessary for operating the store and fulfilling orders, including with:

  1. Shopify as our ecommerce platform provider.
  2. Payment service providers and fraud prevention providers used at checkout to process transactions securely.
  3. Fulfilment suppliers in the Netherlands, including dropshipping partners, to prepare and dispatch your order.
  4. Shipping carriers that need delivery details and tracking data to complete shipment.
  5. Automation, integration, email, hosting, and communication providers used to operate the store and manage support or operational workflows.
  6. Professional advisors and public authorities where required by law or where necessary to protect our rights.

International data transfers

  1. Within the EEA. Some order-fulfilment data is shared with suppliers located in the Netherlands. This is an intra-EEA transfer.
  2. Outside the EEA. Some service providers may process data outside the EEA.
  3. Safeguards. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms implemented by our providers.

Returns, evidence and courier data

When you request a return, report a defective, wrong, damaged or missing item, or arrange return shipping, we may process your order details, return reason, messages, photographs, videos, documents, parcel dimensions, carrier name, tracking number, dispatch date, delivery events and our review decisions.

Evidence is submitted through a secure return portal and stored in private object storage. Time-limited links are used to reduce unauthorized access. We use this information to perform the sales contract, meet consumer-law obligations, prevent abuse, investigate delivery issues, handle courier claims and establish, exercise or defend legal claims.

We share only the data needed for the case with relevant service categories, which may include Shopify, payment providers, fulfilment partners, carriers, courier aggregators, secure hosting or object-storage providers, email providers and automation or communications providers. A future carrier or return-location provider is not treated as active until it is actually used for your case.

Return evidence and its review audit are normally retained for 36 months after the return case is closed. Deletion is paused while a dispute, chargeback, lost-parcel investigation, courier claim, legal claim or manual compliance hold is active. When the hold ends, the normal deletion schedule resumes unless a longer legal retention duty applies.

A short security-link lifetime does not shorten your consumer rights or the retention period for evidence already accepted into an open case.

Data retention

We retain personal data only for as long as necessary for the purposes described above. In practice, this means:

  • account and customer profile data are kept while relevant to your relationship with us;
  • order, invoice, and transaction records are kept as long as required for legal, tax, accounting, and consumer protection obligations;
  • support and complaint records are kept for as long as needed to resolve the issue and manage any follow-up or legal claims;
  • marketing data is kept until you unsubscribe, withdraw consent, or we no longer need it for that purpose;
  • technical and security logs are kept for as long as reasonably necessary for security, fraud prevention, and troubleshooting.

Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your GDPR rights

Depending on the circumstances, you may have the right to:

  • access your personal data;
  • request rectification of inaccurate data;
  • request erasure of your data;
  • request restriction of processing;
  • object to certain processing;
  • receive portability of data where applicable;
  • withdraw consent at any time where processing is based on consent.

To exercise any of these rights in relation to our processing, contact us at contact@pawroutine.com.

Supervisory authority (Romania)

You also have the right to lodge a complaint with the Romanian supervisory authority: ANSPDCP.

Cookies and tracking

We use cookies and similar technologies to operate the Website, remember preferences, understand site usage, and support marketing activities where enabled.

Strictly necessary cookies are used to make the store function properly. Optional cookies such as personalization, marketing, and analytics cookies are used only according to your choices where consent is required.

You can manage your preferences through the cookie banner or the Cookie preferences link available on the Website.

Children

The Website is not intended for children. If you believe that a child has provided personal data to us, please contact us so we can review and delete it where appropriate.

Updates to this Privacy Policy

We may update this Privacy Policy from time to time. The Effective date above shows the latest version. Material changes will be posted on the Website.