Privacy Policy

• Identification and contact data — name, e-mail address, phone number, delivery and billing addresses, company details for business invoices.
• Order and payment data — products ordered, order history, invoices, delivery tracking. Card details are processed exclusively by Stripe; we never see or store your full card number.
• Account data — login e-mail, encrypted password, preferences (currency, language), subscription settings.
• Communications — messages you send us through the contact form, e-mail or social media, and reviews you publish.
• Technical data — IP address, browser type, pages visited and the strictly necessary cookies described in our Cookie Policy.

• To process and deliver your orders, issue invoices and handle returns — performance of a contract (art. 6(1)(b) GDPR) and legal obligations under accounting and tax law (art. 6(1)(c)).
• To manage your account and subscription — performance of a contract.
• To answer your questions and complaints — performance of a contract and our legitimate interest in providing customer support.
• To send you newsletters and offers — only with your consent (art. 6(1)(a)), which you can withdraw at any time using the link in every e-mail or by writing to us.
• To remind you about an unfinished order (abandoned basket) — our legitimate interest in completing a purchase you initiated; you can opt out with one click.
• To prevent fraud and secure the Site — our legitimate interest and legal obligations.
• To produce anonymous statistics on how the Site is used, in order to improve it — legitimate interest; the results cannot identify you.

We never sell your personal data. We share it only with service providers who need it to deliver our services, under contract and only for that purpose:

• Stripe — payment processing (Stripe Payments Europe, Ltd., Ireland).
• Sameday and FedEx — delivery of your parcels (name, address, phone, e-mail).
• Supabase — secure hosting of our database and authentication (servers in the European Union).
• Oblio — electronic invoicing, as required by Romanian tax law.
• Public authorities — where the law requires it (e.g. ANAF, ANPC, courts).

Where a provider processes data outside the European Economic Area, we rely on the European Commission’s standard contractual clauses or an adequacy decision.

• Order, invoice and payment records — 10 years, as required by Romanian accounting legislation.
• Account data — for as long as your account is active; you can ask us to delete it at any time.
• Newsletter data — until you withdraw consent.
• Contact-form messages — 3 years after the last exchange.
• Technical logs — up to 12 months.

Under the GDPR you have the following rights, which you can exercise free of charge by e-mail:

1. Access — to obtain confirmation of whether we process your data and a copy of it.
2. Rectification — to correct inaccurate or incomplete data; you can also edit your details directly in your account.
3. Erasure — to have your data deleted, except where we must keep it (for example invoices under accounting law, or data needed for an open order or dispute).
4. Restriction — to limit processing while a request is being verified.
5. Portability — to receive the data you provided in a structured, machine-readable format.
6. Objection — to processing based on legitimate interest, including direct marketing, at any time.
7. Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.

We answer requests within one month. We may ask you to confirm your identity before acting on a request.

The Site is served exclusively over HTTPS. Data is stored in an EU-hosted database protected by row-level access rules, passwords are stored hashed, and access to personal data within our team is limited to what is necessary. Payments are handled by a PCI DSS Level 1 certified provider.

If you believe we process your data incorrectly, please write to us first at contact@88thnight.com. You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, București.

We may update this Privacy Policy when our services or the law change. The latest version is always available on this page and significant changes are communicated by e-mail to account holders.