Last updated: 21 October 2026

This policy explains what personal data we collect when you use www.brownbearleatherworks.com or buy from us, why we use it, who we share it with, how long we keep it and what rights you have. We apply it in accordance with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 and Romanian Law no. 506/2004.

Who the controller is

The controller of your data is URSE COSTIN-IONUȚ PERSOANĂ FIZICĂ AUTORIZATĂ, with its registered office at Trandafirilor 65, Berceni, județul Ilfov, România, Trade Register no. F23/233/2014, tax identification number (CUI) 32942880 (“we”, “us”). For any question about your data, email us at [email protected]. We have not appointed a data protection officer, because the law does not require us to.

What data we collect and why

Orders

When you place an order, we collect your name, delivery and billing address, email address, phone number, the products ordered, the options you chose (including the personalisation text) and the order history. We use this data to conclude and perform the contract: to make the product, deliver it, send you confirmations and handle returns and complaints. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Without this data we cannot take your order.

We also keep billing data and order documents in order to comply with our tax and accounting obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

You enter your card details directly into the secure form of our payment processor, Stripe; we do not see or store them. Stripe may use transaction and device data to prevent fraud, including through automated risk assessment.

Customer account

If you create an account, we keep your name, email, password (stored securely as a hash), saved addresses and order history, so that you can use them for future orders. Legal basis: performance of a contract. You can ask us to delete your account at any time.

Shopping cart and the email entered at checkout

If you enter your email address at checkout and do not complete the order, we save it together with the contents of your cart and may send you a reminder and a discount code for the products left in your cart. Legal basis: our legitimate interest in reminding you of an order you started (Art. 6(1)(f) GDPR). Every email contains an unsubscribe link; if you use it, we will not send you such messages any more. We delete this data after no more than 30 days if you do not complete the order. If you unsubscribe, we keep only your email address in a suppression list, so that we do not send you such messages again.

Newsletter

If you subscribe, we use your email address to send you news and offers. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email; withdrawing your consent does not affect the lawfulness of the emails sent before.

Messages, reviews and withdrawal requests

When you write to us, leave a review or submit a withdrawal request, we use the data you give us to reply to you and deal with your request. For reviews, the name (or nickname) you choose is shown publicly next to the review. Legal basis: performance of a contract, legal obligation (for withdrawal requests and complaints) or our legitimate interest in replying to messages.

Site security

We use Google reCAPTCHA on forms and Cloudflare services to protect the site against abuse and automated attacks. These process technical data such as your IP address and information about your browser. Legal basis: our legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR). Our servers keep technical logs (IP address, page accessed, date) for security purposes.

Statistics and advertising

Only if you give your consent in the cookie banner do we use Google Analytics to understand how the site is used and Google Ads to measure how effective our ads are. Legal basis: your consent. Without your consent, these tools do not store cookies in your browser.

Cookies

We use cookies and similar technologies in the following categories:

• Strictly necessary: session, cart, account login, form protection, language, currency and your cookie choice. The site does not work without them, which is why they do not require consent.
• Statistics (Google Analytics): show us, in aggregate, which pages are visited. Enabled only with your consent.
• Advertising (Google Ads): measure whether a visit comes from an ad and whether it ends in an order. Enabled only with your consent.

You can change your choice at any time using the cookie preferences link shown on the site, or delete cookies in your browser settings.

Who we share your data with

We do not sell your data. We share it only with providers that help us operate and with authorities, where the law requires us to. Most providers process the data on our behalf under a contract; some (for example Stripe for fraud prevention, couriers, our accountant and the authorities) process it as independent controllers, under their own policies:

• Stripe: payment processing and fraud prevention;
• Packeta and partner carriers (for example Sameday in Romania): parcel delivery;
• Resend: sending emails;
• Hetzner (Germany): hosting the site and the database;
• Cloudflare: site delivery and security;
• Google: reCAPTCHA and, with your consent, Google Analytics and Google Ads;
• CookieYes: managing cookie consent;
• our accountant and the tax authorities, for our legal obligations.

Transfers outside the European Economic Area

Some providers (for example Stripe, Google, Cloudflare, Resend) may also process data in the United States. These transfers are made on the basis of the European Commission’s adequacy decision on the EU–US Data Privacy Framework, for certified companies, or on the basis of standard contractual clauses approved by the Commission. You can ask us for details of the safeguards applied.

How long we keep your data

• order data and accounting documents: for as long as accounting law requires (currently 5 years from 1 July of the year following the end of the financial year);
• customer account: until you ask us to delete it;
• unfinished carts and the email entered at checkout: no more than 30 days;
• newsletter: until you unsubscribe;
• messages, complaints and withdrawal requests: as long as needed to resolve them and then for as long as we might need them to defend a legal claim, up to the general limitation period of 3 years;
• technical security logs: usually a few weeks.

Your rights

You have the right to request access to your data, its rectification or erasure, restriction of processing and data portability. You can object at any time to processing based on our legitimate interest, including cart reminder emails. Where processing is based on consent, you can withdraw your consent at any time. To exercise any of these rights, email us at [email protected]; we reply within one month at the latest.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro, or with the data protection authority of the country where you live.

Children

The site is not aimed at people under 16 and we do not knowingly collect data about them. If you find out that a child under 16 has sent us data without a parent’s consent, write to us and we will delete it.

Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, except for the automated anti-fraud checks carried out by Stripe at payment. These assess the risk of a transaction using signals such as card details, device and payment history, and can lead to a payment being declined. If a payment is declined, you can write to us: a person will review it, you can give your point of view and you can contest the decision.

Security

We use encrypted connections (HTTPS), restricted access to servers and providers that apply appropriate security measures. No system is completely secure, but we take reasonable technical and organisational measures to protect your data.

Changes

We may update this policy. The date of the last update appears at the top of the page; for significant changes we will let you know on the site or by email.