Privacy Policy & GDPR
Your rights overyour own data
Who processes your personal data, on which article of the GDPR, who else ever sees it, where in the world it sits, and the six things you can make us do about it.
Last updated
1. Data Controller
Your personal data is processed by:
- Company name
- CSO CODESOFT SRL
- Registration number (CUI)
- 43602018
- Registered office
- Sat Vidra, Comuna Vidra, Vrancea, Romania
- Contact email
- contact@legendsteps.com
We are committed to protecting our users' privacy and complying with applicable laws, including Regulation (EU) 2016/679 (GDPR).
2. Data We Collect
We collect and process the following categories of data:
- Identification Data: Name, surname, email address, profile picture (for Google authentication).
- Billing Data: Details required for invoicing by law.
- Technical and Usage Data: IP address, browser type, device used, activity logs, challenge progress (distance covered).
- Financial Data: Payment information (securely processed via Stripe; we do not store your full card details).
3. Purpose and Legal Basis for Processing
| Legal basis | What we process for |
|---|---|
| Contract Execution | To provide our services, process orders, and deliver purchased products. |
| Legal Obligation | For invoicing, accounting, and tax reporting according to Romanian law. |
| Legitimate Interest | For site security, fraud prevention, and improving our services. |
| Consent | For marketing communications (newsletter), if you have explicitly opted in. |
4. Data Recipients
We do not sell your personal data. We only share it with partners necessary for service operation:
- Payment Processors: Stripe (for secure payment processing).
- Infrastructure Services: Google Firebase (for hosting, authentication, and database).
- Courier Services: Partner courier companies, strictly for order delivery.
- Public Authorities: Only if there is a legal obligation (e.g., tax authorities).
5. International Data Transfers
Your data may be stored on servers located in the European Union or the United States (via Google Firebase and Stripe). We ensure these providers comply with security standards and Standard Contractual Clauses approved by the European Commission.
6. Your Rights
Under GDPR, you have the following rights:
- Right of Access: You can request a copy of the data we hold about you.
- Right to Rectification: You can correct inaccurate data.
- Right to Erasure ("Right to be Forgotten"): You can request deletion of data, unless we are legally required to keep it (e.g., invoices).
- Right to Restriction of Processing.
- Right to Data Portability.
- Right to Object.
To exercise these rights, you can contact us at: contact@legendsteps.com. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).