Smart Residence

Privacy Policy

Last updated: 3 June 2026

This Privacy Policy describes how MDS SMART CONSULTING S.R.L. (Smart Residence) processes your personal data when you use smart-residence.ro, create an account, place orders, contact us, or subscribe to our newsletter.

This policy is drafted in line with Regulation (EU) 2016/679 (GDPR), applicable national law, and common e-commerce practice. For the sales contract, see our Terms and Conditions; for cookies, see our Cookie Policy.

Who we are
Scope and definitions
What data we process
Purposes and legal bases
Sources of data
Recipients and processors
International transfers
Retention periods
Security
Your rights
Cookies and similar technologies
Marketing and newsletter
Children
Automated decisions and profiling
Changes to this policy
Contact and complaints

1. Who we are

Data controller: MDS SMART CONSULTING S.R.L., tax ID 40005082, registration no. J20/1800/2018, registered office: 7 Barna Street, Moșnița Nouă, Timiș County, Romania.

Trading name: Smart Residence, premium appliances online store.

Data protection contact: [email protected]. For any questions or requests regarding the processing of your personal data, including the exercise of your GDPR rights, please contact us at this email address.

2. Scope and definitions

2.1. This policy applies to processing carried out through the website, customer account, contact forms, checkout, commercial communications, and the GDPR tools integrated on the site.

2.2. “Personal data” means any information relating to an identified or identifiable natural person (e.g. name, email, phone, delivery address).

2.3. “Processing” means any operation performed on personal data (collection, storage, use, disclosure, erasure, etc.).

2.4. “Processor” means a provider that processes data on our behalf (courier, hosting, invoicing, etc.).

3. What data we process

Depending on how you interact with us, we may process:

Identity and contact data: name, email, phone, billing/delivery address, company name, tax ID (for business orders);
Account data: customer ID, password (stored only as a cryptographic hash, we cannot see it in plain text), account preferences, order history, wishlists, comparisons;
Order and payment data: items ordered, amounts, order status, payment method; we do not store full card details on the website, online payments, if enabled, are handled by certified payment providers;
Delivery and installation data: delivery instructions, scheduling, proof of delivery;
Communication data: messages via contact forms, emails, warranty/return requests;
Technical data: IP address, browser type, operating system, pages visited, session identifiers, cookies (see dedicated section);
Marketing data (optional): newsletter subscription only if you opt in;
GDPR request data: export/deletion requests, email confirmations, technical logs of requests.

We do not routinely ask for special categories of data (health, etc.). Please do not send such data unless strictly necessary and inform us in advance.

4. Purposes and legal bases

Purpose	Examples	Legal basis (GDPR)
Website operation and security	IP, session, technical logs	Legitimate interests (Art. 6(1)(f)) / legal obligation
Account management	email, password hash, preferences	Contract (Art. 6(1)(b)) / consent at registration
Orders, delivery, invoicing	order data, address, phone	Contract (Art. 6(1)(b)); legal/tax obligations (Art. 6(1)(c))
Order-related communications	email, phone	Contract / legitimate interests
Warranty, returns, complaints	product ID, proof of purchase	Contract / legal obligation
Newsletter and offers (if subscribed)	email	Consent (Art. 6(1)(a)), withdraw anytime
Strictly necessary cookies	session, language, currency	Legitimate interests / technical necessity
Optional cookies (analytics/marketing)		Consent (Art. 6(1)(a)), not used on the site at present
Defending legal claims	relevant case data	Legitimate interests (Art. 6(1)(f))
GDPR requests (export/erase)	email, requested action	Legal obligation (Art. 6(1)(c)) / legitimate interests

5. Sources of data

5.1. Data is mainly collected directly from you (forms, account, checkout).

5.2. We may receive limited data from delivery partners (delivery confirmations) or payment processors (payment status), only for the stated purposes.

5.3. Technical data may be generated automatically by your browser and our servers when you visit the site.

6. Recipients and processors

Data may be shared, on a need-to-know basis and with appropriate agreements where required, with:

IT and hosting providers, to run and secure the website;
Couriers (e.g. FAN Courier), to deliver orders (name, address, phone, parcel details);
Payment processors, if you use online payment (card data is processed by the payment provider, not by us);
Invoicing software (e.g. Oblio), to issue invoices and tax documents;
Transactional email providers, order, account, and GDPR confirmations;
Public authorities, when required by law (tax authorities, courts, etc.).

We do not sell your personal data. Processors may not use your data for purposes other than those contracted.

7. International transfers

We generally process data within the European Economic Area. If a provider (e.g. email or cloud) uses servers outside the EEA, we ensure appropriate safeguards (EU Standard Contractual Clauses, adequacy decisions, or equivalent measures) as required by GDPR.

8. Retention periods

Active account: for as long as the account exists; after closure or erasure request, deletion or anonymisation within a reasonable time, except where law requires retention;
Orders and invoices: according to Romanian accounting and tax archiving rules (typically 5 years for supporting financial-accounting documents, and 10 years for annual financial statements, under Accounting Law no. 82/1991, as amended);
Communications and complaints: as long as needed to resolve the matter plus applicable limitation periods;
Newsletter: until you unsubscribe or withdraw consent;
Cookies: as described in our Cookie Policy on the site;
GDPR requests: technical logs for a reasonable period to demonstrate compliance.

9. Security

We apply appropriate technical and organisational measures: HTTPS, passwords stored as cryptographic hashes, restricted system access, security updates and controlled backups. Nevertheless, no information system can be guaranteed to be entirely secure; please notify us immediately if you suspect unauthorised access to your account.

10. Your rights

Where applicable, you have the right to:

Right of access (Art. 15 GDPR), obtain confirmation of processing and a copy of your data;
Right to rectification (Art. 16 GDPR), correct inaccurate data or complete incomplete data, via your account or by written request;
Right to erasure (Art. 17 GDPR), request deletion of your personal data, in the situations provided by law;
Right to restriction of processing (Art. 18 GDPR), in the cases provided by law;
Right to data portability (Art. 20 GDPR), receive the data you provided in a structured, commonly used and machine-readable format, where applicable;
Right to object (Art. 21 GDPR), to processing based on legitimate interests, including direct marketing;
Right to withdraw consent, for consent-based processing (e.g. newsletter), without affecting the lawfulness of processing carried out before withdrawal;
Right to lodge a complaint, with a supervisory authority (see below).

How to contact us: email [email protected] with subject “GDPR request”, stating which right you wish to exercise and enough information to identify you. We usually respond within one month (extendable by two further months in complex cases, with notice).

Online tool: you may also use the Personal data (GDPR) page in the site footer to request export or removal of data linked to your account/email. You will receive a confirmation email; deletion requests may be processed after a grace period (typically 30 days) to prevent fraud and handle outstanding legal obligations.

11. Cookies and similar technologies

The site uses strictly necessary cookies (session, cart, language, currency) and a consent cookie (policy) for your choice on optional cookies.

We do not currently use Google Analytics, Meta Pixel, or similar profiling tools. If we enable them in the future, we will update the Cookie Policy and request consent where required by law.

Full details are in our Cookie Policy (footer link). You can also manage cookies in your browser settings.

12. Marketing and newsletter

Newsletter subscription is optional and requires an explicit opt-in at registration or a separate subscribe action. You can unsubscribe anytime from your account (Newsletter section), via a link in promotional emails, or by emailing [email protected].

We do not send marketing without consent. Transactional emails about your order (confirmation, delivery) are not marketing and are sent on a contractual basis.

13. Children

Our services are not directed at persons under 16. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us for deletion.

14. Automated decisions and profiling

We do not make solely automated decisions with significant legal effect on you, and we do not use behavioural advertising profiling on this site.

15. Changes to this policy

We may update this policy to reflect legal, technical, or service changes. The “Last updated” date at the top shows the current version. For material changes, we may display a notice on the site.

16. Contact and complaints

Controller: MDS SMART CONSULTING S.R.L., [email protected]

Supervisory authority (Romania): National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest.