Book a session

Privacy Policy

I. General information

The confidentiality of your personal data is one of the main concerns of GREEN BODY SRL, cu sediul social în Str. Oituz, Nr. 43B, Sat Brănești, Comuna Brănești, Jud. Ilfov, 077030, înregistrată la Registrul Comerțului sub nr. J23/2302/2012, CUI 15017086. (hereinafter referred to as “Green Body SRL”), as a controller of data within the meaning of Regulation (EU) 2016/679 (“GDPR”).

Controller contact details: e-mail office@xsomatic.ro, telephone +40 749 269 691.

This document informs you about the processing of personal data in the context of using the website https://www.xsomatic.ro/ (the “Site”), the online store, forms, the newsletter and measurement / marketing tools.

Last updated: September 2026.

II. Categories of personal data processed

II.1. Customers — we may process: first and last name, telephone, e-mail address, billing address / billing data, order and payment details (without Green Body SRL storing complete card data), order history, correspondence, as well as technical data about Site use (if you have consented to analytics / marketing cookies).

II.2. Visitors — data provided directly (contact form, newsletter) and, after consent, browsing data / online identifiers via cookies and pixels (see the Cookie Policy).

II.3. Newsletter / eBook subscribers — name (if provided), e-mail, the consent given and its date, as well as unsubscribe data.

III. Purposes and legal bases of processing

III.1. Customers — Green Body SRL processes data for:

  • performing the contractual relationship (order, payment, digital delivery / service scheduling, invoicing, informing about order status) — legal basis: performance of the contract (Art. 6(1)(b) GDPR);
  • fulfilling legal obligations (tax, archiving) — legal basis: legal obligation (Art. 6(1)(c));
  • direct marketing by e-mail / SMS — legal basis: consent (Art. 6(1)(a)); unsubscribing is possible at any time;
  • analyses regarding the functioning of the Site (analytics cookies) — legal basis: consent (Art. 6(1)(a)), where required;
  • advertising / remarketing (Meta Pixel, TikTok Pixel, etc.) — legal basis: consent (Art. 6(1)(a));
  • fraud prevention, Site security, defence of rights — legal basis: legitimate interest (Art. 6(1)(f)), balanced against your rights.

III.2. Visitors — we process form data to respond to requests (legitimate interest or pre-contractual steps), and non-essential cookies only on the basis of consent.

IV. Duration of processing

  • Contractual / customer data: for the duration of the relationship and thereafter in accordance with legal obligations (e.g. financial-accounting documents: 10 years).
  • Contact requests: generally up to 12 months from the last exchange of messages, if there is no subsequent contract.
  • Newsletter: until withdrawal of consent / unsubscribe.
  • Cookies / consent preferences: according to the durations in the Cookie Policy (consent preferences: up to 6 months, after which you may be asked for consent again).
  • Security logs: for the period necessary for the purpose, within reasonable limits.

V. Recipients / processors

To fulfil the purposes, Green Body SRL may disclose data to:

  • IT / hosting / online store service providers — Shopify and its subcontractors;
  • the payment processor NETOPIA Payments (NETOPIA FINANCIAL SERVICES S.A.), for processing card payments;
  • analytics and tagging providers: Google (Google Analytics 4, Google Tag Manager, Google Search Console);
  • advertising providers: Meta (Meta Pixel — Facebook / Instagram), TikTok (TikTok Pixel) — only if you have consented to marketing cookies;
  • e-mail / communication providers, if used for the newsletter;
  • public authorities, when required by law;
  • consultants (legal, accounting), under a confidentiality obligation.

These providers act, as applicable, as processors or as independent / joint controllers, according to the roles established by law and the applicable contracts.

VI. Transfers outside the EEA

Some services (Shopify, Google, Meta, TikTok) may involve the transfer of data outside the European Economic Area (including the USA). In these situations we rely on appropriate safeguards provided by the GDPR, such as the European Commission’s standard contractual clauses, certificates / recognised transfer frameworks (where applicable) and supplementary measures, as appropriate.

Further details can be found in these providers’ privacy policies. For questions about transfers: office@xsomatic.ro.

VII. Cookies and tracking technologies

The Site uses cookies and similar technologies. Non-essential cookies (analytics and marketing) are activated only after consent. You can manage preferences at any time from “Cookie settings” in the Site footer. Full details: Cookie Policy.

VIII. Your rights

As a data subject, you have the following rights (under the conditions of the GDPR):

  • the right to be informed;
  • the right of access;
  • the right to rectification;
  • the right to erasure (“right to be forgotten”), under the conditions of the law;
  • the right to restriction of processing;
  • the right to data portability;
  • the right to object (including to direct marketing);
  • the right to withdraw consent at any time (without affecting the lawfulness of prior processing);
  • the right not to be subject to an automated individual decision that produces significant legal effects, under the conditions of the law;
  • the right to lodge a complaint with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing) or to address the competent courts.

To exercise your rights: office@xsomatic.ro. We will respond within the time limits provided by the GDPR (generally one month).

IX. Security

We take reasonable technical and organisational measures to protect data (HTTPS connection, limited access, certified payment processors). However, no transmission over the internet is 100% free of risks.

X. Updates

We may update this policy to reflect legal or service changes. The current version is displayed on this page, with the date of the last update.