Privacy Policy (GDPR)
Last updated: 31.08.2026
1. Who we are
MPR GROUP S.R.L., with its registered office at Str. Borzești no. 12/A, Târgu Mureș, Mureș County, Romania, Trade Register no. J26/970/2023, tax identification number RO48381201, is the controller of the personal data collected through neat-society.com.
Contact for anything relating to your data: contact@mprfamily.com, phone +40 730 711 870.
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
2. What data we collect
Data you give us directly:
- identification and contact details: first name, last name, e-mail, phone number;
- delivery address and billing address;
- business billing details for companies: company name, VAT/tax number, registration number, bank, IBAN;
- the content of messages sent through the contact form or by e-mail;
- account details, if you create an account;
- confirmation that you are over 18.
Data collected automatically:
- IP address, device type, browser and operating system;
- pages visited, time spent, traffic source;
- cookie identifiers and similar technologies (see section 7).
What we do not collect: we do not store full payment card details. Card payments are processed entirely by the authorised payment processor.
We do not intentionally process special categories of data (health, beliefs, ethnic origin and similar), and we ask you not to send us such information through the Site's forms.
3. Why we process your data and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Taking, processing and delivering your order | performance of a contract – Art. 6(1)(b) |
| Issuing invoices and keeping accounting records | legal obligation – Art. 6(1)(c) |
| Verifying that you are 18 or over | legal obligation – Art. 6(1)(c) |
| Handling returns, withdrawals and complaints | contract / legal obligation |
| Creating and managing your account | performance of a contract – Art. 6(1)(b) |
| Responding to enquiries sent by e-mail or form | legitimate interest – Art. 6(1)(f) |
| Newsletter and marketing communications | consent – Art. 6(1)(a) |
| Analytics and marketing cookies | consent – Art. 6(1)(a) |
| Fraud prevention and Site security | legitimate interest – Art. 6(1)(f) |
| Establishing, exercising or defending legal claims | legitimate interest – Art. 6(1)(f) |
Providing the data needed for delivery and invoicing is necessary to enter into the contract; without it we cannot process your order.
4. How long we keep your data
- Order and invoicing data: 10 years from the end of the financial year, under accounting and tax law.
- User account: for as long as the account exists, plus 3 years from the last activity.
- Marketing data (newsletter): until you withdraw consent, or a maximum of 3 years from your last interaction.
- Correspondence and complaints: 3 years from resolution.
- Traffic data and cookies: as set out in section 7.
- Withdrawal confirmations: 3 years from the date of the request.
Once these periods expire, data is deleted or irreversibly anonymised.
5. Who we share data with
We share data, strictly on a need-to-know basis, with:
- courier companies – to deliver your order;
- payment processors – to collect payment;
- our e-commerce platform and hosting provider (Shopify Inc. and its sub-processors);
- e-mail marketing and web analytics providers, where you have given consent;
- our accountants, legal advisers and auditors;
- public authorities, where they make a lawful request.
We do not sell your data and we do not pass it to third parties for their own marketing purposes.
6. Transfers outside the EEA
Some providers (for example the e-commerce platform or analytics tools) may process data outside the European Economic Area. Where this happens, the transfer is based on an adequacy decision of the European Commission or on Standard Contractual Clauses approved by the Commission, together with supplementary technical measures. You can request a copy of the safeguards in place by writing to contact@mprfamily.com.
7. Cookies
We use strictly necessary cookies (cart, session, consent preferences), analytics cookies and marketing cookies. Cookies that are not strictly necessary are set only after you consent through the cookie banner.
You can change or withdraw your choices at any time from the cookie settings window available on the Site or in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
Details of each cookie, its provider and its lifetime are set out in the Cookie Policy.
8. Your rights
As a data subject you have the right:
- of access to the data we process about you;
- to rectification of inaccurate or incomplete data;
- to erasure ("right to be forgotten"), where the law allows;
- to restriction of processing;
- to data portability;
- to object to processing based on legitimate interests, including direct marketing;
- to withdraw consent at any time, without affecting the lawfulness of prior processing;
- not to be subject to a decision based solely on automated processing producing legal or similarly significant effects;
- to lodge a complaint with a supervisory authority.
How to exercise your rights: send a request to contact@mprfamily.com. We reply within one month of receipt; this can be extended by up to two further months for complex requests, in which case we will tell you within the first month. Exercising your rights is free of charge; manifestly unfounded or excessive requests may be charged for or refused with reasons.
To prevent disclosure to unauthorised persons, we may ask for additional information to confirm your identity.
Supervisory authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania www.dataprotection.ro · anspdcp@dataprotection.ro
If you live in another EU/EEA country, you may also complain to your local supervisory authority.
9. Data security
We apply appropriate technical and organisational measures: encrypted HTTPS connections, role-based access control, two-factor authentication for administrative accounts, data processing agreements with all providers, and training for everyone with access to personal data. Details are set out in the GDPR Policy.
10. Minors
The Site is intended solely for persons aged 18 and over. We do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data, write to contact@mprfamily.com and we will delete it without delay.
11. Changes
We may update this policy. The version in force is the one published on the Site, with the last updated date shown at the top. We will notify you of substantial changes by e-mail or through a prominent notice on the Site.
