Privacy

Last updated: 30 August 2026

This page explains what personal data we process when you visit our site or enter one of our campaigns, why we process it and what rights you have over it. We have written it in plain language, without contract-speak.

1. Who we are

The data controller is S.C. BRĂDET S.R.L., a Romanian company with its registered office at 14 Bogdan Petriceicu Hașdeu Street, Pitești, Argeș County, entered in the Trade Register under no. J03/400/2001, VAT number RO14062704.

You can write to us at the address above, call us on +40 730 272 338 (Monday to Friday, 09:00–16:00) or email the address published on our Contact page. For any request about your personal data, use any of these channels and say in your message that it is a GDPR request.

2. What data we process, and why

2.1. Simply visiting the site

Our site uses no tracking cookies: we have no Google Analytics, no Facebook Pixel, no TikTok Pixel or any other analytics or advertising tool, and we build no visitor profiles.

The only cookies we set are strictly necessary ones. The first is called PHPSESSID. It appears only on pages that list products and has a simple job: to keep the products in the same order as you move from one page to the next. It holds no data about you, does not identify you and is deleted automatically when you close your browser. Being indispensable to the page you asked for, the law requires no consent for it.

The second is bd_lang, which remembers the language you chose to read the site in, Romanian or English, so that we do not have to ask on every page. We set it only after you use the language switch; it holds no other data and expires after a year. Being a preference you expressed yourself, it also falls under strictly necessary.

In addition, your browser stores locally the choice you made in the privacy banner (see point 2.5). That is not a cookie, is never sent to our servers and stays on your device alone.

The fonts and icons shown on the page are hosted on our own server rather than fetched from third parties, precisely so that your IP address does not reach other companies while you read our pages.

Like any site on the internet, the server it runs on automatically records, in technical logs, the IP address, the time of access and the page requested. These logs serve solely to run and secure the site. To be completed: the name of the hosting provider and how long it keeps the access logs.

2.2. Protecting our email address

Our email address is not written directly into the pages of the site, so that spam programs cannot harvest it automatically. It is shown only after a real interaction with the page. So that this mechanism cannot be abused, we keep for one hour at most an irreversible code (a “hash”) computed from the requester's IP address, together with the time of the request. The IP address cannot be reconstructed from that code, and after an hour it is deleted automatically.

2.3. When you contact us

If you call or email us, we process the data you give us yourself (name, telephone number, email address, the content of your message) in order to reply. The legal basis is our legitimate interest in communicating with those who approach us, or pre-contractual steps if you write about a commercial partnership.

The site has no contact form: communication happens only by telephone or by email, straight into our inbox.

2.4. Entering promotional campaigns

When you enter a campaign we ask for: your surname, first name, and the number and date of the receipt. Depending on the campaign we may also ask for the shop where you bought the product, your town, your telephone number, your email address, the product purchased and a photograph of the receipt. Along with the entry we automatically save the IP address it was sent from, and the date and time, so that we can detect duplicate or fraudulent entries.

The photograph of the receipt is kept in a folder that is not publicly accessible and can be seen only by our authorised staff, after they sign in.

The legal bases are: your consent (Art. 6(1)(a) GDPR), given by ticking the box in the form; performance of the campaign rules, which have the nature of a contract (Art. 6(1)(b)); our legitimate interest in preventing fraud (Art. 6(1)(f)); and, for winners, our legal obligations in tax and accounting matters (Art. 6(1)(c)).

You may withdraw your consent at any time by writing to the contact details in point 1. Withdrawal does not affect processing carried out beforehand, but it does mean you can no longer take part in that campaign.

2.5. The privacy banner and your choice

On your first visit we show a banner asking your permission before switching on any analytics or marketing tool. We currently use none, and the banner unblocks nothing — but the mechanism is there so that, if we ever add such a tool, it cannot start without your prior consent.

The categories are:

• Strictly necessary — they make the site work and remember your choice. They cannot be switched off and they track no one.
• Analytics — they would show us, in aggregate, which pages are read most often. They are not used to identify a visitor directly.
• Marketing — they would identify visitors across different sites, to measure our campaigns or to show relevant advertising elsewhere.

Refusing is as easy as accepting — a single click, on an equally visible button. We do not block access to the site if you refuse, and we do not ask again on every page.

Your choice is saved in your browser's local storage (not in a cookie) and stays valid until you change it. You can change it at any time by clicking “Privacy Settings” at the foot of any page. If you clear your browsing data, the banner will appear again.

3. Who else has access to your data

The data is seen only by those of our staff who need it for their work and who are bound by a duty of confidentiality. We do not sell, rent or exchange personal data with anyone.

Inevitably, the data sits on the servers of our hosting provider, which acts as a processor under a contract obliging it to protect that data. To be completed: the name of the hosting provider and, where applicable, the other recipients — for example the courier used to send prizes, or the accountant.

We may be required to disclose data to public authorities where the law demands it.

4. Transfers outside the European Union

We transfer no personal data outside the European Economic Area. Every resource the site needs in order to display is hosted on our own server.

5. How long we keep the data

We do not keep data longer than is needed for the purpose it was collected for:

• The anti-spam protection code described in point 2.2: one hour, after which it is deleted automatically.
• Email correspondence and notes of telephone calls: to be decided — we suggest no more than 1 year from the last exchange, where no commercial relationship arose.
• Campaign entries from non-winning participants, together with the receipt photographs: to be decided — we suggest deletion within 90 days of the campaign ending and any complaints being settled.
• Winners' details and prize handover documents: for the period required by tax and accounting law, to be confirmed with the accountant — usually 5 or 10 years.

When those periods expire the data is permanently deleted, the receipt photographs included.

6. Your rights

The General Data Protection Regulation gives you the following rights, which you may exercise free of charge once every six months:

• The right of access — to learn whether we process data about you and to receive a copy of it.
• The right to rectification — to have inaccurate data corrected or incomplete data completed.
• The right to erasure (the “right to be forgotten”) — to have your data deleted when there is no longer a legal reason to keep it.
• The right to restriction of processing — to have processing paused while we check a complaint of yours.
• The right to data portability — to receive your data in a machine-readable format, or to have us send it to another controller.
• The right to object — to object to processing based on our legitimate interest.
• The right to withdraw your consent, at any time, as easily as you gave it.
• The right not to be subject to automated decisions — we make no automated decisions affecting you and build no profiles.

We reply within one month of receiving your request at the latest. If the request is complex we may extend that by a further two months, but we will tell you if we do.

If you are not satisfied with our answer you may approach the Romanian National Supervisory Authority for Personal Data Processing — 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, email anspdcp@dataprotection.ro, dataprotection.ro — or the courts.

7. How we protect the data

The site is served over an encrypted connection. The administration area is password-protected, and the password is stored as a hash, not in plain text. The data files, including the receipt photographs, sit in folders blocked from direct browser access and can be opened only by signed-in administrators. Access is limited to the people who need it.

8. Children

Our site is not aimed at children and we do not knowingly collect data from anyone under 16. Entry to promotional campaigns is open only to adults, under the rules of each campaign. If you learn that a child has sent us personal data, please tell us and we will delete it.

9. Changes to this policy

We may update this policy when the way the site works changes, or when changes in the law require it. The version in force is always the one published here, and the date of the last update is shown at the top of the page.