Privacy Notice

Who we are

Longauer Zsolt Întreprindere Individuală, a sole trader (întreprindere individuală) registered in Romania (ONRC F2026042954004 · EUID ROONRC.F2026042954004 · CUI 55551589), Str. Puskás Tivadar nr. 25, Sfântu Gheorghe, jud. Covasna, România.

Write to us about anything in this notice at contact@karqa.store. We have not appointed a data protection officer: the law does not require one of a business our size, and naming a role that does not exist would send your question nowhere.

What we collect, and why

If you run a shop on karqa, or have been given access to one:

• Your name, email address and the sign-in details our login provider holds for you — to let you into your shop's back office. We need these to provide the service (GDPR article 6(1)(b)); for someone a shop has given access to, the shop's and our legitimate interest in running it (article 6(1)(f)).
• Your business details — legal name, address, registration and tax numbers, contact phone and email. For a sole trader these are personal data. We use them to provide the service, to invoice you, and because the law requires them on invoices (article 6(1)(b) and (c)).
• Invoices we issue you, payments for your subscription, and the records behind them. Romanian accounting and tax law requires us to keep them and to report invoices to the tax authority (ANAF) through RO e-Factura (article 6(1)(c)). Card details for your subscription go to our payment provider, Stripe; we never see the full card number.
• A record of which version of the Terms of Use and the Data Processing Agreement you accepted, when, and from which account — so we can show what was agreed (article 6(1)(b) and (f)).
• What you do in the back office, recorded with your name where it changes an order or a setting (for example, who marked an order as shipped) or downloads the shop's data. Your shop relies on this trail, and so do we, to resolve disputes and keep the service secure (article 6(1)(f)).
• Messages you send us — feedback, support requests, replies to our emails — to answer them (article 6(1)(b) or (f)).
• Service emails we send you about your shop, your invoices, changes to our prices or terms, and security. These are part of the service, not marketing. We do not currently send marketing emails; if we start, we will ask first where the law requires it, and every one will let you opt out.
• Reports about content in your shop, and our decisions on them, which the Digital Services Act requires us to handle and keep a record of (article 6(1)(c) and (f)).

If you use the contact form on karqa.store or write to us: your name, email address, shop name if you give one, and your message — to reply, and to set up your shop if that is what you asked about (article 6(1)(b) or (f)).

If you report content in a shop to us under the Digital Services Act (karqa.store/report explains how): your name and email address, unless the law lets you report anonymously, your report, and our decision on it — to handle the report as the Digital Services Act requires (article 6(1)(c)).

When you visit karqa.store or use the back office: the technical data any web server receives, such as your IP address and browser, which our hosting provider logs to keep the service running and secure (article 6(1)(f)).

We need the account and business details above to provide the service: without them we cannot open or run a shop for you. Everything else is optional. We do not make decisions about you by automated means alone.

Cookies

karqa.store sets no cookies and runs no analytics or advertising tags. Its fonts and images come from karqa.store itself, so a visit sends nothing to anyone else beyond what any web server receives, which our host, Vercel, processes for us.

The back office stores only what it needs to work: your sign-in session with our login provider, and two conveniences kept in your own browser (whether you have dismissed the setup checklist, and couriers you have typed in before). None of it tracks you, so none of it needs your consent. Its fonts, too, are served by the back office itself.

Who we share it with

Service providers who process it for us, under contracts that bind them to our instructions:

• DigitalOcean — hosts the platform, its database and uploaded files, in Frankfurt, Germany, with backup copies in Amsterdam, the Netherlands;
• Vercel — serves karqa.store, the back office and the shops' storefronts, and runs their server code, including the contact form, in Frankfurt, Germany;
• Okta (Auth0) — signs you in to the back office, and keeps your sign-in details in its EU region (Germany, with failover in Ireland);
• Resend — delivers our emails and the messages sent through the contact form, and receives the mail sent to contact@karqa.store;
• Google (Gmail) — keeps our mailbox, where the mail you send to contact@karqa.store is forwarded;
• Oblio — issues our invoices to you, and sends them to the tax authority (ANAF) through RO e-Factura;
• Stripe — takes payment for your subscription. Stripe is also a controller in its own right for some of this, under its own privacy policy.

Others, only where we must or you ask us to: the Romanian tax authority (ANAF), courts and other authorities where the law requires it; our accountant and lawyers, bound to confidentiality; and, if the karqa business is transferred or incorporated, the business that takes it over, which remains bound by this notice.

We do not sell personal data, and we do not share it for advertising.

Transfers outside Europe

We keep your data in the European Union: the platform and its database are in Frankfurt, Germany, and so is the server code of our websites.

DigitalOcean, Vercel, Okta, Resend, Google and Stripe are based in the United States, so your data may be accessed from there even where it is stored in Europe, for example in logs or for support. Each of them is certified under the EU–US Data Privacy Framework, which the European Commission has found to ensure adequate protection, and each one's terms add the European Commission's Standard Contractual Clauses. Write to us for a copy of the safeguards that apply.

How long we keep it

• Your account and shop: while you use karqa, then for at least 30 days so you can take your data with you, after which we delete it.
• Invoices and the accounting records behind them: for as long as Romanian accounting and tax law requires, even after you leave.
• Records of what you accepted, and the back-office trail: for the life of our contract and then until the general three-year limitation period for claims under it has run.
• Messages and enquiries: until the matter is resolved and any follow-up has ended, then deleted — unless they become part of our contract with you.
• Reports of content, and our decisions on them: until any challenge to the decision has ended, then until the three-year limitation period for claims about it has run.
• Server logs: only as long as needed to keep the service secure, then deleted.

Your rights

You may ask us for a copy of your personal data, and to correct it, delete it, restrict how we use it, or give it to you in a portable form. You may object at any time to our using it on the basis of legitimate interests, and where you have given consent you may withdraw it. Some rights have limits — we cannot delete an invoice the law requires us to keep, for example — and if one applies we will tell you which and why.

Write to contact@karqa.store. We answer within one month, and may ask you to confirm who you are first.

You may also complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority in the EU country where you live or work.

Keeping it safe

Each shop's data is kept apart from every other's, all traffic is encrypted, credentials you give us for other services are encrypted where they are stored, and access is limited to what each person needs. No system is perfectly secure; if a breach puts your data at risk we will tell you, as the law requires.

Changes to this notice

When we change this notice we update the date at the top. If a change matters to how we use your data, we will also tell shop owners by email before it takes effect.