Privacy Policy (GDPR)
Last updated: 11 October 2026
This Privacy Policy explains how BEER LAB SRL (hereinafter "we", "Sifo" or "the Seller") collects, processes, and protects your personal data, in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679).
1. Identity of the Data Controller
Company: BEER LAB SRL
Registered office: Brașov Municipality, Str. Zaharia Stancu nr. 6 B, Ap. 202, Brașov County
CUI: 54684382
Email for data protection: bere@sifo.ro
Phone: 0756 666 555
2. What data do we collect, for what purpose, and on what legal basis?
We collect only data strictly necessary to offer you our products and an optimal experience on the sifo.ro website.
| Purpose of Processing | Data Collected | Legal Basis (According to GDPR) |
|---|---|---|
| Processing, invoicing, and shipping of orders placed on the site. | Name, first name, delivery/billing address, phone number, email. | Art. 6 para. 1 lit. b (Contract performance). |
| Verification of legal age for alcohol purchase (+18 years). | Age confirmation declaration (over 18 years) upon site entry / checkout. | Art. 6 para. 1 lit. c (Legal obligation). |
| Customer support, complaint management, and returns. | Name, email, phone, order history. | Art. 6 para. 1 lit. f (Legitimate interest in solving customer problems). |
| Reporting and fixing technical errors of the website and of the server that prepares the payment. | The error message and where in the code it happened, the page address (without anything after a "?" or "#"), browser, operating system and device type, website version, time, and the IP address the report was sent from. | Art. 6 para. 1 lit. f (Legitimate interest in keeping the website working and secure). |
| Aggregate website visit statistics. | No data that identifies you: we see only totals (page views, referring site, country, browser and device type). | Art. 6 para. 1 lit. f (Legitimate interest in understanding how the website is used). |
Note regarding payments: Online card payments are securely processed by Stripe, an authorized third-party provider. Sifo does not collect and store your complete bank card data.
Error reporting: When an error occurs on the website or on the server that prepares the payment, a report is sent to the self-hosted error-tracking system of our technical provider, Fibonacci Impact (GlitchTip, open-source software), on its own servers. We use no third-party error-reporting service. The report contains the data in the table above and the steps just before the error (pages opened, requests made and buttons clicked, never what you typed). It contains no cookies, no names, no email addresses, no form or request contents, no session recordings, and never any payment data (payments are processed by Stripe). Reports are kept for 90 days, used only to find and fix errors, and only our technical provider has access to them.
Visit statistics: We use Cloudflare Web Analytics to count visits. It sets no cookies, uses no browser local storage and does not identify you by fingerprinting; we see only totals: page views, referring site, country, and browser and device type. Details: Cloudflare's privacy policy.
Presentation video: On the home page, the video's preview image loads from YouTube (Google) servers when you reach it on the page, so YouTube receives your IP address and information about your browser. Until you click the video, the YouTube player does not load and no YouTube script runs. Once you click it, the player loads from youtube.com: YouTube receives your IP address, information about your browser and device and the page you are watching from, may set its own cookies and may record the view, under its own policy.
Partner venues map: The map in the "Where to find Șifo?" section of the home page loads its images from OpenStreetMap servers (tile.openstreetmap.org), run by the OpenStreetMap Foundation in the United Kingdom, when you reach it on the page. OpenStreetMap receives your IP address, information about your browser and the address of sifo.ro; it sets no cookies. The "Open in Google Maps" links on the map lead to Google only if you click them.
3. To whom do we transmit data?
To operate the online store, we collaborate with trusted third parties to whom we may transmit only data necessary to fulfill their services:
- Courier companies (for order delivery);
- The online payment processor Stripe (for making and confirming payments);
- IT service and web hosting providers, used through our technical provider, Fibonacci Impact: Cloudflare (website hosting, content delivery, DNS and security), Hetzner (servers in Germany) and RackNerd (servers in Ireland, France and the United States). The service that prepares the payment, e-mail (including messages sent to bere@sifo.ro), error tracking and monitoring run on these servers, and our technical provider may move them between these locations, for example for maintenance or disaster recovery;
- Google (the presentation video on YouTube, described above);
- OpenStreetMap Foundation (the partner venues map images, described above);
- Accounting firms (for invoice registration according to law).
4. Data retention period
We keep your data only as long as necessary for the purposes mentioned above or to comply with legal obligations:
- Financial-accounting documents (invoices): 10 years, according to Romanian legislation.
- Error reports: 90 days.
5. Your rights (GDPR)
As a data subject, you have the following rights:
- Right of access: You can request a copy of data we hold about you.
- Right to rectification: You can request correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): You can request data deletion, under legal conditions.
- Right to restriction of processing: You can request limitation of data processing in certain circumstances.
- Right to data portability: You can request receiving data in a structured format to transfer to another controller.
- Right to object: You can object to data processing for reasons related to your particular situation.
- Right to withdraw consent: For processing based on your consent, you can withdraw it at any time.
To exercise these rights, you can contact us at bere@sifo.ro. We will respond within a maximum of 30 days.
You also have the right to file a complaint with the National Authority for Supervision of Personal Data Processing (ANSPDCP - www.dataprotection.ro) if you consider your rights have been violated.