Privacy policy

Legal Grounds

Justification

Performance of a Contract

(Article 7 point (b) of Law 124/2024)

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

• When you place an order through Kpop magic shop’s Website, a distance sales contract is established between you and Kpop magic shop. The processing of your personal data is necessary for the conclusion and performance of this contract and for fulfilling our obligations arising from it. Such processing includes but is not limited to: creating and managing your user account, processing orders, issuing invoices, arranging delivery, and handling returns, refunds, or warranty claims. Without this processing, Kpop magic shop would not be able to conclude or perform the contractual relationship.
• The functioning of the Kpop magic shop Website requires the processing of certain personal data that is strictly necessary for the performance of the contract concluded with user/data subject upon registration and continued use of the digital services.

·         In particular, the processing of identification and authentication data is required to create and manage the user account, verify the user’s identity and enable access to essential Website and functionalities. Without such processing, Kpop magic shop would not be able to provide the digital services requested by the data subject.

Legitimate interest

(Article 7 point (dh) of Law 124/2024

Processing is necessary for the compliance with a legal interest pursued by the Controller 1 or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

• Kpop magic shop may process certain personal data when it is necessary for the purpose of legitimate interest pursued by Kpop magic shop, provided that such interests are not overridden by your fundamental rights and freedoms. This includes processing activities for preventing and detecting fraud or misuse of service; ensuring the security, integrity availability and the proper functioning of the Website and IT systems; performing internal analytics to improve user experience; maintaining minimal records necessary for legal claims; whenever processing is based on legitimate interest, Kpop magic shop conduct a balancing test (legitimate Interest Assessment) to ensure that such processing does not disproportionately affect your privacy.

Personal data collected

Purpose of processing

Legal Basis

Identification Data: Name, Surname;

Contact Details: Email address, Mobile phone number.

Account and Authentication Data:  Username

Website usage – Account creation/registration and management - We need to process your data to identify you as user or as guest; to create, manage and maintain your online customer account, enabling you to view your orders, preferences and purchase history. Synchronize the user profile across devices

Performance of a contract (Article 7, point (b) of Law 124/2024)

Identification Data: Name, Surname;

Contact Details: Email address, mobile phone number, billing and delivery address;

Shopping and Transaction Data: Purchase and payment history, shopping preferences, shopping cart content, refund and return details;

Order processing and contract performance -To process, confirm and fulfill your online orders/purchases, issue invoices, manage payments, deliver products and handle returns, refunds or warranty claims.

Performance of a contract (Article 7, point (b) of Law 124/2024)

Identification Data: Name, Surname;

Contact Details: Email address, mobile phone number, billing and delivery address;

Shopping and Transaction Data: interactions with Customer Support Service.

Customer service and communication -To provide assistance and respond to your inquiries, requests, or complaints and provide updates related to your orders, deliveries or returns.

Performance of a contract (Article 7, point (b) of Law 124/2024)and Legitimate interest (Article 7, point dh of Law 124/2024)

Identification Data: Name, Surname;

Contact Details: Email address, mobile phone number;

Profiling and Website Usage Data: Information collected automatically through cookies and similar technologies, including age, gender, IP address, traffic data, geolocation data, device information (Device ID, software version connection used, operating system, browser used) and keywords searched according to your interests.

Shopping and Transaction Data: purchase history;

Marketing and promotional activities -To send newsletters, promotional messages and special offers about Kpop magic shop products or services if you have given your consent.

Consent (Article 7, point (a) of Law 124/2024)

Identification Data: Name, Surname;

Contact Details: Email address, mobile phone number, billing and delivery address;

Shopping and Transaction Data: purchase history, refund and return details;

Legal compliance and protection of rights -To comply with legal obligations arising from tax, accounting and consumer protection laws and to establish, exercise or defend legal claims; To represent Joint Controllers before courts, public institutions, and other competent authorities

Legitimate interest (Article 7 point (dh) of Law 124/2024)

Technical, infrastructure and Security Data information generated or recorded when you access and use the Website location, including technical identifiers (such as IP address and device identifiers), device and software information, access timestamps, system and application logs, performance and stability metrics, server response data, and security-related records (including authentication events and automated protection logs).

Such data is processed for the purposes of maintaining and ensuring the proper functioning, stability and continuity of the digital infrastructure; diagnosing errors, crashes and service disruptions; monitoring and improving the technical performance of the platform; detecting, preventing and responding to cybersecurity incidents; protecting user accounts from unauthorized access;

Legitimate interest (Article 7 point (dh) of Law 124/2024)