Privacy Policy

This Privacy Policy describes how SC VLC DIVISION SRL (“Tattoo Wholesale”, “we”, “us”), operating https://tattoowholesale.eu, collects, uses and protects your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

1. Data controller

SC VLC DIVISION SRL, registered office at Str. Rahovei CT 2 (no. 16A), Sibiu, Romania, Trade Registry no. J32/150/2015, VAT ID RO34143366. Contact: order@tattoowholesale.eu.

2. What data we collect

• Account & identity: name, email, phone, optional company name and VAT ID.
• Shipping & billing: street address, city, county/state, postal code, country.
• Order data: products ordered, prices, dates, status.
• Payment data: handled directly by Stripe Payments Europe Ltd. We never store full card numbers.
• Technical data: IP address, browser, device, cookies (see Cookies Policy).

3. Why we use your data (legal basis)

• Contract (art. 6(1)(b) GDPR) — to create your account, process orders, deliver products, handle returns and warranty.
• Legal obligation (art. 6(1)(c)) — invoicing, accounting, tax records.
• Legitimate interest (art. 6(1)(f)) — fraud prevention, securing the site, internal analytics.
• Consent (art. 6(1)(a)) — marketing emails, non-essential cookies. You can withdraw consent at any time.

4. Who receives your data

We share data only with processors who help us run the service:

• Hosting & database: Vercel Inc. (USA, SCC + DPA), Supabase (EU region — Frankfurt).
• Payments: Stripe Payments Europe Ltd. (Ireland).
• Transactional email: Resend (EU region).
• Shipping carriers (e.g. GLS) — only the address fields needed to deliver your order.
• Tax authorities and other public authorities, when required by law.

5. How long we keep your data

• Account data: as long as the account is active, plus 3 years after deletion (statute of limitations).
• Orders & invoices: 10 years (Romanian accounting law).
• Server logs: up to 90 days.
• Marketing consent: until withdrawn.

6. Your rights under GDPR

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data (you can also do this from your profile page).
• Erasure (“right to be forgotten”) — delete your account and personal data, subject to legal retention.
• Restriction of processing.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest, including direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the Romanian Data Protection Authority (dataprotection.ro).

To exercise any of these rights, email order@tattoowholesale.eu. We respond within 30 days.

7. International transfers

Some of our processors may store or process data outside the EU/EEA. In those cases we use Standard Contractual Clauses approved by the European Commission and additional safeguards as required by GDPR Chapter V.

8. Children

Tattoo Wholesale is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

9. Security

We use industry-standard security measures (TLS encryption, hashed passwords, RLS database policies, restricted service-role keys). No system can be guaranteed 100% secure; if you suspect a breach involving your data, contact us immediately.

10. Changes

We may update this Privacy Policy. The latest version is always available on this page, with the “Last updated” date below.