YOUR DETAILS. HANDLED WITH CARE.
Privacy policy.
This notice explains what information we use, why we use it and the choices you have when browsing, contacting the atelier or placing an order.
- Purpose
- Only data needed for a defined reason
- Choice
- Control over optional processing
- Rights
- A direct contact for your requests
Who is responsible for your data.
The legal entity identified below operates the Izabela Barabancea website and acts as controller for the personal data described in this notice. Privacy requests can be sent to contact@izabelabarabancea.com, using “Personal data” in the subject line if helpful.
This notice covers our own website and our handling of enquiries and orders. When you independently visit a payment provider or a social network, that provider may also process information as a separate controller under its own notice.
- Legal name
- [...]
- Tax identification number
- [...]
- Trade Register number
- [...]
- Registered office
- [...]
- Telephone
- [...]
- Returns address
- [...]
What we use and the legal reasons.
We receive information directly from you, from the browser used to access the website and, where relevant to an order, from payment and delivery providers. We do not ask you to send special-category information, identity documents or full card details in an ordinary enquiry.
- Enquiries and fitting requests: name, e-mail, correspondence and any measurements you choose to provide. Used to take steps at your request before a contract (GDPR Article 6(1)(b)), or to respond to other genuine enquiries under our legitimate interest in customer communication (Article 6(1)(f)).
- Orders and delivery: contact details, billing and delivery addresses, selected products, sizes, colours, order history and necessary payment status/reference data. Used to perform the contract (Article 6(1)(b)). Required fields are identified when collected; without necessary information, we cannot fulfil the order.
- Invoices and compliance: transaction and billing records needed to meet accounting, tax and other legal duties (Article 6(1)(c)).
- Security and claims: technical information such as IP address, request time, browser information and security events, and correspondence relevant to a dispute. Used for our legitimate interests in protecting the service, preventing misuse and establishing or defending legal claims (Article 6(1)(f)), or a specific legal obligation where applicable.
- Optional marketing: only if a separate marketing service is offered and you give the consent required for that channel (Article 6(1)(a)). An order, an enquiry or acceptance of terms does not itself subscribe you to marketing. Consent can be withdrawn without affecting earlier lawful processing.
Cookies, local storage and your browser.
The storefront uses session storage for the active visit and separate, optional local storage for remembering your language or selection between visits. Both optional purposes are off until you choose them. Device permission and, where personal data is involved, consent under GDPR Article 6(1)(a) apply to this optional remembering. Browser storage is not a customer account. The public storefront currently includes no advertising pixel, embedded social feed or optional analytics script in its own application code; Instagram and Facebook are ordinary outbound links.
A checkout or payment service may use additional necessary security and payment technologies, explained when that service is used. Optional analytics or advertising technologies must not be activated without the prior consent required by law. Hosting security measures and network logs are separate from the browser preferences below.
Use Cookie preferences in the footer to change or withdraw each optional permission. Withdrawal removes the corresponding persistent copy without clearing the active visit. You can also clear website data in your browser. If storage is blocked, some choices apply only to this visit. Requests to delete data held by the seller can be made using our contact details; the Cookie Policy provides the full device-storage explanation.
Scroll horizontally to see every column.
| Name / type | Purpose | Duration |
|---|---|---|
| iza-admin-session · cookie | Necessary. Authenticates authorised administrators after login; HttpOnly, Secure in production, SameSite=Strict. | 8 hours, or earlier logout / invalidation. |
| iza-cookie-preferences · cookie | Necessary. Records the version, time and two choices, including refusal. No tracking ID. | Up to 180 days. |
| izabela-language-v1 · sessionStorage | Necessary for the language explicitly selected for this tab’s visit. | The tab’s visit, subject to browser session restoration. |
| izabela-selection-v1 · sessionStorage | Necessary for the pieces, options and quantities saved during this visit. | The tab’s visit, subject to browser session restoration. |
| izabela-language-v1 · localStorage | Optional, with specific permission. Remembers your language between visits. | Up to 180 days of use; expired copies are removed on the next storage check. |
| izabela-selection-v1 · localStorage | Optional, with specific permission. Remembers the bag between visits. | Up to 180 days of use; expired copies are removed on the next storage check. |
Who may receive information.
Access is limited to people and service providers who need information for the stated purpose. Relevant recipient categories include authorised atelier staff; hosting, storage and technical support providers, including Vercel; e-mail and communication providers; payment providers; couriers; accounting and legal advisers; and competent authorities when law requires disclosure.
Providers acting on our instructions must be subject to the appropriate data processing arrangements. Providers with their own legal obligations, such as some payment services, couriers or authorities, may act as independent controllers. We do not sell customer data.
Following a social link or messaging us on Instagram involves that platform’s own processing. Do not send payment credentials or sensitive information in a social message. Information needed to complete an order may subsequently be recorded in our order correspondence.
Processing outside the European Economic Area.
Technical, communication or payment providers may process information outside the EEA. Choosing a European storage region does not, by itself, mean that every support or service operation occurs only within the EEA.
Where such a transfer is subject to the GDPR, we must use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses and supplementary measures where necessary. You may ask us which safeguards apply to a relevant provider and how to obtain information about them, subject to lawful redactions.
How long information is kept.
Retention depends on the purpose and applicable legal requirements. Enquiries and voluntary fitting details are retained while needed to respond, carry out an agreed request and deal with related follow-up; they are not kept indefinitely merely because you contacted us.
Order records are kept for performance, after-sales obligations and the applicable period for legal claims. Invoices and supporting accounting records follow the retention periods required by Romanian fiscal and accounting law. Where a dispute, investigation or legal hold requires longer retention, only the relevant records are retained for that reason.
Technical logs follow the retention settings and security needs of the relevant service and are kept no longer than necessary for those purposes. Visit language and bag data use session storage. Optional persistent copies are used for no more than 180 days from the preference decision and removed on withdrawal or the next storage check after expiry. The decision cookie lasts up to 180 days; the administration session expires after eight hours. Marketing consent records, if a service is introduced, are kept for the subscription and as needed to demonstrate compliance and respect an opt-out.
Your rights under the GDPR.
Subject to the legal conditions, you may request access to your data and a copy, correction of inaccurate information, erasure, restriction of processing and portability of data processed automatically on consent or contract grounds.
You may object to processing based on legitimate interests on grounds relating to your particular situation. For direct marketing, the right to object is unconditional. You may withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal. Erasure is not absolute where legal retention or the establishment, exercise or defence of claims requires relevant data.
We do not make solely automated decisions producing legal or similarly significant effects on you through the storefront. Ordinary stock checks and display of prices are not such decisions.
Making a request or a complaint.
Contact contact@izabelabarabancea.com or the postal address above and explain the right you wish to exercise. We respond without undue delay and normally within one month. Where the GDPR permits an extension of up to two further months because of complexity or number of requests, we explain it within the first month.
We may ask for proportionate information needed to verify your identity where reasonable doubts exist. Requests are normally free; any permitted fee or refusal must meet the GDPR’s conditions and be explained.
You may complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), or another competent supervisory authority, without first obtaining our approval. You also retain your right to a judicial remedy.
Security, children and future updates.
We use appropriate access controls, authenticated administration and secure transmission to protect information, with measures proportionate to the processing and risk. No internet service can promise absolute security. If a personal data breach occurs, notification and communication are handled where required by the GDPR.
The website is intended for customers able to lawfully place an order. A children’s clothing collection does not mean that we seek to collect information directly from children. Parents should provide only the measurements needed for a requested fit, without a child’s full identity or other unnecessary information.
We update this notice when purposes, providers or functions materially change. The date at the top identifies the current version. A new notice is not a substitute for obtaining fresh consent where a new purpose legally requires it.
Contact the atelier
A question, a detail, a personal request.
For help with a piece, an order or your rights, our atelier is just a message away.