Privacy Policy
This policy explains what data we process about you, why, for how long, and what rights you have. Last updated: 2026-06-22
1. Data Controller
IMPERIAL CM SRL (trade name: Imperial Market) — referred to below as “we” or “the company”. Registered address: Str. Nicolae Titulescu nr. 8a, Moldova Nouă, Caraș-Severin County, Romania VAT ID: RO 1074642 Trade Registry No.: J1991000876117 Privacy / DPO email: privacy@imperialmarket.ro
This policy applies to:
- The imperialmarket.ro website
- The Imperial Market mobile app
2. The data we process
2.1 In the Imperial Market app
| Category | Specific data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Account identification | Email, phone number, name, password (stored as a one-way hash) | Creating and managing your account | Contract (Art. 6(1)(b) GDPR) | Until account deletion |
| Virtual loyalty card | Unique virtual card number | Identification at the till, applying discounts | Contract | Until account deletion |
| Fiscal receipts | Receipt number, store, date, total amount, products | Showing your purchase history (the app displays the last 12 months) and calculating savings | Contract (Art. 6(1)(b)) + Legitimate interest (Art. 6(1)(f)) | Stored up to 10 years; de-identified when you delete your account |
| Notification token | Firebase Cloud Messaging (FCM) token | Sending push notifications about promotions | Consent | Until notifications are disabled or the account is deleted |
| Technical data | App version, operating system, device model, anonymous device identifier | Diagnostics, technical statistics | Legitimate interest (Art. 6(1)(f)) | While the app is installed; the link to your account is removed when you delete your account |
Display vs. storage of purchase history. In the app you see your purchases from the last 12 months. We keep older receipts (up to 10 years) for accounting and statistical purposes, but they are not shown in the app. When you delete your account, your receipts are de-identified (name, phone number and card number removed) so they can no longer be linked to you. Separately, as a retailer we are required by Romanian law to keep the legally-mandated fiscal records in our accounting system — an obligation independent of your app account.
2.2 On the website
The website does not use non-essential cookies, does not run third-party analytics, and does not collect personal information. Our CDN server keeps anonymous technical logs (truncated IP, user-agent) for 30 days for protection against attacks.
3. Who we share data with
We use the following data subprocessors:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting + DDoS protection | Anonymous technical logs | EU / US (standard contractual clauses) |
| Google LLC (Firebase Cloud Messaging) | Push notifications to Android devices | Device tokens | EU / US |
Syncing fiscal receipts with your virtual card is handled by our own systems hosted on our infrastructure in Romania — no third-party processor is involved.
We do NOT sell your data to any third party. Data is shared only for the purposes described.
4. International transfers
Some subprocessors (Google, Cloudflare) are based in the United States. Transfers are made under the European Commission’s Standard Contractual Clauses (Decision 2021/914) and additional technical measures (encryption in transit, encryption at rest).
5. Your rights (GDPR Art. 15–22)
You have the following rights:
- Right of access (Art. 15) — to find out what data we process about you
- Right to rectification (Art. 16) — to correct inaccurate data
- Right to erasure (Art. 17) — to request deletion of your account and data (see the Account Deletion page)
- Right to restriction (Art. 18) — to request the temporary halt of processing
- Right to portability (Art. 20) — to receive your data in a structured format (GDPR export)
- Right to object (Art. 21) — to object to processing based on legitimate interest
- Rights regarding automated decisions (Art. 22) — we do not make decisions with legal effects on you based solely on automated processing
To exercise any right, write to privacy@imperialmarket.ro. We reply within a maximum of 30 days. See also the Your GDPR Rights page for practical details.
6. Complaints
If you believe your rights have been violated, you may file a complaint with the Romanian Data Protection Authority (ANSPDCP) — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București Tel: +40 31 805 9211 · Email: anspdcp@dataprotection.ro Web: www.dataprotection.ro
7. Minors
The Imperial Market app is not intended for persons under 16 years of age. We do not intentionally collect data about minors. If you become aware that a minor under 16 has an account, write to us at privacy@imperialmarket.ro and we will delete the account without delay.
8. Security
We use TLS encryption for all communications, passwords stored with hashing (bcrypt), and restricted database access for authorized personnel.
9. Changes to the policy
We may update this policy. The most recent version will always be available at imperialmarket.ro/en/privacy. Significant changes will be announced by email or by in-app notification.