Privacy Policy

1. What data we process

Account data: name, email, password stored hashed, chosen language. If you sign in with Google, we receive your name, email and account ID from Google – not your password.

Order data: name, delivery and billing address, phone, email, products ordered, personalisation details (text, name, dates, photos), amounts and payment method. Card details never reach us – they are processed by Stripe.

Content of digital pages: texts, photos, video and audio recordings you upload, details you enter (e.g. pet or baby details, car deadlines, love story), and visitors' guestbook messages.

Contributions from others: the storyteller's voice recordings (“Tell us!”), family messages, hearts and questions; video, audio or text messages from Group message contributors (name, optionally email and photo); the recipient's thank-you message.

Safety features: for the pet tag, the location and message voluntarily sent by a finder; for protected pages, the PIN (stored hashed) and the identifier of a remembered device.

Business services: contact details of the company and its admins; private guest feedback for the review stand; data of buyers registered in the Product passport; employee data in the Company gifting programme (name, email, birthday, start date, team, office).

Messages sent via the contact form: name, email, message.

Custom quote requests: the type of request, description, quantity, deadline, budget, contact details (name, email, phone, city, optionally company name and tax ID) and uploaded files (photos, sketches, logos).

Technical data: IP address, device and browser type, time of access, number of times a page is opened – generated automatically when you use the service.

2. Purposes and legal bases

Performance of a contract (Art. 6(1)(b) GDPR): processing the order, production, delivery, creating and hosting the digital page, your account, service emails (e.g. new story notifications, Group message invitations and reminders, deadline reminders for the car keyring or vaccinations), customer support.

Legal obligation (c): issuing and keeping invoices, accounting and tax obligations, responding to authorities.

Legitimate interest (f): service security, preventing abuse and fraud, aggregated usage statistics (e.g. how often a page is opened, shown to its owner), defending our rights.

Visit and purchase statistics with Google Analytics (only if you accept statistics cookies).

Consent (a): the location sent by a pet finder, the optional email entered by contributors, any marketing messages (only if requested separately). Consent can be withdrawn at any time.

We do not take decisions based solely on automated processing that produce legal effects concerning you.

3. When we are only a processor

For some services the controller is our customer and we only process data on its behalf: the company using the Company gifting programme (employee data), the maker or brand using the Product passport (its buyers' data) and the company using the review stand (its guests' private feedback). The Data processing agreement applies in these cases, and data requests can also be sent directly to that company.

A person who creates a digital page and uploads data about others (e.g. family photos, recordings, a child's details) is responsible for having their consent or another legal basis.

4. Who we share data with

Stripe Payments Europe, Ltd. (Ireland) – card payments.

Google Ireland Limited – Google sign-in (only if you choose it) and, for the review stand, searching for the business location to build the review link.

Google Ireland Limited – Google Analytics, only if you accept statistics cookies: site usage data and, for an order, its number, products and amount (no name, address or e-mail). Retention: 14 months.

Our hosting, storage and email providers, who process data only on our instructions under contracts compliant with Art. 28 GDPR. We provide the current list on request.

Courier companies – the recipient's name, address and phone number, for delivery.

Our accountant and public authorities, where required by law.

YouTube videos embedded by users load from youtube-nocookie.com; Google receives data only when a visitor starts the video.

We do not sell personal data or use it for advertising.

5. Transfers outside the EU

Some providers (e.g. Stripe or Google) may transfer data outside the European Economic Area, usually to the US, on the basis of the EU–US Data Privacy Framework or standard contractual clauses approved by the European Commission.

6. How long we keep data

Account data: while the account is active; after deletion we erase it within 30 days, except what we must keep by law.

Invoices and accounting records: 10 years (Accounting Law no. 82/1991).

Digital page content and recordings: for the included or extended service period; after expiry or deletion we keep them for at most 90 more days (for possible reactivation), then delete them permanently.

Data processed on behalf of businesses: for the duration of the contract with the business, then deleted or returned within 30 days.

Custom quote requests and their files: if no order follows, we delete them after at most 2 years; if they become an order, we keep them with the order.

Contact messages: until resolved, then at most 2 years. Technical logs: at most 90 days.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection (especially to processing based on legitimate interest) and to withdraw consent. Much of your data can be changed or downloaded directly in your account.

To exercise your rights write to info@kelvins.ro. We reply within one month at the latest.

You can lodge a complaint with the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest – www.dataprotection.ro.

8. Minors

Our services are not intended for people under 16. Data about children (e.g. in the baby journal) is entered by the parent, who decides what to publish and who has access.

9. Security

We use encrypted connections (HTTPS), hashed passwords, hard-to-guess secret links for private pages, PINs for protected pages and restricted internal access. If a security incident affects your rights, we will inform you as required by law.

10. Cookies

We use cookies strictly necessary for the site to work (sign-in, language, remembered device) and, only with your consent, Google Analytics statistics cookies. Details and settings in the Cookie policy.

11. Changes

We may update this policy; the effective date is shown at the top. We will notify you by email of significant changes.