Privacy policy

PRIVACY POLICY — INGE

Last updated: 31 August 2026

1. WHO WE ARE

INGE operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services").

The controller of your personal data is:

INGE DESIGN SRL, trading as INGE
Registered office: Drumul Cheile Turzii 125-134,042096, Romania
Sole registration code 50163713
E-mail: contact@ingewear.com |

This Privacy Policy describes how we collect, use, and disclose your personal data when you visit or use the Services, make a purchase or other transaction through the Services, or otherwise communicate with us. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), Law no. 190/2018 and Law no. 506/2004 on the processing of personal data in the electronic communications sector.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy prevails as regards the collection, processing and disclosure of your personal data.

Please read this Privacy Policy carefully. It is provided to you for information purposes under Articles 13 and 14 GDPR; reading it is not a consent to processing. Where we rely on your consent, we ask for it separately and specifically.

2. PERSONAL DATA WE COLLECT

"Personal data" means any information relating to an identified or identifiable natural person. It does not include data that has been anonymised so that it can no longer be linked to you.

Depending on how you interact with the Services, we may process the following categories:

Identity and contact details: name, address, billing address, shipping address, telephone number, e-mail address.
Payment data: transaction details, form of payment, payment confirmation, the last four digits and expiry date of your card, and billing details. We do not store your full card number or CVV; full card data is processed directly by our payment service providers.
Account data: username, password (stored in hashed form), security questions, preferences and settings.
Transaction data: items you view, add to your cart or wishlist, purchase, return, exchange or cancel, and your order history.
Communications: the content of your messages to us, for example a customer support enquiry, a complaint, a withdrawal notice or a conformity claim.
Device and technical data: device, browser and network information, IP address, and other unique identifiers.
Usage data: information about how and when you interact with or navigate the Services.
Reviews and user content, where you choose to publish them.

We do not intentionally collect special categories of personal data (Article 9 GDPR). Please do not send us health data or other sensitive information unless we specifically ask for it.

Providing your identity, contact, delivery and payment data is necessary in order to conclude and perform a purchase contract; without it we cannot process your order. All other data is optional.

3. SOURCES OF PERSONAL DATA

Directly from you, when you create an account, place an order, use the Services, or communicate with us.
Automatically through the Services, from your device when you use the Services, and through cookies and similar technologies (see Section 5).
From our processors and service providers, when they collect or process personal data on our behalf.
From our partners or other third parties, such as payment providers confirming a transaction or carriers confirming a delivery.

4. PURPOSES, LEGAL BASES AND RETENTION PERIODS

Purpose	Legal basis (Art. 6 GDPR)	Retention period
Processing and fulfilling your order; payment; delivery; invoicing	Performance of a contract — Art. 6(1)(b); compliance with a legal obligation for invoicing — Art. 6(1)(c)	For the duration of the contract; accounting and supporting documents are retained for the period required by Law no. 82/1991 on accounting and by tax legislation
Creating and managing your account	Performance of a contract — Art. 6(1)(b)	Until you close your account, plus the applicable limitation period for related claims (generally 3 years)
Handling returns, exchanges, withdrawal requests and conformity claims	Performance of a contract and compliance with legal obligations — Art. 6(1)(b) and (c)	2 years from delivery (statutory guarantee), plus the applicable limitation period
Customer support and responding to your enquiries	Performance of a contract — Art. 6(1)(b); our legitimate interest in handling enquiries — Art. 6(1)(f)	3 years from the last contact
Fraud prevention, authentication, security of the Services and of payments	Legitimate interest in protecting the Services, our customers and ourselves — Art. 6(1)(f); legal obligation — Art. 6(1)(c)	Up to 3 years from the event; longer where required to establish, exercise or defend a legal claim
Sending marketing communications by e-mail or SMS	Your consent — Art. 6(1)(a); for existing customers, our legitimate interest in marketing similar products, subject to your right to object — Art. 6(1)(f) and Art. 6 of Law no. 506/2004	Until you withdraw consent or object; in any event no longer than 3 years of inactivity
Personalised advertising and analytics using cookies and similar technologies	Your consent — Art. 6(1)(a), and Art. 4(5) of Law no. 506/2004	According to the lifetime of each cookie, as set out in our Cookie Policy; consent is refreshed at least every 6 months
Product recommendations and tailoring the store to you	Your consent, or our legitimate interest in improving the Services where the effect on you is minimal — Art. 6(1)(a) or (f)	Until you withdraw consent or object
Publishing your reviews	Your consent — Art. 6(1)(a)	Until you request removal
Improving and developing the Services, statistics and reporting	Legitimate interest in operating and improving our business — Art. 6(1)(f); wherever possible we use aggregated or anonymised data	Up to 2 years in identifiable form
Complying with legal obligations and responding to requests from public authorities	Compliance with a legal obligation — Art. 6(1)(c)	As required by the applicable legislation
Establishing, exercising or defending legal claims	Legitimate interest in defending our rights — Art. 6(1)(f)	Until the claim is finally resolved, plus the applicable limitation period

Where we rely on a legitimate interest, we have carried out a balancing assessment between that interest and your rights and freedoms. You may request further information about that assessment using the contact details in Section 15, and you may object to the processing at any time (see Section 11).

At the end of the applicable retention period, we delete or anonymise the data.

5. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to operate the store, remember your preferences, measure audience and — where you consent — to show you personalised advertising.

Strictly necessary cookies are placed on the basis of Article 4(5) of Law no. 506/2004 without your consent, because they are essential to providing the Services you request. All other cookies (analytics, advertising, personalisation) are placed only after you give your consent through our consent banner. You may withdraw or change your choices at any time through the cookie settings link available in the store footer, with no detriment to you. Refusing non-essential cookies does not prevent you from using the store or placing an order.

Full details of each cookie, its purpose, provider and lifetime are set out in our Cookie Policy [LINK].

6. RECIPIENTS OF PERSONAL DATA

We disclose personal data only where necessary and on an appropriate legal basis, to the following categories of recipients:

Shopify, which hosts the Services (see Section 7).
Processors acting on our instructions under an agreement concluded in accordance with Article 28 GDPR: IT and hosting providers, payment service providers, carriers and fulfilment partners, customer support tools, e-mail and SMS providers, analytics providers, cloud storage providers.
Business and marketing partners, where you have consented to personalised advertising. These partners may act as independent controllers or as joint controllers for that activity and will use your data in accordance with their own privacy notices. You may withdraw your consent at any time.
Third parties you ask us to disclose data to, for example through social media widgets or login integrations.
Our affiliates within our corporate group, where necessary for the purposes set out above.
Professional advisers, auditors, public authorities and courts, where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.
An acquirer or successor, in connection with a merger, acquisition, restructuring or insolvency proceeding, subject to appropriate safeguards and to informing you.

We do not sell your personal data.

A list of the processors we currently use is available on request at contact@ingewear.com.

7. RELATIONSHIP WITH SHOPIFY

The Services are hosted by Shopify. For most processing carried out in the operation of our store, Shopify acts as our processor and processes personal data on our behalf and on our instructions, under a data processing agreement concluded in accordance with Article 28 GDPR.

In addition, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, with other merchants and with Shopify. For those enhanced features, Shopify acts as an independent controller and is responsible for that processing, including for responding to requests to exercise your rights in relation to it. To learn more, and to exercise your rights directly with Shopify, see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

Information you submit through the Services may be transmitted to Shopify and to other recipients which may be located outside Romania; any transfer outside the European Economic Area is subject to Section 8.

8. INTERNATIONAL TRANSFERS

We may transfer, store and process your personal data outside Romania.

Where we transfer personal data outside the European Economic Area, we do so only on one of the following bases under Chapter V GDPR:

an adequacy decision of the European Commission concerning the recipient country;
the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), accompanied where necessary by a transfer impact assessment and supplementary technical and organisational measures;
another mechanism permitted by Articles 46 to 49 GDPR.

You may request a copy of the safeguards applied to a specific transfer by writing to contact@ingewear.com.

9. SECURITY

We implement appropriate technical and organisational measures under Article 32 GDPR, including encryption of data in transit, access controls on a need-to-know basis, hashing of passwords, logging, and contractual confidentiality obligations for our staff and processors.

No security measure is perfect, and information you send to us may not be secure while in transit. We recommend that you do not use unsecured channels to send us sensitive or confidential information, and that you never share your password or other access credentials with anyone.

Where a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you and the National Supervisory Authority for Personal Data Processing (ANSPDCP) in accordance with Articles 33 and 34 GDPR.

10. AUTOMATED DECISION-MAKING AND PROFILING

We do not take decisions based solely on automated processing which produce legal effects concerning you or which similarly significantly affect you, within the meaning of Article 22 GDPR.

We do carry out limited profiling for marketing and personalisation purposes — for example recommending products based on your browsing and purchase history, and automated fraud-risk scoring at payment. Fraud checks may cause an order to be flagged for manual review; no order is refused without human involvement. You may object to profiling for marketing purposes at any time, with immediate effect.

11. YOUR RIGHTS

Under the GDPR you have the following rights in relation to your personal data:

Access (Art. 15) — to obtain confirmation of whether we process your data, a copy of it, and information about the processing.
Rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed.
Erasure (Art. 17) — to have your data deleted, where one of the grounds in Article 17 applies.
Restriction of processing (Art. 18) — to have processing restricted in the situations listed in Article 18.
Data portability (Art. 20) — to receive the data you provided to us, in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where processing is based on consent or on a contract and carried out by automated means.
Objection (Art. 21) — to object to processing based on our legitimate interests. Where you object to processing for direct marketing purposes, including profiling for that purpose, we will stop immediately and unconditionally.
Withdrawal of consent (Art. 7(3)) — at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it.
Not to be subject to a decision based solely on automated processing (Art. 22), as described in Section 10.
To lodge a complaint with a supervisory authority and to an effective judicial remedy (Art. 77 and 79).

How to exercise your rights. Write to us at contact@ingewear.com, or use the options available in your account and in our e-mails. We will respond within one month of receiving your request. That period may be extended by up to two further months where the request is complex or where we receive a number of requests, in which case we will inform you within the first month and explain why. Exercising your rights is free of charge; we may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive, in particular because of its repetitive character, and we will explain our reasoning.

We may ask you for additional information to confirm your identity where we have reasonable doubts, in accordance with Article 12(6) GDPR — but only what is strictly necessary. You may ask a person to act on your behalf; we will require proof of their authorisation.

12. COMPLAINTS

If you have a complaint about how we process your personal data, please contact us first at contact@ingewear.com. We will acknowledge your complaint and respond without undue delay.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru no. 28-30, 010336 Bucharest, Romania, anspdcp@dataprotection.ro, www.dataprotection.ro — or with the supervisory authority of your habitual residence or place of work, and to seek a judicial remedy before the competent courts. A list of the European supervisory authorities is available here.

Contacting us first is not a condition for lodging a complaint.

13. CHILDREN'S DATA

The Services are not intended for use by children. We do not knowingly collect personal data relating to persons under 16 years of age, and an account may only be created by a person of at least 18 years of age. Where processing is based on consent and relates to an information society service offered directly to a child under 16, that consent must be given or authorised by the holder of parental responsibility, in accordance with Article 8 GDPR.

If you are the parent or guardian of a child who has provided us with personal data, please contact us at contact@ingewear.com and we will delete it without undue delay.

14. THIRD-PARTY WEBSITES AND LINKS

The Services may include links to websites or other online platforms operated by third parties. If you follow links to sites that are not affiliated with or controlled by us, we recommend that you review their privacy and security policies and other applicable terms. We are not responsible for the privacy or security practices of such sites, or for the accuracy, completeness or reliability of information found on them.

Information you publish in public or semi-public spaces, including on third-party social media platforms, may be visible to other users of the Services and of those platforms. Our inclusion of such links does not, in itself, imply any endorsement of the content of those platforms or of their owners or operators.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time, including to reflect changes in our practices or for operational, legal or regulatory reasons. We will publish the revised version on this website and update the "Last updated" date.

Where a change materially affects you — for example a new purpose of processing or a new category of recipient — we will inform you in advance by a durable means, such as e-mail or a prominent notice in the store, and, where the new processing requires your consent, we will ask for it before we begin.

16. CONTACT

For any question about this Privacy Policy or our processing of personal data, or to exercise any of your rights, contact us at contact@ingewear.com or at the address in Section 1. For the purposes of the applicable data protection legislation, we are the controller of your personal data.