This Privacy Policy aims to explain, in a clear and transparent manner, how ERTHOLOGY CORP S.R.L. collects, uses, discloses, and protects the personal data of data subjects. Data processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), as well as with applicable national legislation on personal data protection.

1 Identity of the Data Controller

ERTHOLOGY CORP S.R.L. (hereinafter referred to as "the Company" or "We") is a personal data controller and is identified by the following information:

2 Principles of Personal Data Processing

In its activities, the Company processes personal data of website visitors, customers, potential customers, candidates, employees, collaborators, contractual partners, and other individuals who interact with it.

Data is processed in compliance with the following principles:

• Lawfulness, fairness, and transparency
• Collection for specified, explicit, and legitimate purposes
• Data minimization
• Accuracy and update
• Storage limitation
• Integrity and confidentiality, through appropriate technical and organizational measures

3 Categories of Data Processed and Purposes of Processing

3.1. "Contact Us" Form

Through the form available on the website https://erthology.com/, the following are processed: first name, last name, email address, phone number, and any other information voluntarily provided in the "Comment" field.

3.2. Order Form

For processing online orders, we process: first name, last name, email address, phone number (optional), shipping and billing details (apartment, postal code, etc.).

The Company does not automatically request individuals' personal identification numbers (CNP). Providing it is optional. Invoices can be issued without CNP, in accordance with the principle of data minimization.

3.3. Financial Data

Information regarding payments made (amount, date, method) is processed, as well as data necessary for refunds, including IBAN and bank details. Card data is not stored by the Company and is managed by Shopify Payments.

3.4. Email Interactions

We may collect information regarding email opens, link clicks, and content preferences. Unsubscribing is possible at any time via the dedicated link or direct contact.

3.5. Incomplete Orders

If an order is not completed, the data entered (e.g., email, items in cart) may be stored for 30 days to send a reminder email.

3.6. Voluntarily Provided Data

Information submitted through reviews, chat, or email is processed exclusively for the purpose of communication and resolving requests.

3.7. Social Networks

In the case of interactions on platforms such as Facebook, Instagram, TikTok, or YouTube, public data such as username, profile picture, and messages may be processed. The policies of the respective platforms apply separately.

3.8. Contracts and Collaborations

For the conclusion and execution of contracts, we process data such as: first name, last name, series and number of identity document/passport, gender, address, bank account, email, phone number.

3.9. Cookies and Similar Technologies

The website may collect data such as IP address, browser type, session duration, browsing history, and page interactions. Additional details are available in the Cookie Policy below.

4 Legal Bases for Processing

Data processing is carried out based on:

• Performance of a contract
• Compliance with legal obligations
• Consent given
• Legitimate interest of the Company

5 Data Retention Period

Data is stored for the period necessary to fulfill purposes and legal obligations, including:

6 Data Recipients

Data is not transferred outside the EU/EEA.

7 Protection Measures and Internal Access

We apply data encryption, strict access control, confidentiality agreements, and regular staff training.

8 Data and Payment Security

The Shopify platform provides infrastructure, backups, and cybersecurity. Payments are processed through Shopify Payments, a PCI DSS certified provider, using the 3D Secure protocol.

9 Data of Minors

The website is intended exclusively for individuals aged 18 and over. Data of minors is not intentionally collected and is immediately deleted if identified.

10 Rights of Data Subjects

Data subjects have the rights provided by GDPR:

• Right of access to personal data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object
• Right not to be subject to automated decision-making
• Right to lodge a complaint with ANSPDCP

The website https://erthology.com/ uses its own and third-party cookies to ensure the correct functioning of the site, to improve the browsing experience, and to adapt content and services to user interests.

Data processing through cookies is carried out in accordance with Regulation (EU) 2016/679 (GDPR), applicable national legislation, and rules regarding the privacy of electronic communications. User consent is requested before using non-essential cookies, through the dedicated banner.

When accessing the website, personal data is not transmitted to our servers unless actively provided by the user. An exception is made for strictly necessary technical cookies, which are essential for the functioning of the site.

The Google Analytics tool is configured so that the collected information is anonymized and does not allow direct identification of individuals.

External technologies (such as Google Maps or YouTube plugins) are disabled by default. Their activation is only possible with explicit consent, in which case third-party providers may process user data according to their own privacy policies.

1 What are cookies?

Cookies are small text files stored on the user's device (computer, mobile phone, tablet) when accessing a website. They allow the device to be recognized and browsing preferences to be remembered (language, authentication, display settings), facilitating efficient use of the site.

Some cookies may contain personal data, such as an IP address. Cookies are only used to the extent that the user has given their consent, with the exception of strictly necessary cookies.

2 Types of cookies used

3 Third-party cookies

Certain content elements may be provided by third parties. These may place their own cookies, called "third-party cookies". These providers are responsible for complying with the law and their own privacy policies.

4 Cookie lifetime

Cookies can be:

• Session cookies — deleted when the browser is closed
• Persistent cookies — remain stored until expiry or manual deletion

Users can delete cookies at any time from their browser settings.

5 Cookie control

Users can manage or delete cookies by accessing their browser settings. Completely disabling cookies may affect the website's functionality.

For more information: www.aboutcookies.org