Privacy policy

The controller of your data is Humanity Concept SRL, tax ID (CUI) 42635394, registered office at Calea Turzii 13-15, Cluj-Napoca, Romania. Humanity Concept SRL operates delia-tipau.com and Delia Țipău's courses, services and bookings.

For any question about your data, write to contact@delia-tipau.com.

• Your account: your name, email and password (stored encrypted) or, if you sign in with Google or Facebook, the name, email and profile picture we receive from them. We use them to give you access to the courses you bought. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Buying courses and bundles: billing details (name, email, phone, address; for companies, the company name and tax ID), the courses bought, the amounts paid and any discount codes used. Card payments are processed by Stripe: we never see or store your card details. If you choose to pay in instalments, the application goes to TBI Bank, which assesses it as a separate controller. Invoices are issued through Oblio. Legal basis: performance of a contract and our legal accounting obligations (Art. 6(1)(b) and (c)).
• Online courses: your progress through the lessons and what you watched, so you can pick up where you left off. The videos are hosted by Vimeo. Legal basis: performance of a contract.
• Bookings: your name, phone, email, the services chosen, your booking history and the deposits paid. When booking online you receive a verification code by text message. The treatment consent form may include health data (for example contraindications); we process it only with your explicit consent and only for the safety of the treatment. Evaluation photos (before and after) are kept in private storage that only the team can access. Legal basis: performance of a contract and explicit consent (Art. 9(2)(a) GDPR).
• Marketing messages: we send offers and news by email or text message only if you agreed to it. You can unsubscribe at any time from the link in the message. Messages about your orders and bookings (confirmations, reminders) keep coming. Legal basis: consent (Art. 6(1)(a)).
• Contact and support forms: your name, email, phone (if you fill it in) and message, so we can reply. Cloudflare Turnstile protects the forms against spam. Legal basis: our legitimate interest in answering messages and steps taken before a contract (Art. 6(1)(f) and (b)).
• Instagram and Facebook messages and ads: when you message us or answer the questions in our ads (for example “How would you like to book your place?”), we receive your name or username, your messages and the answers you chose, so we can send you the information you asked for. Meta Platforms Ireland Ltd. is an independent controller for the data on its platforms. Legal basis: steps taken before a contract and our legitimate interest (Art. 6(1)(b) and (f)).
• Promotional links: when you reach the site through a link such as delia-tipau.com/ig-bio, we count the click and keep, for 30 days in a cookie, the link you came through, to see which channel brought an order. For statistics we record the date, device type, browser, country and whether the link was opened inside the Instagram app. Unique visitors are counted through an encrypted code that changes every day; we do not keep your IP address. Legal basis: our legitimate interest in knowing which promotion channels work (Art. 6(1)(f)).
• Analytics and advertising, only with your consent: if you accept cookies, we use Google Analytics (visit statistics) and the Meta Pixel (which pages you visit and what you buy, to measure and show ads on Instagram and Facebook). When you buy a course we also send the purchase to Meta through the Conversions API: the amount, the courses, your IP address, your browser, and your email and phone irreversibly turned into a code (SHA-256 hash). Without your consent we send nothing. For collecting and sending this data we are joint controllers with Meta. Legal basis: consent (Art. 6(1)(a)).

• Necessary: the sign-in session (while you are signed in), dt_customer (the booking session, 180 days), dt_consent (your choice in the cookie banner, 180 days) and the technical cookies used at checkout. Your cart is kept in your browser. These need no consent, because the site cannot work without them.
• Promotional link attribution: dt_promo and dt_promo_click, 30 days. They are our own cookies and only hold the link code and the click, not who you are.
• Analytics, with your consent: _ga and _ga_*, from Google Analytics, up to 2 years.
• Advertising, with your consent: _fbp and _fbc, from Meta, 90 days.

You can change your choice at any time from the “Cookie settings” link in the page footer.

We do not sell your data. We share it only with the providers we need to run the site, payments and communication, who process it on our behalf or, where stated, as separate controllers:

• Hosting and storage: Vercel (website hosting), Neon (database), Cloudflare (file storage and spam protection).
• Payments and invoicing: Stripe (card payments), TBI Bank (instalments, separate controller), Oblio (invoicing).
• Communication: MailerSend (emails), SMSAPI (text messages).
• Courses: Vimeo (video hosting).
• Google: sign-in with Google, Google Analytics (with your consent) and the team's calendar for bookings.
• Meta: sign-in with Facebook, the Meta Pixel and Conversions API (with your consent), Instagram and Facebook messages.
• Authorities: when the law requires it (for example the tax authority or the courts).

Some providers (for example Vercel, Cloudflare, Stripe, Vimeo, Google and Meta) may process data in the United States. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

• Your account: while it is active. If you ask us to delete it, we do, except for the data the law requires us to keep.
• Invoices and accounting records: for the period required by accounting law (currently up to 10 years).
• Bookings, consent forms and evaluation photos: while you are a client and at most 3 years after your last appointment, unless the law requires otherwise.
• Messages (forms, email, Instagram, Facebook): at most 2 years after the last conversation.
• Marketing consent: until you unsubscribe or withdraw your consent.
• Cookies: the periods listed in the cookies section.

You have the right to access your data, to have it corrected, erased or restricted, to data portability and to object to processing based on our legitimate interest, including direct marketing. You can withdraw your consent at any time, without affecting the processing done before. We do not make decisions based solely on automated processing that have legal effects on you.

For any request, write to contact@delia-tipau.com and we will reply within one month.

If you are not satisfied with our answer, you can lodge a complaint with the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro.

The site uses encrypted connections (HTTPS). Passwords are stored encrypted, the team's access to data is limited by role, and private photos open only through temporary links valid for 15 minutes.

Our courses and services are meant for people over 16. We do not knowingly collect data from children under 16; if you find out that this happened, write to us and we will delete it.

When we change this policy, we publish the new version here and update the date at the top of the page.