Privacy policy

This Privacy Policy explains how LEONTHE STORE S.R.L. collects, uses and protects your personal data when you visit leonthe.com (the “Site”), create an account, place an order or contact us.

1. Who we are

The controller of your personal data is:

Company name: LEONTHE STORE S.R.L.
Tax ID (CUI): RO54770653
Trade Register No.: [TRADE REGISTER NO.]
Registered office: Sat Zănești, Comuna Zănești, Strada Luminii, Nr. 1, Neamț County, Romania
E-mail for personal data requests: contact@leonthe.com

We have not appointed a Data Protection Officer (DPO), as we are not legally required to. For any question about your data, please write to the e-mail address above.

2. What data we collect

Data you provide directly

Identification and contact data: first and last name, e-mail address, phone number.
Delivery and billing data: delivery address, billing address and, where applicable, company details.
Account data: e-mail address, password (stored encrypted by Shopify), order history.
Communication data: messages sent by e-mail, WhatsApp or the contact form.
Marketing preferences: whether you have subscribed to our newsletter.

Data collected automatically

Device and browsing data: IP address, browser type and version, time zone, pages and products viewed, search terms, the page that referred you to the Site and how you interact with the Site.
This data is collected through cookies, pixels and similar technologies, some of them only with your consent (see section 9).

Payment data

Online payments are processed by Shopify Payments, by card (Visa, Mastercard, Maestro, American Express, UnionPay) or digital wallet (Apple Pay, Google Pay, Shop Pay). LEONTHE has no access to your full card number and does not store card data. We only receive limited transaction information, such as payment status, card type and the last four digits.

3. Why we use your data and on what legal basis

We process your data only for specific purposes, each with a legal basis under Regulation (EU) 2016/679 (the “GDPR”).

Purpose	Data used	Legal basis (GDPR)	How long we keep the data
Processing and delivering orders, order-related communication	identification, contact, delivery, order	performance of a contract, Art. 6(1)(b)	for the duration of the order and warranty, then as required by law
Invoicing and accounting records	identification, billing, order	legal obligation, Art. 6(1)(c)	for the periods required by accounting legislation (currently up to 10 years)
Managing your customer account	e-mail, password, order history	performance of a contract, Art. 6(1)(b)	until the account is deleted or after 3 years of inactivity
Customer support, returns, complaints	contact, order, message content	performance of a contract and legitimate interest, Art. 6(1)(b) and (f)	3 years after the request is resolved
Newsletter and e-mail offers	e-mail, name, preferences	consent, Art. 6(1)(a)	until you unsubscribe or after 3 years of inactivity
Site usage analytics (Google Analytics)	browsing and device data	consent, Art. 6(1)(a)	as shown in the cookie table; Google Analytics data is kept for 14 months
Personalised advertising and remarketing (Meta, Google Ads, Pinterest)	browsing data, ad interactions, hashed e-mail for audiences	consent, Art. 6(1)(a)	as shown in the cookie table and platform settings
Fraud prevention and Site security	IP address, transaction data	legitimate interest, Art. 6(1)(f)	per Shopify’s policy, usually from a few hours to a few days
Defending our rights in case of a dispute	data relevant to the dispute	legitimate interest, Art. 6(1)(f)	for the applicable limitation period

Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. For the newsletter, use the unsubscribe link in any e-mail. For cookies, use the cookie banner settings on the Site.

We only send newsletters and offers if you have actively subscribed, by ticking the box at checkout or through the sign-up form on the Site. The box is never pre-ticked. Newsletters are sent through Mailchimp. You can unsubscribe at any time with one click, using the link at the end of every e-mail.

If you have consented to marketing cookies, we may use your e-mail address, converted into an encrypted code (hash), to build custom audiences in Meta Ads. You may object to this at any time by writing to contact@leonthe.com.

We do not sell your personal data. We share it only with the following partners, to the extent necessary for the purposes above:

Recipient	Role	Main location
Shopify International Ltd.	online store platform, hosting, customer accounts	Ireland, with transfers to Canada and the US
Shopify Payments	processing card and digital wallet payments	EU, with transfers to the US
DHL	order delivery	EU and the destination country
Google Ireland Ltd. (Google Analytics, Google Ads)	analytics and advertising	Ireland, with transfers to the US
Meta Platforms Ireland Ltd. (Meta Pixel, Facebook, Instagram, WhatsApp)	advertising, remarketing, customer communication via WhatsApp	Ireland, with transfers to the US
Pinterest Europe Ltd.	advertising	Ireland, with transfers to the US
Intuit Mailchimp	sending newsletters	US
Advisers (accountant, lawyer) and public authorities	legal obligations, defending our rights	Romania

For data collected through the Meta Pixel, LEONTHE and Meta Platforms Ireland Ltd. are joint controllers for the collection and transmission of data to Meta. Meta’s further processing is governed by the Meta Privacy Policy.

We may also disclose data where required by law, for example in response to a lawful request from an authority.

6. Transfers outside the European Economic Area

Some of our partners process data outside the EEA, particularly in the US and Canada. These transfers take place only with appropriate safeguards:

for the US, under the EU-US Data Privacy Framework where the partner is certified, or under the Standard Contractual Clauses approved by the European Commission;
for Canada, on the basis of the European Commission’s adequacy decision.

You may request details of these safeguards at contact@leonthe.com.

7. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Our partner Shopify uses limited automated mechanisms to prevent fraud, which have no such effects: a temporary block, lasting a few hours, of IP addresses associated with repeated failed transactions, and a temporary block, lasting a few days, of cards associated with those IP addresses.

8. Your rights

Under the GDPR, you have the following rights:

the right of access to the data we hold about you;
the right to rectification of inaccurate or incomplete data;
the right to erasure, except for data we are legally required to keep, such as invoices;
the right to restriction of processing;
the right to data portability;
the right to object to processing based on legitimate interest and, at any time, to processing for direct marketing;
the right to withdraw your consent at any time;
the right to lodge a complaint with a supervisory authority.

To exercise your rights, write to us at contact@leonthe.com. We will reply within one month of receiving your request; this period may be extended by two further months for complex requests, in which case we will inform you. We may ask for additional information to confirm your identity.

The supervisory authority in Romania is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28–30, Sector 1, Bucharest, www.dataprotection.ro. If you live in another EU member state, you may also contact the authority in your country.

9. Cookies and similar technologies

Cookies are small files stored on your device when you visit the Site. We use strictly necessary cookies without consent, because the store cannot work without them. Analytics and marketing cookies are only placed after you agree to them in the cookie banner. You can change or withdraw your choice at any time from the banner settings.

Strictly necessary cookies

Name	Provider	Purpose	Duration
_tracking_consent	Shopify	stores your cookie preferences	1 year
cart, cart_sig, cart_ts	Shopify	shopping cart functionality	2 weeks
checkout_token, secret	Shopify	checkout	session – 1 year
_secure_session_id	Shopify	navigating the store	24 hours
secure_customer_sig, storefront_digest, _shopify_u	Shopify	customer login and account updates	up to 1 year
_ab	Shopify	access to store administration	session

Analytics cookies (consent only)

Name	Provider	Purpose	Duration
_shopify_y, _shopify_s, _shopify_sa_p, _shopify_sa_t, _landing_page, _orig_referrer	Shopify	statistics on visits, traffic sources and landing pages	30 minutes – 1 year
_ga, _ga_ID	Google Analytics	statistics on Site usage	2 years

Marketing cookies (consent only)

Name	Provider	Purpose	Duration
_gcl_au	Google Ads	measuring ad conversions	90 days
_fbp, _fbc	Meta	personalised advertising and remarketing on Facebook and Instagram	90 days
_pin_unauth, _pinterest_ct_ua, _epik, _derived_epik	Pinterest	personalised advertising and conversion measurement	1 year

You can also manage cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Site from working.

You can also adjust your ad preferences directly in your accounts: Google, Meta, Pinterest.

10. Minors

The Site is not intended for persons under 16 and we do not knowingly collect their data. If you are a parent or guardian and believe a child has provided us with data, contact us at contact@leonthe.com to have it deleted.

11. Data security

We apply appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS), access restricted to the people who need the data, and providers that meet recognised security standards, including PCI DSS for payments.

12. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The current version is always available on the Site, with the date of the last update. We will inform you of significant changes by e-mail or through a notice on the Site.

13. Contact

For any question about this policy or your data, you can contact us at contact@leonthe.com or by post at: LEONTHE STORE S.R.L., Sat Zănești, Comuna Zănești, Strada Luminii, Nr. 1, Neamț County, Romania.

Last updated: october 2026