Privacy Policy

Data Controller

Outsole SRL

Tax ID (CUI): RO42946188

Registered address: Str. Coriolan Brediceanu nr. 9, ap. 1, Garaj Auto, Timișoara, jud. Timiș, Romania

Contact: outsolesrl@gmail.com

1. Introduction

Outsole SRL ("Outsole", "we", "us") is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (EU) 2016/679 (GDPR).

By using the Outsole consignment platform (the "Platform"), you acknowledge that you have read and understood this policy.

2. Data We Collect

Depending on your account type, we collect the following personal data:

All users:

• Full name or company name
• Email address
• Phone number
• Residential or registered business address
• IBAN and account holder name (for payout processing)

Private individuals:

• Personal identification number (CNP or equivalent)
• Government-issued ID document (photo or scan of front and back)

Companies:

• Tax identification number (CUI)
• Name of legal representative

Automatically collected:

• IP address and browser information (via Supabase infrastructure)
• Login timestamps and session data

3. Why We Collect Your Data

We process your personal data for the following purposes and legal bases:

We do not use your data for automated decision-making or profiling.

4. How We Store Your Data

Your data is stored on Supabase infrastructure hosted within the European Union. Identity documents and signed contracts are stored in private, access-controlled storage buckets and are never publicly accessible.

Access to your personal data is restricted to Outsole staff who need it to operate the Platform.

5. How Long We Keep Your Data

• Account data is retained for as long as your account is active
• After account closure, personal data is retained for a minimum of 5 years to comply with Romanian fiscal and legal obligations
• Identity documents are retained for the duration of your account and deleted within 30 days of a verified account closure request
• Signed consignment agreements are retained for a minimum of 5 years as legally required documents

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Your data may be shared only in the following limited cases:

• With payment processors solely for the purpose of executing bank transfers to your IBAN
• With Romanian tax or legal authorities if required by law
• With our technical infrastructure provider (Supabase) solely for platform operation — governed by a Data Processing Agreement in compliance with GDPR

7. Cookies & Tracking

The Platform uses only essential session cookies required for authentication and platform functionality. We do not use tracking cookies, advertising cookies, or third-party analytics.

8. Your Rights Under GDPR

As a data subject you have the following rights:

• Right of access — request a copy of all personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data (subject to legal retention obligations)
• Right to restriction — request that we limit processing of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at outsolesrl@gmail.com. We will respond within 30 days.

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Romanian data protection authority:

ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)
Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted storage, access controls, and private storage buckets for sensitive documents.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be communicated via email and displayed on the Platform. Continued use of the Platform after changes are posted constitutes acceptance of the updated policy.