Version 2.0 (effective from 04.10.2026). Policy reviewed and completely rewritten.
1. Who we are
The controller of your personal data is PADEL EXPERIENCE S.R.L. (“PADELXP”, “we”, “us”), with its registered office in Municipiul Câmpina, Aleea Scărișoara nr. 10A, județul Prahova, Romania, Trade Register no. J2025026671005, tax identification number (CUI) 51624190, which owns the online shop www.padelxp.ro.
For any question or request regarding your data: contact@padelxp.ro, telephone +40 730 569 003.
2. What data we process, why and on what legal basis
| Situation | What data | Why | Legal basis (GDPR) |
|---|---|---|---|
| You place an order (with or without an account) | name, billing and delivery address, telephone, e-mail, products ordered, payment method; for companies: company name, tax identification number (CUI), Trade Register number | processing, invoicing and delivering your order, returns, warranties | Art. 6(1)(b) GDPR – performance of a contract |
| Invoicing and accounting records | the data on the invoice | tax and accounting obligations | Art. 6(1)(c) GDPR – legal obligation |
| You create an account | name, e-mail, password (encrypted), addresses, order history | access to your account, faster checkout, order history | Art. 6(1)(b) GDPR |
| B2B partner account | company details and contact person details | approving and managing the account, B2B prices | Art. 6(1)(b) GDPR |
| You contact us (e-mail, form, telephone, social media) | name, e-mail, telephone, content of your message | to reply to you | Art. 6(1)(b) or (f) GDPR – legitimate interest in replying |
| Offers and news for B2B partners (e-mail) | the e-mail address of the company / contact person | to send you offers and news as a B2B partner | Art. 6(1)(f) GDPR – legitimate interest (existing business relationship); you can unsubscribe at any time using the link in every e-mail |
| Our online advertising (Google, TikTok, Facebook/Instagram) | cookie identifiers, your interaction with our ads and with the website | to measure and improve our ads | Art. 6(1)(a) GDPR – consent (the “Advertisement” category in the cookie banner) |
| Active / abandoned baskets | basket contents, e-mail address (if you entered it), date | sales statistics and help with completing your order | Art. 6(1)(f) GDPR – legitimate interest |
| Browsing the website | IP address, browser, pages accessed (server logs) | operation and security of the website | Art. 6(1)(f) GDPR |
| Usage statistics (Google Analytics) | cookie identifiers, pages visited, device, approximate location | to understand how the website is used and to improve it | Art. 6(1)(a) GDPR – consent (cookie banner) |
| Complaints, disputes, defence of legal claims | data from the order and from correspondence | establishing, exercising or defending our legal claims | Art. 6(1)(f) GDPR |
The data needed for an order is mandatory: without it we cannot conclude and perform the contract. All other data is optional.
We do not make decisions based solely on automated processing and we do not carry out profiling that produces legal effects concerning you.
3. Who we share your data with
We do not sell your data. We share it only to the extent necessary with:
- courier companies that deliver your order (name, address, telephone);
- NETOPIA Payments – the card payment processor (you enter your card details directly with NETOPIA; we never see them);
- SmartBill – issuing invoices;
- Mailjet – sending e-mails about your order and account;
- the hosting provider of the website and the backup service;
- Google Ireland Limited (Google Analytics), only if you have accepted analytics cookies;
- CookieYes – managing cookie consent;
- Akismet (Automattic) – filtering spam messages sent through forms;
- Google (Google Ads), TikTok and Meta (Facebook/Instagram) – the platforms on which we advertise, only if you have accepted advertising cookies;
- our accountant, lawyers and auditors, where necessary;
- public authorities, only where the law requires us to.
All of these providers process the data on our behalf, under a contract and only for the purposes set out above.
4. Transfers outside the EU
Your data is processed mainly within the European Union. Some providers (for example, Google or Automattic) may transfer data to the USA. This is done on the basis of the EU-US Data Privacy Framework (the European Commission’s adequacy decision of 10 July 2023) or of the standard contractual clauses approved by the European Commission.
5. How long we keep your data
| Data | Retention period |
|---|---|
| orders, invoices, accounting documents | 10 years, as required by financial and accounting legislation |
| customer account | until you delete it or ask us to delete it; after deletion we keep only what must be kept for orders and invoices |
| correspondence, complaints | 3 years from the last communication |
| offers for B2B partners | until you unsubscribe |
| active / abandoned baskets | a maximum of 90 days |
| server logs | a maximum of 30 days |
| cookies | as set out in the Cookie Policy |
6. Your rights
Under the GDPR, you have the right:
- to find out what data we hold about you and to receive a copy of it (Art. 15);
- to ask us to correct inaccurate data (Art. 16);
- to ask us to erase your data (Art. 17), except for data we are required by law to keep;
- to ask us to restrict processing (Art. 18);
- to receive your data in a structured format or to have us transmit it to another controller (Art. 20);
- to object to processing based on our legitimate interest (Art. 21) and, at any time, to processing for marketing purposes;
- to withdraw your consent at any time (for example, for cookies), without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, write to us at contact@padelxp.ro. We will reply within one month at the latest (this period may be extended by a further two months in complex cases, in which case we will inform you).
7. Complaints
If you believe that we are processing your data in breach of the law, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, București, www.dataprotection.ro, or with the supervisory authority in the country where you live.
8. Security
We use an encrypted connection (HTTPS), restricted access to data, encrypted passwords and backups. Card payments are processed exclusively by NETOPIA Payments.
9. External links and social media
The website contains links to other websites and to our Facebook, Instagram and TikTok pages. The policies of the respective operators apply to these.
10. Changes
We may update this policy. The current version and its effective date are shown at the top of this page. We will inform you of any significant changes on the website or by e-mail.