Data Controller
The following company details are currently associated with this website and operational back-office environment.
- Company: ROBERTS AARON LEE – PERSOANĂ FIZICĂ AUTORIZATĂ
- CUI / Trade Register: 41431477
- Trade Register: F2019001132122
- Not registered for VAT.
- Str. Petru Maior nr. 13, ap. 4
- 123456 Cluj-Napoca
- Romania
- Email: [email protected]
- Phone: +40 757 355 883
What We May Collect
Depending on how you interact with Pelicula35, we may process the following categories of data:
- Basic identity details such as your name or company name.
- Contact details such as email address, phone number, and billing or delivery information.
- Order-related data, communication history, notes, and service preferences.
- Technical information necessary for site security, diagnostics, or service delivery.
How We Use Data
- To provide lab, store, customer account, and order-related services.
- To respond to questions, service requests, or operational communication.
- To meet legal, accounting, tax, and fraud-prevention obligations.
- To protect systems, records, and customer information.
Sharing and Processors
Data may be shared only when necessary with hosting, infrastructure, payment, logistics, accounting, or other operational providers acting on Pelicula35’s instructions, or where disclosure is legally required.
Email updates and promotions
If you choose to receive updates, we use your name, email address, language, subscription status and the time, source and IP address of the request to manage and evidence your choice. The legal basis is your consent under Article 6(1)(a) GDPR. A campaign is not sent until you confirm through the email we send you.
You can withdraw consent at any time through the unsubscribe link in every update. Withdrawal does not affect earlier lawful processing. If you unsubscribe, we may retain your email address in a reduced do-not-contact record so that it is not added again by mistake.
Pelicula35 Analytics and Google user data
Authorised Pelicula35 staff may connect a Google account to Pelicula35 Analytics, our private internal reporting dashboard. The application requests read-only access to Google Analytics 4 and Google Search Console.
- Categories used: aggregate website traffic, page, acquisition, campaign and conversion reporting from Google Analytics, and aggregate search query, impression, click, position and landing-page reporting from Google Search Console.
- This access is used only to provide Pelicula35's internal analytics and performance reporting. The application does not modify Google Analytics or Search Console data.
- OAuth access and refresh tokens are encrypted at rest and never shown publicly. Bounded aggregate report results are cached in Pelicula35's own database for dashboard performance and historical comparisons. No raw visitor-level or customer-identifying Google data is collected.
- Google user data is not sold, is not used for advertising, and is not shared with unrelated third parties. Access is limited to authorised staff according to internal role permissions.
- The connected administrator can disconnect Google at any time and delete cached Google reporting data from the dashboard; cached reports are also removed automatically under the configured retention period. Requests can be sent to [email protected].
Pelicula35 Analytics' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google API Services User Data Policy.
Retention
Personal data should be kept only as long as needed for service delivery, legitimate business records, legal compliance, dispute handling, or security obligations.
Deleting your account
You can close your Pelicula35 account yourself from Account, Profile. We email a link to confirm, then the account and the information we hold to operate it are deleted. Closing an account is not the same as destroying our accounting records, and the two are treated differently:
- Erased: sign-in credentials and password, connected Google or Facebook accounts, two-factor security, saved payment methods (removed at Stripe as well), delivered scans and their files, phone number, delivery addresses, preferences, abandoned baskets and newsletter subscription. If you had previously unsubscribed from the newsletter we keep your address alone, flagged do-not-contact, so that we do not add you back by mistake.
- Retained: issued invoices, credit notes, estimates, the payments against them and the order records behind them, together with the name, billing address and, where applicable, tax code printed on those documents. We do not retain your phone number, which is not required invoice content.
The lawful basis for retaining them is Article 6(1)(c) of the GDPR, processing necessary for compliance with a legal obligation, and Article 17(3)(b), which withholds the right to erasure to that extent. The Romanian Fiscal Code requires a full invoice to identify the buyer, so these documents cannot lawfully be anonymised either.
Accounting Law no. 82/1991, article 25, requires the supporting accounting documents to be kept for five years, counted from 1 July of the year following the financial year in which they were drawn up. An invoice issued during 2026 is therefore kept until 30 June 2032 and destroyed after that.
That period can be extended where an audit, dispute, chargeback, statutory hold or legal claim requires it. Any extension is recorded with a reason and a review date rather than applied indefinitely by default.
Retained documents are separated from the closed account. They carry no login, no email address, no phone number and nothing that can sign in, and they are never used for marketing, profiling or re-engagement. They remain visible to Pelicula35 staff who work with invoices, as accounting records must be.
Where a closure affects a processor, we act on it: the Stripe customer record and saved cards are deleted, Google and Facebook identity links are removed, and newsletter data is deleted, except that an existing unsubscribe is kept in reduced form so we do not contact you again by mistake.
Database backups are held on a rotating schedule and expire with it, so a deleted account may persist in a backup until that rotation completes. Backups are not used to restore closed accounts.
Your Rights
Subject to applicable law, you may request access, correction, deletion, restriction, objection, or portability for relevant personal data. Requests can be sent using the contact details listed on this page.
You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP: www.dataprotection.ro
Signing in with Google or Facebook
If you choose social sign-in, Pelicula35 receives an account identifier and basic profile information from Google or Facebook, including your name, email address and profile picture where available. We use this information only to create, link and authenticate your Pelicula35 customer account. We do not request access to Gmail, Google Drive, contacts, Facebook posts or other unrelated services, and we do not sell this information.