Privacy Policy and GDPR

This is the English version of our Privacy Policy. The Romanian version is the primary, legally-binding version — see Politica de confidențialitate.

1. Data controller

BRIGHT DABSTER SRL. CUI: 36384662. J2016010338402 is the controller of the personal data collected through this website. For any request regarding your data, write to us at info@amopizza.ro.

2. What data we collect

• Account data: name, email address, phone number, password (stored securely, never in plain text).
• Order data: the products ordered, order value, order history, any notes you leave with an order.
• Delivery data: your delivery address and the phone number at which we can reach you during delivery.
• Payment data: we do not collect or store your card details — online payment is processed directly by Netopia, under its own privacy policy. We only receive confirmation of the payment from Netopia.
• The amo club program (cashback): phone number, email, order history and value, and cashback balance — see section 4.
• Newsletter: the email address entered in the sign-up form that was previously in the site footer. The form is no longer available; the footer now has a link to create an account on the site instead.
• Technical data and cookies: IP address, browser type and cookies needed for the site to work (cart, account, session), plus your cookie preference — see section 10.

3. Purpose and legal basis

• Contract performance: taking, preparing, and delivering your order (GDPR Art. 6(1)(b)).
• Legal obligations: issuing invoices, tax records (GDPR Art. 6(1)(c)).
• Legitimate interest: fraud prevention, site security, service improvement (GDPR Art. 6(1)(f)).
• Consent: marketing communications (amo club, newsletter) and optional cookies, withdrawable at any time, without affecting orders already placed (GDPR Art. 6(1)(a)).

4. The amo club program (cashback)

amo club is our loyalty program: customers accumulate cashback (a redeemable balance) based on order history, identified by phone number and/or customer account, and receive program-related communication by email. For in-store orders, the phone number is used as a unique identifier linking in-store and online orders, not as a general contact channel.

Data used for this program (phone number, email, order history and value, cashback balance) is processed based on your consent at sign-up and may be deleted on request, though the accumulated cashback balance is lost when the account is deleted.

5. Who we share data with

Strictly necessary data is shared with:

• Netopia — our payment processor, for online card payments;
• delivery staff — name, address, phone;
• our website hosting provider;
• the kitchen order-management / point-of-sale (POS) system, where applicable;
• our email service provider, through which we send order confirmations and, with your consent, amo club communications;
• public authorities, where the law requires it (for example tax authorities).

In addition, when pages load, your browser fetches fonts from Google Fonts and graphics or badges from third parties (for example the Netopia badge and the SAL/SOL logos), which means your IP address is sent to those providers. We do not sell or rent your data to third parties for marketing purposes.

6. Retention period

Account data is kept for as long as the account is active. Invoice data is kept for the legal tax-archiving period (10 years). Email addresses collected through the former sign-up form are kept until you unsubscribe or ask us to delete them. Your cookie preference is kept for 180 days from your last visit, or until you change it. You may request account deletion at any time; tax documents remain archived as required by law.

7. Your rights

Under Regulation (EU) 2016/679 (GDPR), you have the right to access, rectify, erase, restrict, port, and object regarding your data, as well as the right to withdraw consent and to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro).

8. How to exercise your rights

Send us a request at info@amopizza.ro marked "Personal data" and say which right you want to exercise. We may ask you to confirm your identity. We reply within one month of receiving your request, a period that may be extended under the conditions set out in the GDPR. You can unsubscribe from marketing communications at any time by writing to the same address. Exercising your rights is free of charge.

9. Complaint to the supervisory authority

If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, without prejudice to your right to go to court. We encourage you to contact us first so we can resolve the matter directly.

10. Cookies

The site uses a consent banner for essential cookies needed for it to function (e.g. the shopping cart, the account session) and, if enabled, analytics and marketing cookies. Essential cookies do not require consent. Your preference is saved in our own cookie (amo_consent) and in your browser's local storage; the cookie is renewed on each visit and expires after 180 days without a visit. You can change or withdraw your consent at any time using the "Preferințe cookie" (cookie preferences) link in the footer of every page, or from your browser settings.

11. Security

The site uses a secure connection (HTTPS/SSL) for all pages, including account and checkout forms.

12. Meta Pixel (ad measurement)

If you agree to marketing cookies, we use Meta Pixel, a tool from Meta Platforms Ireland Limited (Facebook and Instagram). We use it to see whether our ads work.

Without your consent, Meta Pixel does not load and we send nothing to Meta.

What is sent to Meta, if you accept:

• the page you are on and the products you view or add to your cart (name, code, price);
• the order value and currency (RON) after you place an order;
• technical data: your IP address, browser type and the identifiers in the _fbp and _fbc cookies.

We do not send your name, email, phone or address to Meta. If you are logged in to Facebook or Instagram in the same browser, Meta may still link the technical data to your account.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the cookie settings. Withdrawing does not change what happened before.

For data collected through Meta Pixel, BRIGHT DABSTER SRL and Meta Platforms Ireland Limited are joint controllers. What Meta does with the data after it receives it is explained in its privacy policy: https://www.facebook.com/privacy/policy

Meta may transfer data outside the European Economic Area, based on the mechanisms provided by GDPR.

Cookies used: _fbp and _fbc, valid for up to 90 days.

Your rights (access, deletion, objection and others) are described in the section “7. Your rights”.