Privacy policy

Last updated: October 1, 2026

This English version is provided for convenience. In case of any difference, the Romanian version prevails.

This policy explains what personal data we process when you visit happynest.ro, place an order or subscribe to our newsletter, why we process it and what your rights are under Regulation (EU) 2016/679 (“GDPR”) and applicable Romanian law.

1. Data controller

HAPPY NEST PLAYLAND S.R.L.
Tax ID (CIF) 51444822 · Trade Register No. J2025018037002
Registered office: Sat Salicea, Com. Ciurila, No. 104G, postal code 407236, Cluj County, Romania
Email: contact@happynest.ro

For any question about your personal data, email us at contact@happynest.ro.

2. What data we process

  • Identification and contact data: first and last name, email address, phone number, delivery and billing address (and, for companies, company name and tax ID).
  • Order data: products bought, order value, payment method chosen, order and return history, the IBAN you give us for refunds.
  • Payment data: card payments are handled by the payment processor; we do not see or store full card details.
  • Account data: the email address used to sign in, saved addresses and your favorites list.
  • Communications: messages you send us through the contact form or by email, and published reviews.
  • Technical and browsing data: IP address, device and browser type, pages visited and information collected through cookies, as described in our Cookie policy.

We do not knowingly collect data about children. The Site is intended for parents and adults shopping for children.

3. Why we process data and on what legal basis

  • Processing and delivering orders, handling returns and complaints: performance of the contract (art. 6(1)(b) GDPR).
  • Invoicing and accounting records: compliance with legal obligations (art. 6(1)(c) GDPR).
  • Replying to your messages: our legitimate interest in communicating with you or, where applicable, performance of the contract.
  • Asking for a review after your order is delivered (one email and at most two reminders, sent through Loox): our legitimate interest in hearing from customers. You can object at any time through the unsubscribe link in the email.
  • Newsletter and marketing communications: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time through the unsubscribe link in every email.
  • Site security and fraud prevention: our legitimate interest (art. 6(1)(f) GDPR).
  • Statistics, improving the Site and personalized advertising: your consent, given through the cookie banner.
  • Defending our rights in any disputes: our legitimate interest.

4. Who we share data with

We do not sell your data. We share it only as needed with:

  • Shopify, the platform the store runs on (hosting, cart, payments, order emails). See the Shopify privacy policy;
  • the payment processor, for card payments;
  • courier companies, to deliver parcels and collect cash on delivery;
  • Loox, the service we use to collect and display reviews;
  • accounting, IT and email marketing providers acting on our instructions;
  • public authorities, where the law requires it.

Some of these providers may process data outside the European Economic Area. In those cases, transfers rely on a European Commission adequacy decision or on the standard contractual clauses approved by the Commission.

5. How long we keep data

  • order and invoice data: for the period required by accounting law (currently 5 years for supporting documents and 10 years for accounting records);
  • account data: until the account is deleted;
  • newsletter data: until you unsubscribe;
  • messages and complaints: as long as needed to resolve them and to defend our rights, within the statutory limitation periods.

6. Your rights

Under the GDPR you have the right of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection (including to direct marketing) and not to be subject to a decision based solely on automated processing. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

To exercise your rights, email contact@happynest.ro. We reply within one month. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, www.dataprotection.ro.

7. Data security

We use appropriate technical and organizational measures to protect data, including encrypted connections (HTTPS) and restricted access. No method of transmission or storage is completely secure, so please do not send us sensitive data through unsecured channels.

8. Changes

We may update this policy. The current version is always available on this page, with the date of the last update.