Privacy policy

Privacy Policy

Last updated: [20 April 2026]

At Timmann Audio, we respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and applicable Romanian law (including Law no. 190/2018).

This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and what rights you have regarding your data.

1. Who We Are (Data Controller)

Timar Vasile-Călin Întreprindere Individuală (hereinafter referred to as the 'Individual Enterprise' or 'We')

Registered Office: Blvd. Traian, Nr. 31, Ap. 10 Baia Mare, Maramureș County, Romania

Trade Register Number: F2026016137008 Unique Registration Code (CUI): 54345556

Contact for privacy matters: Email: calin@timmannaudio.com

You can reach us via the Contact section on www.timmannaudio.com.

2. Personal Data We Collect

We collect the following categories of personal data depending on your interaction with our website:

Identification and contact data: first name, last name, billing and shipping address, phone number, email address.
Account data: username, password (encrypted), order history.
Payment data: we do not store full credit card details. Payments are processed securely by third-party providers (e.g., Stripe, PayPal). We may receive transaction references.
Technical and usage data: IP address, browser type, device information, pages visited, cookies (see our Cookie Policy for details).
Communication data: messages or inquiries sent through the contact form or support.
Marketing data: preferences and consent for receiving newsletters or promotional communications (if you opted in).

We do not collect or process sensitive (special category) data unless strictly necessary and with your explicit consent.

3. Purposes and Legal Basis for Processing

We process your personal data only for the following purposes and on the following legal grounds:

Purpose	Legal Basis	Examples
Processing and fulfilling orders	Performance of a contract (Art. 6(1)(b) GDPR)	Creating and managing your order, issuing invoices, shipping products
Delivery and logistics	Performance of a contract + Legitimate interest	Sharing necessary data with courier partners
Customer support and returns	Performance of a contract + Legitimate interest	Answering questions, handling warranty claims or returns
Payment processing	Performance of a contract	Processing payments via secure gateways
Marketing communications (newsletter, promotions)	Your explicit consent (Art. 6(1)(a) GDPR)	Sending emails about new products or offers (you can withdraw consent anytime)
Improving our website and analytics	Legitimate interest (Art. 6(1)(f) GDPR)	Understanding how users interact with the site (using anonymized data where possible)
Legal obligations	Compliance with legal obligations (Art. 6(1)(c) GDPR)	Accounting, tax reporting, responding to authorities

4. How Long We Keep Your Data

Order and account data: for the duration of our contractual relationship + 5–10 years for accounting and legal archiving obligations.
Marketing data: until you withdraw your consent.
Technical / cookie data: for the period specified in our Cookie Policy (usually up to 2 years).

After the retention period, we will delete or anonymize your data.

5. Sharing Your Personal Data

We do not sell your personal data. We may share it only with trusted third parties when necessary:

Courier / logistics partners (e.g., Posta Română, DHL, GLS, Fan Courier) for delivery.
Payment processors (e.g., PayPal, Stripe, card providers).
Hosting and technical service providers (Shopify platform, email service providers).
Legal and accounting advisors when required by law.
Public authorities (e.g., tax authorities) only when legally obliged.

All third parties are bound by data processing agreements and must ensure an adequate level of protection.

6. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses approved by the European Commission, or
Adequacy decisions of the European Commission.

7. Your Rights (Data Subject Rights)

Under GDPR, you have the following rights (free of charge in most cases):

Right of access — to know what data we hold about you.
Right to rectification — to correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”) — in certain circumstances.
Right to restriction of processing.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object to processing (including for direct marketing).
Right to withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, please send us an email with a copy of your ID (for identity verification). We will respond within 30 days.

You also have the right to lodge a complaint with the Romanian Data Protection Authority: ANSPDCP – Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal Website: www.dataprotection.ro

8. Security of Your Data

We implement appropriate technical and organizational measures to protect your personal data, including SSL encryption, secure servers, access controls, and regular backups.

In the unlikely event of a personal data breach that poses a high risk to your rights, we will notify you and the supervisory authority as required by law (within 72 hours where feasible).

9. Minors

Our website is not intended for children under 16 years old. We do not knowingly collect data from minors. If we become aware that we have collected such data, we will delete it immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with the new “Last updated” date. Significant changes will be notified via email or a prominent notice on the website.