Legal document — GDPR

Privacy Policy

How we collect, use, and protect your personal data, in accordance with Regulation (EU) 2016/679 and Law 190/2018.

Last updated: March 18, 2026

Table of Contents

  1. Data controller
  2. What data we collect
  3. Why we collect data (legal basis)
  4. How long we store data
  5. Who we share data with
  6. Your rights (GDPR)
  7. Cookies
  8. Marketing and newsletter
  9. International transfers
  10. Protection of children
  11. Changes to the policy
  12. Contact DPO / complaints

In short: We do not sell your data to anyone. We only collect what is necessary to process your order and improve your experience on the Site. You have the right to request access to, rectification of, or deletion of your data, within the limits provided by law — write to us at contact@endora.online.

1. The data controller

The personal data controller is Science of Life PHARMA SRL, registered office: Rimler Karoly 29D4, Oradea, 410169, Romania, Tax ID RO49469396, Trade Reg. No. J5/225/2024.

Contact: contact@endora.online | Contact form

2. What data we collect

Data provided directly by you:

  • Account details: first name, last name, email address, password (encrypted)
  • Order details: delivery address, phone number
  • Payment details: processed exclusively by the payment processor (we do not store them)
  • Messages: content of messages sent via the contact form
  • Newsletter: email address, if you have subscribed

Automatically collected data:

  • IP address and browser type
  • Pages visited and session duration
  • Traffic source (referrer, advertising campaign)
  • Cookie data (see section 7)

3. Why we collect data (legal basis)

  • Performance of a contract (Art. 6(1)(b) GDPR): order processing, delivery, order-related communications
  • Legal obligation (Art. 6(1)(c) GDPR): invoicing, tax reporting, ANPC compliance
  • Legitimate interest (Art. 6(1)(f) GDPR): Site security, fraud prevention, service improvement
  • Consent (Art. 6(1)(a) GDPR): marketing newsletter, non-essential cookies

4. How long we store data

  • Order and billing data: 10 years (legal obligation — Fiscal Code)
  • Account data: for the duration of the account's existence + 1 year after deletion
  • Newsletter: until unsubscribed
  • Contact messages: 2 years from the last communication
  • Traffic data (analytics): maximum 26 months

5. Who we share your data with

We do not sell your data. We share data, strictly as necessary, with:

  • Courier: Sameday, FanCurier, DHL, GLS — name, delivery address, phone number, strictly for shipping the parcel
  • Payment processors: Shopify Payments and PayPal — payment data is processed directly by them; we do not store and do not have access to card details
  • Email marketing: Omnisend — email address and order history, exclusively for communications for which you have given your consent
  • Analytics: Google Analytics 4 — anonymized data, without full IP
  • Authorities: ANAF, ANPC, ANSPDCP — when required by law

All partners have contractual GDPR obligations and cannot use the data for any purpose other than the one agreed upon.

6. Your rights (GDPR)

Under GDPR, you have the following rights which you may exercise at any time by writing to contact@endora.online:

Right of access

You can request a copy of the data we hold about you.

Right to rectification

You can correct incorrect or incomplete data.

Right to erasure

You may request the deletion of your data ("right to be forgotten"), where the law allows.

Right to restriction

You may request the restriction of data processing in certain situations.

Right to portability

You can receive your data in a structured, machine-readable format.

Right to object

You may object to processing based on legitimate interest or direct marketing.

We respond to requests within a maximum of 30 calendar days. If you believe your rights have been violated, you have the right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) — anspdcp.eu.

7. Cookies

The site uses cookies for functionality and analysis. Upon your first visit, we request your consent for non-essential cookies.

Category: Essential

Example: session_id, csrf_token

Purpose: Shopping cart functionality and security

Duration: Session

Category: Analytics

Example: _ga, _gid

Purpose: Visitor statistics (Google Analytics 4)

Duration: 26 months

Category: Marketing

Example: _fbp, _gcl_au

Purpose: Relevant ads (Meta, Google Ads)

Duration: 90 days

Category: Preferences

Example: cookie_consent

Purpose: Storing cookie preferences

Duration: 12 months

You can withdraw your consent at any time from your browser settings or from the cookie banner.

8. Marketing and newsletter

We send marketing emails only if you have given your explicit consent upon subscription. You can unsubscribe at any time via:

9. International transfers

Some data (e.g., Google Analytics) may be transferred to the USA. Transfers are carried out with appropriate safeguards: Standard Contractual Clauses approved by the European Commission or applicable adequacy frameworks.

10. Child protection

The site is not intended for and does not collect data from individuals under 18 years of age. If you have indications that a minor has provided us with personal data, please contact us at contact@endora.online for its immediate deletion.

11. Policy changes

We may update this policy periodically. The version in effect is the one published on the Site with the updated date. Significant changes will be communicated via email to users with an account.

12. GDPR contact and complaints

For any request regarding the processing of personal data:

GDPR Email: contact@endora.online
Online form: endora.online/contact/
Supervisory authority: ANSPDCP — anspdcp.eu

Do you have a question regarding your data? Contact us — we will respond within 30 calendar days, in accordance with GDPR.