Privacy policy.

Last updated: October 2026

This English version is a translation provided for convenience. In the event of any discrepancy between this translation and the Romanian version, the Romanian version prevails.

Data controller

EVEN DECO is the brand under which ANAMAR ASIA CARGO S.R.L. operates. We have not appointed a data protection officer; all requests should be sent to the email address above.

What data we collect and why

Visiting the website

The website and the virtual assistant’s server are hosted by Cloudflare. When you open a page, Cloudflare receives, as with any website, your IP address and technical information about your browser, which are needed to send you the page and the assistant’s script. Fonts are loaded from our own website. Apart from Cloudflare, no third party receives data when pages load, with one exception: on the reviews page, the photos in published reviews are loaded directly from Supabase, which therefore receives your device’s IP address. Legal basis: our legitimate interest in displaying the website, customer reviews and the virtual assistant correctly and securely. You can find details about storage in the browser in the Cookie policy.

The virtual assistant

The virtual assistant on the website is an artificial intelligence program. When you write to it, we process what you write in the conversation and the assistant’s replies. To formulate a reply, the recent conversation is sent to Anthropic, the provider of the artificial intelligence model. Anthropic does not use this content to train its models and deletes it automatically within 30 days at most. The exception is content flagged for breaching its usage policies, which may be kept for up to 2 years.

The same assistant also answers questions written in the “Ask us anything” box on the Frequently asked questions page. There we process only the question you write and the assistant’s answer: the question is sent to Anthropic, under the same conditions as conversation messages, and nothing is saved in your browser.

We do not keep conversations on our servers. The exceptions are the list of unanswered questions and the conversation that you choose to send us together with a quote request (details below). In your browser, the conversation remains saved so that it is not lost if you reload the page. 24 hours after the last message, the conversation expires and is deleted from the browser the next time the website is opened. You can delete it at any time with the “Delete conversation” button.

Replies are generated automatically and are for information only. We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. Quotes are prepared by members of our team. Please do not write sensitive data in the conversation or in the box, such as your personal numeric code (CNP), bank details or health information. Legal basis: steps taken at your request prior to entering into a contract.

Unanswered questions

When the assistant’s reply, in the conversation or in the “Ask us anything” box, contains wording that may indicate that a piece of information is missing from the catalogue (for example “we will check and confirm”, “we don’t have that information”, “it is not listed in our catalogue” or “our catalogue is flexible”), or when the assistant indicates that the information is not in the catalogue, we automatically keep the question and the beginning of the reply, in order to complete the catalogue. Phone numbers and email addresses written in the usual format are removed automatically before saving; please do not write them in the conversation or in the box (use the form for a quote). We keep these records for no more than 90 days. Legal basis: our legitimate interest in completing the catalogue.

Quote requests

You can request a quote through two “Quote request” forms. Through the one on the Contact page you send us your name, phone number, the town or city of the event or delivery, your email address (optional), the product category chosen (optional) and the details of your request. Through the virtual assistant’s form you send us your name, phone number, the town or city of the event or delivery, your email address (optional) and the details of your request, together with the codes of the products discussed, a summary of the request prepared by the assistant from the conversation (the products, quantities, type and date of the event, location and contact details, if you wrote them in the conversation) and the conversation up to that point. The request is sent to us by email, at contact@evendeco.ro, using the Resend service, which keeps messages and sending logs for approximately 30 days; we do not keep it on our server. The purpose is to prepare the quote and to conduct the business relationship. Legal basis: your consent, given by ticking the box in the form, and steps taken at your request prior to entering into a contract.

WhatsApp

The WhatsApp buttons on the website are plain links: nothing is sent until you click or tap them. The “or send it on WhatsApp” button in the form on the Contact page does not send us anything through the website: it composes a WhatsApp message with the data entered in the form (your name, phone number, town or city, email, category and details) and opens it in WhatsApp, where you can edit it before sending. The messages prepared by the virtual assistant work in the same way; they contain what you said in the conversation about your request: the products, quantities, event, location and, if you wrote them, your name, phone number and email. Once you press the button, the prepared text goes to WhatsApp.

WhatsApp Ireland Limited is the controller for your WhatsApp account, and EVEN DECO is the controller for the messages it receives from you. Legal basis for the messages received: steps taken at your request prior to entering into a contract.

Phone and email

If you call us or write to us at contact@evendeco.ro, we process your phone number, email address and what you tell us, in order to reply to you and, on request, to prepare a quote for you. Legal basis: steps taken at your request prior to entering into a contract or, for other messages, our legitimate interest in replying to you.

Reviews

If you leave a review, we process the displayed name, the rating, the text and, optionally, a photo. Before it is sent, the photo is converted in your browser, which removes location data from the file. Reviews are stored with Supabase. The photo is saved when the review is sent, at an address that is hard to guess, and is displayed on the website only after the review has been approved. Nothing appears on the website before approval; once approved, the name, rating, text and photo are public.

We keep a published review until you withdraw it. On request, we delete the review and the photo. Reviews that we do not publish are deleted, together with the photo, within 30 days of being sent. The legal basis is your consent, which you give by sending the review; next to the form, we tell you what becomes public.

Orders

To deliver the order, we process your name, phone number and delivery address, on the basis of the performance of the contract; when the order is delivered by courier, this data also reaches the courier company. For invoicing, we process the necessary identification and billing data, on the basis of our legal accounting and tax obligations.

Catalogue search

The search on the website (the magnifying glass in the menu and the field on the Products page) finds products directly in your browser. To learn what customers are looking for and what is missing from the catalogue, our server receives the text searched for, the number of results and, if you open a product from the results, its code, once per page opened for the same text. We do not receive names or cookies. Like any request on the internet, the request also contains your IP address, which we use only to limit abuse (see “Preventing abuse”): so that the same text is not counted too many times from the same network, we keep, for no more than 24 hours, a counter whose name is a cryptographic fingerprint of the day, the network (the first part of the IP address) and the text, in which neither the address nor the text appears in plain text. The text searched for is never saved together with the IP address. Before saving, email addresses, links and long numbers (for example, phone numbers) are replaced automatically; please do not write personal data in the search. We keep only daily totals for each text searched for (how many times it was searched for, how many times it had no results and which products were opened from the results), for no more than 26 months. Legal basis: our legitimate interest in learning which products interest customers.

Preventing abuse

We use your IP address to limit the number of messages to the assistant, forms (quote requests, reviews) and searches sent within a short time from the same address or from the same network. Also for protection, the IP address is sent to Cloudflare Turnstile, together with a verification code. Turnstile processes the IP address, the fingerprint of the secure connection (TLS) and the browser type in order to tell people apart from automated programs. Cloudflare also uses this data on its own behalf, as an independent controller, to improve its bot detection system.

Records linked to the IP address are deleted automatically at the end of the time interval for which they were created, within 24 hours at most. The technical logs of the assistant’s server are kept for a few days (no more than 7) and do not contain the text of messages or the personal data from forms. Legal basis: our legitimate interest in protecting the website and in preventing costs caused by abuse.

Statistics

Without collecting data about visitors, we count how many conversations, questions in the “Ask us anything” box, quote forms and reviews we receive, and which products visitors ask about. In Google Search Console we also see aggregated data, calculated by Google, about the searches in which the website appeared (the search terms, the number of clicks and impressions), without data that identifies visitors. We do not use cookies, tracking scripts or advertising. Legal basis: our legitimate interest in learning which products interest customers.

Which data is mandatory

• Quote forms: your name, phone number and the town or city of the event or delivery are mandatory, as are, in the form on the Contact page, the details of the request; without them the request cannot be sent and we cannot send you a quote. The email address and the product category are optional.
• Review form: the name and the text are mandatory; without them the review cannot be sent. The photo is optional.
• Orders: billing data is required by law, and delivery data is necessary for the performance of the contract; without it we cannot issue the invoice or deliver the order.

Who we share data with

• Cloudflare, Inc. (USA) — hosting of the website, the virtual assistant’s server, bot verification (Turnstile) and forwarding of emails sent to contact@evendeco.ro.
• Anthropic — the provider of the artificial intelligence model that formulates the assistant’s replies. In the European Economic Area, the service is provided by Anthropic Ireland, Limited.
• Resend (Plus Five Five, Inc., USA) — sending quote requests by email.
• Supabase Pte. Ltd. (Singapore) — storage of reviews and photos.
• Email providers — host the mailboxes that receive the messages sent to contact@evendeco.ro and copies of quote requests.
• WhatsApp — only when you choose to message us on WhatsApp.
• Our IT provider — the person who maintains the website and the virtual assistant; the Anthropic service is contracted through their account. They have technical access to the assistant’s data, including the list of unanswered questions, and act only on our behalf, as a processor.
• Courier companies — strictly for delivering the order.
• Public authorities — when we are required to do so by law.

We do not sell your data or rent it out.

Transfers outside the European Economic Area

Some of the providers above process data outside the European Economic Area. Transfers are protected as follows:

• Cloudflare — USA. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses adopted by the European Commission apply.
• Anthropic — USA and, possibly, other countries. Transfers are made on the basis of standard contractual clauses.
• Resend — USA. Resend is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses apply.
• Supabase — data is stored on servers in the region we have chosen, and transfers are covered by standard contractual clauses.
• WhatsApp — WhatsApp Ireland Limited may transfer data to WhatsApp LLC and Meta Platforms, Inc., in the USA, on the basis of the EU-US Data Privacy Framework certification and standard contractual clauses.

You can obtain a copy of the safeguards applicable to these transfers (the standard contractual clauses) by writing to us at contact@evendeco.ro.

How long we keep data

• The conversation with the assistant, in your browser: it expires 24 hours after the last message and is deleted the next time the website is opened; you can delete it earlier at any time.
• Conversations sent to Anthropic: deleted automatically within 30 days at most; content flagged for breaching the usage policies may be kept for up to 2 years.
• The list of unanswered questions: no more than 90 days.
• Quote requests that do not result in an order, received through the quote forms (the assistant’s or the one on the Contact page), on WhatsApp, by email or by phone: no more than 12 months.
• Messages and sending logs at Resend: approximately 30 days.
• Published reviews and their photos: until you request their withdrawal.
• Reviews that we do not publish, together with their photos: no more than 30 days after being sent.
• Catalogue searches, as daily totals for each text searched for, and the list of texts that we exclude from these statistics (for example, messages unrelated to products): no more than 26 months.
• Anti-abuse records linked to the IP address: no more than 24 hours.
• Technical logs of the assistant’s server: a few days, no more than 7.
• Commercial and accounting documents: for the period required by tax legislation.

Your rights

Under the General Data Protection Regulation (GDPR), you have the right of access to your data and the rights to rectification, erasure, restriction of processing and data portability. You also have the right to withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

Right to object: you may object at any time, on grounds relating to your particular situation, to the processing of your data on the basis of our legitimate interest (Article 21 GDPR).

To exercise your rights, you can write to us at contact@evendeco.ro. We will reply within one month of receiving your request.

You also have the right to lodge a complaint with the supervisory authority:

Security

We apply reasonable technical and organisational measures to protect data. The website uses an encrypted connection (HTTPS), and access to data is limited to our team and, for the part that concerns them, to the providers listed above.

Minors

The website is intended for adults. We do not knowingly collect data from minors.

Changes

When the way we process data changes, we update this page and the date at the top.