Legal Compliance

Privacy Policy

Complete GDPR (EU) and CCPA/CPRA (US) compliance document. Read carefully before use.

Last update: October 25, 2026 | Version 2.0

1. Operator's Identity and Contact Information

Name: Quantinel Holdings LLC / Tabakerya.com
Social Office: 10 N Main St, WY 82834, Buffalo, Wyoming
Email DPO: [email protected]
Phone: +1 023457869

Under the meaning of Article 4 paragraph 7 of Regulation (EU) 2016/679 (GDPR) and the California Consumer Privacy Act (CCPA), Quantinel Holdings LLC is the data controller for personal data collected through the Tabakerya.com platform. For users in the EU, our designated representative is [EU Representative Name], contactable at [email protected].

2. Categories of Processed Data and Specific Purposes

We process the following categories of data, strictly limited to the declared purposes:

Identification and Contact Information: Full name, first name, physical address, email, phone number. Purpose: Execution of the sale and purchase contract (Art. 6(1)(b) GDPR), delivery of packages, issuance of tax invoices.
Tax and Business Data (B2B): Company Name, VAT Number, Business Register Number, Intracommunity VAT Code. Purpose: Tax Compliance (Accounting Law, Romanian Tax Code, U.S. IRS Regulations), B2B Invoicing.
Transaction and Logistics Information: Order history, purchased products, AWBs, delivery status, payment methods. Purpose: Managing contractual relationships, preventing fraud, financial reconciliation.
Technical and Navigation Data: IP address, device type, browser, cookies, server logs. Purpose: Cybersecurity (Article 32 GDPR), anonymized analytics, abuse detection.
Marketing data (only with consent): I prefer newsletters, campaign interaction history. Purpose: Customized Commercial Communications (Art. 6(1)(a) GDPR).

3. Legal Bases for Processing (GDPR Article 6 & CCPA)

Data processing is based exclusively on the following legal grounds:

Entering into a contract (Art. 6(1)(b) GDPR): For order processing, deliveries, returns and customer support.
Legal Obligations (Art. 6(1)(c) GDPR): Keeping invoices for 10 years (RO) / 7 years (US IRS), ANAF/IRS reports, minimum age verification of 18+ for tobacco/alcohol.
Legitimate Interest (Art. 6(1)(f) GDPR): Fraud prevention, cybersecurity, and intellectual property protection. We have conducted the balance test (LIA) and documented mitigation measures.
Explicit consent (Art. 6(1)(a) GDPR): For newsletter purposes only, non-essential cookies and marketing profiling. You can withdraw your consent at any time without affecting the lawfulness of previous processing.
CCPA/CPRA Business Purpose: For users in California, we process data exclusively for legitimate, transparent, and documented commercial purposes under this policy.

4. Recipients and Authorized Land Categories

Your data is NOT sold. It is shared EXCLUSIVELY with:

Marketplace Vendors: Just name, delivery address and phone number. Sign data processing agreements (DPA) compliant with Article 28 GDPR.
Logistics Providers (Couriers): Strict necessary data for generating AWB and delivery. They do not have access to your order history or financial information.
Processors: Encrypted transaction tokens. We do not store CVV, full credit card numbers, or sensitive banking information. Compliant with PCI-DSS Level 1.
IT Providers & Hosting: AWS/Azure servers in EU-US regions. Standard contractual clauses (SCC) and EU-US Data Privacy Framework.
Public Authorities: Only upon written request, legally justified (ANAF, ANPC, courts, law enforcement).

5. International Data Transfers

Data may be transferred and processed outside the EU/EEA. For transfers to the USA and other third countries, we apply:

Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914).
The EU-US Data Privacy Framework (adequacy decision from July 2023).
Additional assessments of local legislation and complementary technical measures (end-to-end encryption, pseudonymization).

6. Data Retention Period

We retain your data only for as long as strictly necessary:

Tax and accounting data: 10 years from the issuance of the invoice (Accounting Law 82/1991, Art. 25; IRS Pub 583).
Order and Delivery Information: 3 years since the last interaction (general term for civil rights prescription).
Marketing Data: 24 months since the last active consent or until withdrawal.
Security Logs: 90 days, then automatic irreversible deletion.
Inactive Accounts: Automatically deleted after 36 months of complete inactivity.

7. Rights of the Data Subjects (GDPR Chapter III & CCPA)

You have the following rights, which can be exercised free of charge by submitting a written request to [email protected]:

Right to Access (Art. 15 GDPR / CCPA Right to Know): Obtaining a copy of your data and information about processing.
Right to Rectification (Art. 16 GDPR): Correcting inaccurate or incomplete data.
Right to erasure (\"Right to be Forgotten\", Art. 17 GDPR / CCPA Deletion): Except for data stored for legal obligations.
Right to restrict processing (Art. 18 GDPR): Temporary Data Block in Case of Dispute Over Accuracy
Right to Data Portability (Article 20 GDPR): Receiving data in a structured format, usually also machine-readable.
Right to Object (Art. 21 GDPR): Against processing based on legitimate interest or direct marketing.
Right to opt out of the sale/share of data (CCPA/CPRA): The „Do Not Sell or Share My Personal Information” link is permanently available in the footer.
Right to Non-Discrimination (CCPA §1798.125): We will not deny services, apply different charges, or provide inferior quality in the exercise of CCPA rights.

We respond to requests within a maximum of 30 calendar days. We can extend the deadline by up to 60 days for complex cases, notifying you in advance.

8. Cookies and Similar Technologies

We use the following categories of cookies:

Essentials: Necessary for the operation of the site, shopping cart, security. No consent required (exception: ePrivacy Directive Art. 5(3)).
Preferences: Save your language, currency, and accessibility settings.
Statistics: Google Analytics 4 (IP anonymized, no PII collection). Used to improve UX.
Marketing: Meta Pixels and Google Ads. Only with explicit consent. They can be managed through a Consent Management Platform (CMP).

You can manage your preferences anytime through the cookie banner or your browser settings.

9. Technical and Organizational Security Measures

We implement measures in accordance with Article 32 of the GDPR and industry best practices:

AES-256 encryption for data at rest and TLS 1.3 for data in transit.
Pseudonymization and tokenization of sensitive data.
Strict access control (RBAC), multi-factor authentication for admins.
Continuous SIEM monitoring, quarterly penetration tests, annual ISO 27001 audits.
Incident Response Plan (breach notification within 72 hours to ANPC/competent authorities).

10. Changes and Coming into Effect

We reserve the right to update this policy to reflect legislative, technological, or operational changes. Significant changes will be communicated via email and a banner on the site at least 30 days before they take effect. Continuing to use the platform after the publication of changes constitutes acceptance of the new version.