Privacy Policy

1. Controller and contact

The controller of your personal data is LAVALI ONLINE SHOP SRL (CUI 48870445, J2023006383236), which trades under the commercial name AI Soft România (hereinafter “AI Soft România”). You can reach us at contact@giaconnect.com or through the page “Company details and contact” of the Legal Center. This policy explains what personal data we process on GIA Connect and FTR 2050, why, on what legal basis, for how long, with whom we share it and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Romanian law.

2. Who this policy is for

The platform is only for people aged 18 or over. We do not knowingly collect data from minors; an account declared under 18 is blocked, and if you think a minor has registered, tell us and we will remove the data.

3. What data we collect, why and on what basis

The list below follows what the platform really does. Where we write “contract” we mean the processing needed to provide the service you ask for (GDPR art. 6(1)(b)); “legal obligation” is art. 6(1)(c); “legitimate interest” is art. 6(1)(f), after weighing it against your interests; “consent” is art. 6(1)(a).

• Account and sign-in: email address, password (kept only as a protected hash, never in clear), display name, language, account status, date of the last sign-in, your two-factor authentication secret (kept encrypted) and backup codes (kept only as hashes), the devices you marked as trusted. Purpose: to create and secure your account and to let you sign in. Basis: contract; security of the account is also our legitimate interest.
• Profile: full name, city, country and your age, which you give when you first sign in, and the avatar you choose. Purpose: to show your name on your own profile and on your certificate, to apply the 18+ rule and to show rankings (only the initials of your name, in capitals, appear to other collectors). Basis: contract and, for the age declaration, our legal duty to keep the platform for adults.
• Orders, payments and invoices: billing name, billing address, city, country, postal code, email for the invoice, optional phone number, the content of the order, the amount and currency, the status and identifier of the payment, the IP address at checkout and the consents you ticked at checkout, with date and time. Your card details are entered only on the payment processor’s page and never reach us. Purpose: to take and deliver your order, to issue invoices, to handle refunds and disputed payments and to keep accounting records. Basis: contract and legal obligation (accounting and tax law).
• Your collection and activity on the platform: the cards you own and their history (a record that is only added to, never erased), packs opened, points, destroyed cards, trades, check-ins, quiz answers, badges, bonuses received, notifications. Purpose: to run the collection, to show your album and certificates and to keep the verifiable history of every copy. Basis: contract; the history of copies is also our legitimate interest in the integrity of the collection.
• Forum and messages you write: the text you post, when, your display name, reports you make and the moderation actions taken, with the reason. Purpose: to run the forum and to enforce the community rules. Basis: contract (the forum service) and legitimate interest (moderation).
• Security and fair use: IP address, a device identifier saved in a cookie at registration (kept as a hash), the browser identification sent with some actions, counters of attempts (sign-in, registration). Purpose: to prevent fraud, abuse, multiple accounts and bonus abuse, and to protect the accounts. Basis: legitimate interest in the security and fairness of the platform.
• Sign-in with Google or Facebook, if you choose it: we receive from the provider only your name, your email address (which the provider confirms) and a provider identifier. Purpose: to create or link your account and sign you in. Basis: contract (and your choice). We do not receive your password or other profile data.
• Address suggestions at checkout: the text of the address you type is sent from our server to OpenStreetMap-based services (Photon and Nominatim) to suggest and complete the address; your IP address, account and identity are not sent. Answers are kept in a cache for up to 30 days. Purpose: to help you fill in the billing address correctly. Basis: contract.
• Emails and notifications: we send emails needed for the service (activation, password reset, order, refund and security messages) and, only as described below, optional ones (a weekly reminder of the free check-in, a notice when a new collection or series launches, a notice when a trade or a collector matches what you miss). Basis: contract for service emails; for the optional ones, your choice in the account settings and an unsubscribe link in each email, which stops them at once.
• Messages you send us: the content of your message and your contact details, to answer you. Basis: legitimate interest and, where you ask for something, contract.
• Partner stores: if you scan the QR code on the poster of a partner store, we keep the store’s code in a cookie (gia_pstore) until you create an account. If you create a new account, we link the account to the store for life, so that we can calculate the store’s reward on your paid purchases; if you already have an account, scanning only gives you the free card, and we note the week you took it. The store receives only totals (how many accounts signed up and the value of the reward), never your name, email or orders. If you represent a partner store, we process the company and contact person details, the accepted agreement (with date, version and IP address) and the uploaded invoices. Basis: contract (the gift and the partner program), legitimate interest (relations with partners) and legal obligation (invoices).
• Cookies and local storage: see the Cookie Policy.

We do not use your data for advertising profiles and we do not sell it.

4. How long we keep it

Account and collection data: while the account exists; when it is closed the personal data is anonymized (the account then appears as “deleted account”), while the history of copies stays, without identifying you. Invoices, orders and payment records: for the period required by accounting and tax law (usually between 5 and 10 years). Records of the consents you gave: while the account exists and afterwards for as long as we may need to prove them. Counters of attempts and similar technical data used for security: usually 48 hours; security data: for a limited period needed for security. Sessions: up to 30 days; the “trusted device” mark: 30 days. Address suggestions: 30 days. Forum messages: while the forum exists, shown as “deleted account” after anonymization. These are the usual periods; where the law requires a different one, the law applies.

5. Who receives your data

We share data only as needed: the payment processor Netopia (payments in lei), the invoicing service Oblio (issuing and sending invoices, including e-Factura to the tax authority), the email sending provider, the hosting provider, Google or Facebook (only if you sign in with them), the OpenStreetMap-based address services (only the address text), and authorities when the law requires it. Payment processors and the invoicing service also have their own obligations as controllers for the data they must keep by law. If we activate another payment processor, such as Stripe, for other countries, we will name it here. We do not give your data to advertisers.

6. Transfers outside the European Economic Area

Our providers store data in the European Union where possible. If you sign in with Google or Facebook, data goes to those providers, which may process it in the United States; they rely on the EU–US Data Privacy Framework or on standard contractual clauses. The address services may be run outside the EU (for example in the United Kingdom, which has an adequacy decision). Where another transfer is needed we use the safeguards required by the GDPR.

7. Your rights and how to use them

You have the right of access, rectification, erasure, restriction, portability, objection (especially to processing based on legitimate interest) and the right to withdraw a consent you gave, at any time, without affecting the earlier processing. To use them, write to contact@giaconnect.com from the email of your account, and we answer within one month (it can be extended in complex cases, and we tell you). For erasure we anonymize your account and keep what the law forces us to keep (invoices and payment records) and the history of copies, which no longer identifies you. You can change your profile and notifications in your account settings.

8. Complaints

If you think we processed your data unlawfully you can complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro) or go to court. We would be glad if you contact us first.

9. Security

We protect your data with measures such as encrypted connections, passwords stored only as hashes, encrypted two-factor secrets, limits on sign-in attempts, access restricted to the staff who need it, a separate admin session with optional two-factor authentication, and an append-only history of important operations. No system is perfectly secure: if a breach puts your rights at risk we notify you and the authority as the law requires.

10. Automated decisions and AI

We do not take decisions that affect you only by automated means, and we do not use AI to run the site (allocating the cards, statistics and moderation use classic rules). The contents of the packs are random, decided by our server. See the page on the use of AI for how the images were created.

11. Changes to this policy

We update this policy when the platform or the law changes. Every version has a date; earlier versions are archived and can be consulted in the Legal Center. For important changes we tell you on the site or by email.

12. Contact

contact@giaconnect.com and the page “Company details and contact” of the Legal Center.