Privacy policy

Last updated: 30 August 2026.

1. Who processes the data

The data controller is Fenix Accent Consulting S.R.L., a Romanian company operating the online shop dha-core.com and the brand DHA-CORE®.

• Registered office: Aleea Fizicienilor 13, Bl. 3A, Sc. A, Fl. 2, Ap. 14, Sector 3, Bucharest, Romania
• Unique registration code: RO25723950
• Trade register number: J2009007416407
• Email for privacy matters: customer@dha-core.com
• Phone: +40 726 133 083

We have not appointed a data protection officer (DPO), because our activity does not fall within the situations that require one under art. 37 GDPR. Any request relating to data is answered at the address above.

2. What data we collect

We collect only the data we need in order to deliver an order, issue an invoice and answer a question.

• Contact and delivery details — first name, surname, email address, phone number, delivery and billing address.
• Billing details — for legal entities: name, VAT number, registration number, registered office.
• Order data — the products ordered, the value, the payment and delivery method, the order history.
• Payment data — we do not store card numbers. Card payments are processed entirely on the authorised processor’s infrastructure; we receive only the transaction confirmation and the last digits of the card.
• Account data, if you create one — email address and a password stored in encrypted form.
• Your email address, if you join the waiting list or the newsletter.
• Technical data — IP address, browser and device type, pages visited, collected through cookies and similar technologies. See section 10.

We do not collect health data. We do not ask for or store information about conditions, treatments or medical test results, and our forms contain no such fields.

3. Why we process it and on what basis

Where the basis is consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before it.

4. Who we share it with

We do not sell or rent personal data. We share it only with the suppliers we need in order to operate, each acting as a processor or independent controller, under contract:

• The courier who brings your parcel — name, address, phone number.
• The payment processor — the data needed to authorise the transaction.
• The invoicing provider and the accountant — the billing details.
• The hosting and email provider — technical storage.
• Analytics and advertising providers, only if you have accepted cookies in those categories.
• Public authorities, where the law requires it.

5. How long we keep it

• Financial and accounting documents — 10 years, in accordance with Accounting Law no. 82/1991.
• Order and warranty data — 3 years from completion of the order, the general limitation period.
• Customer account — for as long as the account stays active, plus 1 year.
• The address on the waiting list or newsletter — until you unsubscribe.
• Support correspondence — 2 years.
• Cookies — individual durations are in the Cookie policy.

6. Transfers outside the EU

Data is stored in the European Union. Some analytics or advertising providers may transfer data outside the European Economic Area. Where this happens, the transfer is based on an adequacy decision of the European Commission or on standard contractual clauses, in accordance with Chapter V of the GDPR.

7. Your rights

You have the following rights over your data:

• Access — to find out what data we hold about you and receive a copy.
• Rectification — to have us correct what is wrong or incomplete.
• Erasure — to have it deleted, where we have no legal obligation to keep it.
• Restriction — to limit processing while it is being contested.
• Portability — to receive the data in a structured, machine-readable format.
• Objection — to object to processing based on legitimate interest and, at any time and unconditionally, to direct marketing.
• Withdrawal of consent, at any time.

Send your request to customer@dha-core.com. We reply within 30 days. If the request is complex, the deadline may be extended by 2 months, in which case we let you know and tell you why.

If you are not satisfied with the reply, you can contact the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, dataprotection.ro, or the courts.

8. Security

The site uses an encrypted HTTPS connection. Access to order data is limited to the people who need it. Passwords are stored as hashes, never in plain text. We make regular backups. If a security breach occurs with a high risk to your rights, we inform you and notify ANSPDCP within 72 hours, in accordance with art. 33 and 34 GDPR.

9. Minors

The site is aimed at people over 18 and we do not knowingly collect data from children. If we learn that we have received such data without a parent’s consent, we delete it.

10. Cookies

We use cookies necessary for the site to work, plus analytics and marketing cookies, the latter only with your consent. The full details, the list and the durations are in the Cookie policy, where you can also change your choices at any time.

11. Changes

We may update this policy. The applicable version is the one published here, and the date of the last update is shown at the top. If we make an important change, we announce it on the site.