Privacy Policy
Last updated: 02.10.2026
Who operates this site
veryretail.ro and the very. brand are operated by a joint venture between ARINU IMPEX SRL and ASPIRE BUSINESS CONSULTING SRL.
- ARINU IMPEX SRL — CUI 5708580, Trade Register no. J1994000413072, EUID ROONRC.J1994000413072.
- ASPIRE BUSINESS CONSULTING SRL — CUI RO17835618, Trade Register no. J40/13456/2005.
Who you contract with. Either company may act as the seller of an order or as the contracting party for a service, including commercial representation for manufacturers, with full rights and obligations. The company you contract with is the one named in the order confirmation, the offer and the invoice.
Personal data. Both companies have access to the data collected through the site (forms, orders, the CRM) and process it as joint controllers under Article 26 of Regulation (EU) 2016/679 (GDPR), for the purposes set out in the Privacy Policy. You can exercise your rights against either of them; the single contact point for both is the address below.
Single contact for both companies: info@veryretail.ro · +40 755 907 206
This is an English translation provided for convenience. The Romanian version is the legally binding one: Politica de Confidențialitate.
This policy explains how ARINU IMPEX SRL and ASPIRE BUSINESS CONSULTING SRL, joint controllers (GDPR art. 26), process personal data through the veryretail.ro website, in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018.
1. The data controllers
The data are processed by the two companies of the joint venture, as joint controllers (GDPR art. 26), which have access to the same data and are jointly responsible for processing it:
- Name: ARINU IMPEX SRL
- Tax ID (CUI): 5708580 · Trade Register No.: J1994000413072 · EUID: ROONRC.J1994000413072
- Name: ASPIRE BUSINESS CONSULTING SRL
- Tax ID (CUI): RO17835618 · Trade Register No.: J40/13456/2005
- Email (single contact point for both): info@veryretail.ro · Phone: +40 755 907 206
- Contact person for data protection: Bogdan Lungu, info@veryretail.ro
The two companies have agreed that all requests concerning personal data are received and handled through the single contact point above. You may exercise your rights against either of them.
We are not legally required to appoint a Data Protection Officer (DPO); however, for any request concerning your data you can contact us using the contact details above.
2. What data we collect and for what purpose
We collect personal data mainly when you provide it to us: through orders, the partnership form and the form for manufacturers. For B2B commercial prospecting we also use business contact details obtained from other sources (see below). Every form and every order is also sent, besides the database, as an email notification to the info@veryretail.ro inbox.
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR art. 22). The internal fit score in the CRM is used only to order the list of companies to contact.
| Category of data | Examples | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Order data | name; company name and CUI (companies); email; phone; delivery address (street, locality, county); buyer type (company / private individual); the products and number of cases; the computed totals; the optional message; the acknowledgement of the returns terms (private individuals); browser/device type (user-agent) | Receiving the order, the confirmation or offer, concluding and performing the contract, delivery, communications about the order | art. 6(1)(b) — conclusion and performance of the contract; art. 6(1)(c) — proof that the consumer was given the pre-contractual information (GEO no. 34/2014) |
| Invoicing and accounting data | name or company name, CUI, address, the products, quantities and amounts invoiced | Issuing invoices, keeping accounting and tax records, reporting to the authorities | art. 6(1)(c) — legal obligation (Accounting Law no. 82/1991, the Fiscal Code — Law no. 227/2015) |
| Partnership requests | name of the contact person, company name, partner type, phone, email, locality, county, country, address, website, products of interest | Receiving and handling the partnership request; contacting you | art. 6(1)(b) — pre-contractual steps at your request; art. 6(1)(f) — legitimate interest (the B2B relationship) |
| Representation requests from manufacturers | name of the contact person, company name, phone, email, country, website, details about the manufacturer (category, number of products, markets it sells in, whether it has EAN codes) | Assessing the request for commercial representation and preparing an offer | art. 6(1)(b) — pre-contractual steps at your request; art. 6(1)(f) — legitimate interest (the B2B relationship) |
| Content of the message | the optional text in the form | Understanding and handling the request | art. 6(1)(b) / art. 6(1)(f) |
| Offers (CRM) | customer name, contact person, email, CUI, the products, quantities and prices offered | Preparing and sending offers by email; following up the business relationship | art. 6(1)(b) — pre-contractual steps at your request; art. 6(1)(f) — legitimate interest (the B2B relationship) |
| B2B commercial prospecting (CRM) | company name, channel type, locality, name of the contact person, business email and phone, website, notes, message history | Identifying and contacting potential business partners (shops, distributors) | art. 6(1)(f) — legitimate interest (developing B2B business relationships); you may object at any time (art. 21), after which we no longer contact you |
| Technical data | browser/device type (user-agent), recorded with the form or order; IP address (processed by the infrastructure providers) | Operation, security and availability of the website; preventing abusive orders and requests | art. 6(1)(f) — legitimate interest (security) |
Source of the data used for prospecting (GDPR art. 14): the business contact details of the companies we contact come from publicly accessible sources (the company’s website, public registers and business directories) or from direct business contacts. We use them only to propose a business collaboration to that company.
The data marked as mandatory in the order form are necessary to conclude and perform the contract; without them we cannot take and deliver the order. For invoicing, providing the data is a legal requirement.
We do not collect special categories of data (art. 9 GDPR) and we do not request sensitive data through forms or orders.
3. Who we disclose the data to
We do not sell or trade the data. Both companies of the joint venture have access to the data, as joint controllers. Otherwise, we disclose it only to providers that process it on our behalf (processors), under a contract and with appropriate safeguards:
- Google Cloud (Google Cloud EMEA / Google Ireland Ltd.) — hosting of the application and storage of requests, orders and CRM data, in a region within the European Union.
- Google (Gmail) — the info@veryretail.ro mailbox, where we receive your messages and the notifications about forms and orders.
- Cloudflare, Inc. — content delivery network (CDN) and security; processes traffic data, including IP addresses; forwards messages sent to info@veryretail.ro.
- Resend, Inc. — sending notifications, order confirmations and offers by email.
- Anthropic — when the feature is active, writing email drafts for B2B prospecting, from the business data of the prospected company (name, locality, name of the contact person); drafts are not sent automatically.
The data may also be disclosed, as separate recipients, to:
- the courier and transport companies that deliver the order — name, phone and delivery address;
- the accountant or accounting firm that keeps the seller’s books, and public authorities (for example ANAF, including through the RO e-Factura system), where the law requires it.
Some providers may process data outside the EEA; in such cases, the transfer is made on the basis of the standard contractual clauses approved by the European Commission or of other legal mechanisms (GDPR, Chapter V). We may disclose data to public authorities where the law requires us to do so.
4. How long we keep the data
- Partnership and representation requests, offers not accepted, prospecting data and orders that did not become a contract: for as long as necessary to assess and manage a possible collaboration, then 24 months from the last contact, after which we delete or anonymise them. Prospecting data are deleted earlier if you object to the processing.
- Concluded orders: for the performance of the contract, then for as long as needed for the legal guarantee and for any complaints or disputes, within the statutory limitation period.
- Invoices and other supporting documents: for the period required by accounting law (art. 25 of Accounting Law no. 82/1991 — currently 10 years from the end of the financial year in which they were drawn up).
In all cases, we keep data for longer only where the law requires us to.
5. Your rights
Under the GDPR (art. 15–22), you have the right:
- of access to your data;
- to rectification of inaccurate data;
- to erasure (“the right to be forgotten”);
- to restriction of processing;
- to object to processing based on legitimate interest;
- to data portability;
- to withdraw your consent at any time, where the processing is based on consent.
Where processing is based on our legitimate interest, including B2B commercial prospecting, you may object at any time; for prospecting, once you object we no longer contact you.
To exercise these rights, write to us at info@veryretail.ro, the single contact point of both joint controllers; the request is handled whichever of the two companies it is addressed to. We will reply within one month of receiving your request, which may be extended by two further months for complex requests, in which case we will tell you (GDPR art. 12(3)).
You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) — B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, București; www.dataprotection.ro.
6. Security
We apply reasonable technical and organisational measures to protect the data (restricted access, encrypted connections, infrastructure providers with high security standards).
7. Cookies
For the cookies and similar technologies used by the website, including keeping the order basket in the browser’s local storage (which reaches us only when the order is sent), see the Cookie Policy.
8. Changes
We may update this policy. The applicable version is the one published on the website on the date of access.