Privacy Policy

This explains what we do with your personal data when you shop with Gurkhas Mart, who else sees it, and what you can ask us to do about it. It is written to be read rather than to be survived.

Last updated September 23, 2026.

Who is responsible for your data

• Registered office: Calea București 107, 500418 Brașov, Romania
• Email: info@gurkhasmart.com

What we collect, and why

Only what an order or an account actually needs:

• To take and deliver an order — your name, email address, phone number, delivery address, billing address and what you bought. Without these there is no order and nothing to deliver.
• For a company invoice — your company name, CUI and Nr. Reg. Com., if you ask for one.
• To run an account — your email address and password, and anything else you choose to add, such as a phone number, date of birth, a profile picture or saved addresses. Everything beyond the email address and password is optional and can be left blank or removed.
• To keep the account yours — a record of which devices are signed in, so you can sign out of one you no longer have, and a count of failed sign-in attempts against the internet address they came from, so that somebody guessing passwords is slowed down. That address count is the only place we deliberately process an IP address, and it is kept briefly.
• If you use them — your wishlist, your reviews, and your saved marketing preferences.

We do not buy personal data, and we do not build profiles of you for advertising.

Who else sees it

We share your data only where an order cannot happen otherwise, and only the part that is needed:

• Google — we copy order records into a Google Sheets spreadsheet so the shop can work through the day's orders. That copy includes your name, email address, phone number, delivery address and order contents. The spreadsheet is shared with named members of shop staff only, never by a public link.
• The courier delivering to you — your name, address and phone number, so they can find you and call ahead.
• Our email provider — your email address and the contents of the messages we send you about your order or your account.
• Google Maps, and OpenStreetMap if Maps cannot answer — only if you press the button that fills in your address from your location, and only the coordinates your browser gives us. We do not store your location.
• Google — if you choose to sign in with a Google account, Google tells us your name and email address so we can match or create your account. You can sign in with an email address and password instead.
• Our accountant and the Romanian tax authority — the invoice data the law requires us to issue and keep.

Orders are currently paid in cash on delivery, so we never see or hold card details.

How long we keep it

• Invoices and the order data behind them — for as long as Romanian tax law requires us to keep accounting records.
• Your account and the things attached to it — until you ask us to delete it.
• Failed sign-in counts — a matter of hours.

When we delete your data, we delete it from the order spreadsheet as well, not only from the website.

What you can ask us to do

Under the GDPR you can ask us to:

• show you the data we hold about you, and give you a copy of it;
• correct anything that is wrong;
• delete it, where we are not legally required to keep it — invoices are the usual exception;
• stop using it for marketing, which you can also do yourself in your account at any time;
• restrict or object to how we use it, or hand it to another service in a portable form.

To ask us anything about your data, or to make any of the requests below, use the contact page.

We answer within one month. If you are not satisfied with our answer, you can complain to the Romanian data protection authority, ANSPDCP, at dataprotection.ro — you do not have to come to us first.

Cookies

This site sets a small number of cookies it cannot work without: one that remembers what is in your basket, and one that keeps you signed in. Neither is used to track you between sites, and neither needs your permission, because without them the shop would not function.

Some settings, such as which tab you last had open, are kept in your own browser and never reach us.

Children

This shop is not aimed at children, and we do not knowingly create accounts for them. If you believe a child has given us their data, tell us and we will remove it.

Changes to this policy

If we change how we use your data we will update this page and change the date at the top. Where a change is significant, we will tell account holders by email rather than leaving it to be noticed.