In short
- We collect only what we need to get your order to you: name, email, delivery address and cart contents.
- We do not sell your data to anyone, and we make no automated decisions about you.
- The newsletter and any non-essential cookies run on your consent, which you can withdraw at any time.
- Invoices are kept for 10 years because Romanian accounting law requires it. Everything else, far less.
- Exercise your GDPR rights with one email to office@carefresh.ro. We reply within a month.
1. Who processes your data
The carefresh.ro shop is operated by OKRALIS S.R.L., which is the controller of your personal data.
- Company
- OKRALIS S.R.L., limited liability company
- Tax ID (CUI / CIF)
- 51286544, not registered for VAT
- Trade Register no.
- J2025010018003
- Registered office
- Șos. Giurgiului nr. 277–279, Sector 4, Bucharest, Romania
- office@carefresh.ro
We process personal data under Regulation (EU) 2016/679 (GDPR) and Romanian Law 190/2018. The email above is the only contact channel for any request about your data.
The CARE FRESH trademark is owned by HHO OIL ENERGY S.R.L. (tax ID 45663194, J2022001098233, Str. Cireșului nr. 37, Sat Fundeni, Comuna Dobroești, Ilfov county). Details in the Terms and conditions.
2. What we collect, and where it comes from
- Order: your name, email, delivery and billing address, cart contents and order value.
- Newsletter: your email address only, if you subscribe.
- Support: our email correspondence and whatever you tell us about an order, a return or a complaint.
- Technical data: IP address, device and browser type, cookies and similar identifiers. Details are in the Cookie policy.
We get the data directly from you, except technical data, which is generated automatically as you browse. We do not ask for sensitive data. We never see or store your card details: you enter those with the payment processor, through the payment methods available at checkout.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Taking your order, delivery through our partner courier, returns, the legal guarantee of conformity, order-related messages | Performance of the contract, Art. 6(1)(b) GDPR |
| Invoicing, accounting and tax records | Legal obligation, Art. 6(1)(c) GDPR |
| Newsletter and cookies that are not strictly necessary | Your consent, Art. 6(1)(a) GDPR; for cookies, also Art. 4 of Law 506/2004 |
| Site security, fraud prevention, defending our rights in a dispute | Legitimate interest, Art. 6(1)(f) GDPR |
You can withdraw consent at any time: use the unsubscribe link in every email, change your cookie settings, or write to office@carefresh.ro. Withdrawal does not affect processing already carried out.
4. How long we keep it
- Orders, invoices and accounting documents: 10 years, as Romanian accounting law requires.
- Newsletter: until you unsubscribe.
- Email correspondence: up to 3 years.
- Cookies and technical data: for the periods listed in the Cookie policy.
After those periods we delete or anonymise the data.
5. Who we share it with
We do not sell or rent your data. We share it only with the categories of recipients the shop needs to run:
- the e-commerce platform the shop runs on, including its hosting;
- the payment processor, to take payment for your order;
- the partner courier, for delivery and returns;
- the invoicing provider and our accounting services;
- the email marketing provider, if you are subscribed;
- public authorities, only where the law requires it.
Each provider receives only what it needs, under a contract, and cannot use the data for anything else.
6. Transfers outside the EEA
Some providers may process data outside the European Economic Area. Where that happens, the transfer relies on the safeguards in Art. 46 GDPR, usually the European Commission's standard contractual clauses, or on an adequacy decision. You can ask for a copy of those safeguards at office@carefresh.ro.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, objection, and the right to withdraw consent.
Send your request to office@carefresh.ro. We reply within one month of receiving it; if the request is complex we will tell you and may extend that by two months. We may ask you to confirm your identity, so we do not hand your data to someone else. Some data cannot be erased on request while the law requires us to keep it, invoices for example.
If our answer does not satisfy you, you can complain to the Romanian data protection authority, ANSPDCP, Bd. G-ral. Gheorghe Magheru nr. 28–30, Sector 1, Bucharest, dataprotection.ro. For complaints about the order rather than the data, see Shipping and returns.
8. Security
The site uses an encrypted connection (HTTPS). Access to data is limited to the people who need it to process your order. No measure is perfect, but if an incident puts your data at risk we will inform you and notify the authority, under Art. 33 and 34 GDPR.
9. Children
The shop is not aimed at people under 16 and we do not knowingly collect their data. If you learn that a child has sent us personal data, write to us and we will delete it.
10. No automated decisions
We do not make automated decisions with legal effect on you, and we do not profile you for evaluation. Marketing cookies, if you accept them, are used only for measurement and for showing relevant ads.
11. Changes
If we change this policy, we publish the new version on this page and update the date. Read it together with the Terms and conditions and the Cookie policy.
Last updated: 12 August 2026.