Privacy policy

1. Data controller

The controller of your data is TIIN S.R.L., unique registration code (CUI) 49544587, Trade Register no. J40/2461/2024, registered office at Str. Nerva Traian nr. 27-33, Sc. B, Et. 1, Birou 6, Sector 3, 031044 București.

For any question about your data or to exercise your rights, email us at contact@siphertip.com or call +40 756 571 839.

2. Data we process

• Identity and contact data: name, email address, phone number.
• Account data: if you create an account (optional), your email address, your password (kept by Firebase Authentication only as an irreversible hash; we never see it), your name, your phone number (optional), when the account was created and whether you confirmed your email address. Your account shows the orders placed from it.
• Delivery data: the delivery address, which we pass to the courier.
• Company billing data: company name, registration code (CUI) and Trade Register number, when you buy as a company or self-employed person.
• Order data: the unit bought, amounts, currency, order and payment status, tracking number (AWB), delivery date, return requests and refunds.
• Data about the laptop you sell us: its description and photos, the request code, the offer and the test report, the IBAN and the account holder’s name (only if you accept the offer), the payment date and reference or the return AWB.
• Payment data: you enter your card details directly with Stripe; we never see or store them. Stripe only sends us the payment confirmation and reference.
• Technical data: IP address, browser and device type, server logs and an anonymous session identifier created only when you start an order. We use them to run and secure the website, including abuse limits and anti-fraud checks (Firebase App Check / reCAPTCHA).
• Visit source: if you arrive through a short link (e.g. from TikTok, Facebook or Instagram), we keep only the platform name (e.g. “tiktok”) and attach it to the order. We use no tracking pixels and build no marketing profiles.
• Your messages: the content of emails or WhatsApp messages you send us.

We do not ask for sensitive data and make no decisions based solely on automated processing that produce legal effects for you. At payment, Stripe’s fraud screening may decline a transaction automatically; if that happens, write to us at contact@siphertip.com and we will help you complete the order.

3. Purposes and legal bases

• Entering into and performing the contract (taking the order, payment, delivery, order emails, the order page, returns and warranty) – Art. 6(1)(b) GDPR. Without this data we cannot process your order.
• Customer account (creating and managing the account, signing in, the email confirmation and password reset emails, showing your orders) – Art. 6(1)(b) GDPR. You create an account only if you want one; you can also buy without an account.
• Buying your laptop (“Sell us your laptop”): registering the request, receiving and testing the laptop, the offer, payment by bank transfer or the return – Art. 6(1)(b) GDPR, and for the accounting records of the purchase, Art. 6(1)(c).
• Legal obligations (invoicing, accounting and tax records, handling withdrawals and complaints) – Art. 6(1)(c) GDPR.
• Our legitimate interest in protecting the website and payments (security, preventing fraud and abusive reservations, technical logs), defending our rights in disputes and learning which channels bring buyers (link source) – Art. 6(1)(f) GDPR.

We do not send you marketing messages. If we want to do so in the future, we will ask for your consent separately.

4. Who receives your data

We do not sell your data. We share it only with providers who help us operate, under contract and only as far as necessary:

• Stripe – card payments and refunds. For some data (e.g. fraud prevention), Stripe acts as an independent controller under its own privacy policy.
• Google (Firebase and Google Cloud) – hosting of the website and database, customer accounts and anonymous order sessions (Firebase Authentication, which also sends the email confirmation and password reset emails) and abuse protection (App Check / reCAPTCHA). The database and files are stored in the European Union (regions europe-west4 and eur3).
• Resend – sending emails about orders, invoices and laptop sell requests, from its EU region.
• Courier companies (e.g. Sameday, Fan Courier) – name, phone and address, for delivery and returns.
• Our bank – the IBAN and the account holder’s name, to pay for the laptop you sell us.
• Our accountant and, where applicable, our invoicing provider – for tax and accounting obligations.
• Public authorities (e.g. ANAF, ANPC, courts) – only when required by law.
• WhatsApp (Meta) – only if you choose to message us on WhatsApp; WhatsApp’s privacy policy then also applies.

5. Transfers outside the European Economic Area

The store's database and files are stored in the European Union. Account sign-in data (email address and hashed password) is managed by Firebase Authentication, a Google service that may also store it outside the European Economic Area. Some providers (Stripe, Google, Resend) belong to groups headquartered in the United States and may access data from outside the European Economic Area, for example for technical support or security. In those cases the transfer relies on the standard contractual clauses approved by the European Commission and/or on the provider's certification under the EU-U.S. Data Privacy Framework, as applicable. You can ask us for details at contact@siphertip.com.

6. How long we keep data

• Orders and invoices: 10 years from the end of the financial year, as required by accounting law [to be confirmed with the accountant].
• Correspondence about orders, returns and warranty: for the warranty period, then until the limitation period expires (usually 3 years), to defend our rights in disputes.
• Customer account: for as long as you keep it. We delete it when you ask us at contact@siphertip.com; orders and invoices are still kept for as long as the law requires, no longer linked to the account.
• Anonymous visitor sessions created at checkout: deleted automatically after 30 days, except those turned into an account when you sign up.
• Technical logs and abuse counters: up to 30 days, unless needed to investigate an incident.
• Requests to sell us your laptop: if we do not buy the laptop (request cancelled or ended with its return), 90 days after it ends we delete the photos and remove the contact details and free text, keeping only the request code, the model, the amounts and the dates. If we buy it, we keep the purchase data for as long as accounting law requires, as for orders. Photos uploaded without the request being sent are deleted automatically after one day.

7. Cookies and local storage

We only use cookies and similar technologies that are strictly necessary for the website to work. We use no marketing, advertising or analytics cookies and no third-party tracking tools, so we do not show a cookie consent banner.

• st_currency – remembers your chosen currency (RON or EUR) for 12 months.
• st_utm – remembers for 30 days only the name of the platform you came from through a short link (e.g. “tiktok”), so we can attach it to your order. It contains no personal identifier and does not track you on other websites. [to be confirmed by counsel: classing st_utm as strictly necessary]
• Security and session – on checkout and account pages, reCAPTCHA (Google) may set a security cookie, and your anonymous checkout session or your account session is kept in the browser’s local storage (Firebase), to protect against abuse, to show you your order and to keep you signed in. When you sign in we also store the st_account marker locally (no personal data), only so the menu can show “My account”; we remove it when you sign out.
• Stripe – the payment page, hosted by Stripe, uses its own cookies needed for payment and fraud prevention.

If we ever add cookies that are not strictly necessary, we will ask for your consent before using them.

8. Your rights

• Right of access – to know whether we process data about you and get a copy.
• Right to rectification – to have inaccurate or incomplete data corrected. You can also correct the name and phone number of your account yourself, on the account page.
• Right to erasure – to have data deleted, except data the law requires us to keep (e.g. invoices).
• Right to restriction of processing – in certain cases, for example while we check the accuracy of your data.
• Right to data portability – to receive the data you gave us in a structured, commonly used format, or have it sent to another controller.
• Right to object – to processing based on our legitimate interest.

To exercise your rights, email us at contact@siphertip.com from the address used for the order, or quote the order number, so we can identify you. We reply free of charge within one month of receiving the request. For complex requests this may be extended by two further months, in which case we let you know.

9. Complaints to the supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or go to court. Please contact us first: we try to resolve any issue quickly.

10. Minors

The shop is intended for people aged 18 or over. We do not knowingly collect data about minors. If you learn that a minor has sent us personal data, let us know and we will delete it, within the limits allowed by law.

11. Data security

We use encrypted connections (HTTPS), restrict access to order data to authorised people, and protect order links with a unique access code. The order page link in your email is personal: do not share it. We never see your account password: Firebase Authentication keeps it only as an irreversible hash. Choose a password you do not use anywhere else.

12. Changes to this policy

We may update this policy when the way we process data changes. The date of the last update is shown at the top of the page, and we announce important changes on the website or by email.

This is a working draft of 20 October 2026. The effective date will be set at launch, after legal review.