Privacy Policy – Sakura Bonsai

Last updated: 12 August 2025

This policy explains how BOLDSAI GRUP SRL (“Sakura Bonsai”, “we”) processes your personal data when you visit the website sakurabonsai.ro, create an account or place orders.

1. Who we are

Data controller: BOLDSAI GRUP SRL, J2024027286007, VAT ID (CUI) 50632720
Registered office: Bucharest, District 3, Str. Zizin no. 4, 5th floor, apt. 34
E-mail: office@sakurabonsai.ro • Tel.: +40 724 705 742
We have not appointed a Data Protection Officer (DPO). For any request regarding your data, write to us at the e-mail address above.

2. What data we collect

Identification and contact data: name, e-mail, phone, delivery/billing address.
Account data: username, password (hashed), preference settings, order history.
Transaction data: ordered products, value, payment methods, delivery status.
Payment data: last 4 digits of the card (if returned by the processor), transaction token; we do not store card details.
Communication: messages sent via forms/e-mail, reviews, complaints.
Technical and usage data: IP address, cookie identifiers, GA4 events, device/browser, pages visited, traffic source; see also the Cookie Policy.

3. Purposes and legal bases

Conclusion and performance of the contract (Art. 6(1)(b) GDPR): account creation, order placement and processing, invoicing, delivery, returns and warranty.
Compliance with legal obligations (Art. 6(1)(c) GDPR): financial-accounting records, responses to requests from authorities, statutory warranties.
Legitimate interest (Art. 6(1)(f) GDPR): website security and fraud prevention (including payment anti-fraud), defending our rights in potential disputes, improving services (aggregated and minimally invasive analysis), operational communications.
Consent (Art. 6(1)(a) GDPR):
- analytical cookies (GA4) and marketing (Meta Pixel);
- newsletter/direct marketing (if you subscribe);
- other processing for which we inform you and ask for your consent.

You can withdraw consent at any time (from Cookie Settings, the unsubscribe link in e-mails, or by e-mailing us). Withdrawal does not affect the lawfulness of processing prior to withdrawal.

4. Who we disclose data to

Payment processor: Stripe Payments Europe, Ltd. (card payment processing, fraud prevention).
Couriers: Cargus, Fan Courier (delivery, cash on delivery).
IT/hosting services: Romarg SRL.
Analytics/marketing: Google Ireland Limited (GA4/GTM), Meta Platforms Ireland (Pixel) – active only with consent.
Public authorities: upon lawful request.
Professional advisors: accounting/lawyers, to the extent necessary.

Our providers act as processors or joint controllers (as applicable), under contracts and our instructions.

5. Transfers outside the EEA

Some services may involve transferring data to countries outside the European Economic Area, e.g., to the USA (Google/Meta). In such cases we use Standard Contractual Clauses (SCCs) and, where applicable, additional measures to protect the data.

6. Retention periods

Account and orders: for the duration of the contractual relationship and thereafter, in line with the statutory periods applicable to financial-accounting records (usually up to 10 years from the end of the financial year).
Complaints/warranties/returns: for the duration of resolution and the periods provided by law.
Marketing: until withdrawal of consent or exercise of the right to object.
Cookies/analytics: according to the durations in the Cookie Policy.

We keep data only as long as necessary for the stated purposes or as required by law, then we anonymize or securely delete it.

7. Your rights

You have the following rights (under the GDPR): access, rectification, erasure (“right to be forgotten”), restriction, portability, objection (including to direct marketing), withdrawal of consent, not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise your rights: write to office@sakurabonsai.ro. We will respond within one month (extendable by 2 months in complex cases; we will inform you).

You have the right to lodge a complaint with the ANSPDCP – the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro).

8. Security

We apply reasonable technical and organizational measures (TLS encryption, access control, backup policies, data minimization). No measure can guarantee absolute security; please keep your password confidential and notify us immediately of any suspected unauthorized access.

9. Minors

The website is not intended for persons under 18. We do not knowingly collect data about minors; if you become aware that a minor has provided us with data, write to us for deletion.

10. Cookies

For details about cookies and consent, see the Cookie Policy (separate document available on the website).

11. Changes to this policy

We may update this Policy to reflect legislative or operational changes. We will publish the updated version on the Website and indicate the date of the last modification.

12. Contact

Questions or requests regarding data protection?
E-mail: office@sakurabonsai.ro • Tel.: +40 724 705 742.