DRAFT — NOT READY FOR LAUNCH The data controller’s legal identity and contact details, retention periods, provider transfer details, and final legal bases are not confirmed. Complete and review this notice before collecting customer data.

Privacy notice

This draft reflects the current FIG TIN website code and its Stripe test checkout. It is not a statement that the website is ready to accept customer orders.

Who is responsible for your data?

Controller: LEGAL SELLER IDENTITY — PENDING. FIG TIN is currently a personal jewelry business based in Romania; this notice does not claim it is a registered company.

Controller address: PENDING.

Privacy contact: EMAIL ADDRESS PENDING.

Data handled by this website

The shopping bag is saved in your browser’s local storage as product identifiers and quantities under the key figtin-cart-v1. The site code does not send that saved cart to an analytics service.
When requesting a shipping quote or starting checkout, the browser sends product identifiers, quantities, and the selected EU destination country to the FIG TIN PHP backend. The backend validates product prices on the server and calculates a 0 RON shipping charge.
Stripe Embedded Checkout collects the customer’s name, email, delivery address, phone number, and payment details. Payment-card details are entered into Stripe’s checkout and are not stored in the FIG TIN order database by the current code.
After checkout, the order database stores an order number, Stripe Checkout and PaymentIntent identifiers, payment status, currency and total, shipping charge and destination, customer name and email, delivery address and phone number, purchased item names and quantities, and order timestamps.
The webhook database stores Stripe event identifiers and event types to prevent duplicate processing. Application error logs record exception class, code, source file name, and line number; the current logging helper does not write request payloads or payment-card data.

Purposes and legal bases

Order and payment data is intended to be used to calculate checkout totals, take payment through Stripe, record and fulfill orders, handle payment status, and meet applicable legal obligations. The specific GDPR legal basis for each purpose, including any accounting retention, must be confirmed by the seller before launch.

Local storage is used only to remember the shopping bag between visits. The browser user can clear it through their browser settings.

Service providers and external resources

The website loads Stripe.js and embeds Stripe Checkout; the backend communicates with Stripe’s API and receives signed Stripe webhook events. Stripe processes payment and checkout data under its own terms and privacy notice. The site also loads its Archivo and Space Mono fonts from Google Fonts.

The reviewed HTML contains no direct Google Analytics or Meta Pixel integration and no application code that sets cookies. Stripe’s embedded checkout may use cookies or other browser storage for payment functionality; Stripe’s current documentation should be checked before launch.

Any international data transfers, transfer safeguards, and the precise provider roles and retention terms for Stripe and Google Fonts must be confirmed from the providers’ current documentation and account configuration before publication.

Retention, rights, and complaints

Order and log retention periods: PENDING — TO BE SET BASED ON APPLICABLE LEGAL REQUIREMENTS. Do not publish an invented retention period.

Subject to applicable law, individuals may have rights to request access, rectification, erasure, restriction, portability, or to object to certain processing, and may complain to a supervisory authority. The privacy contact needed to handle requests is PENDING. Romania’s supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Legal reference

See the General Data Protection Regulation (EU) 2016/679. This draft requires review against Romanian data-protection requirements and the final production configuration.