Privacy Policy

Arkka Home app · Last updated: 18 October 2026 · Versiunea în limba română

This is an English translation of the Romanian privacy policy. If the two versions differ, the Romanian version prevails.

This page explains what personal data we process when you use the Arkka Home app, why, how long we keep it and what rights you have. We have tried to write it in plain language.

1. Who is the data controller

SC ZEGA EVENTS SRL, tax ID (CUI) RO32117891, which operates the Arkka Home Outlet Codlea store.
Contact address: Str. Fabricii nr. 11, Codlea, Brașov County, Romania.
Phone: 0771 610 640
Email: contact@arkka-home.ro

Open in Google Maps Navigate with Waze

2. What data we process

You can browse the stock, the new arrivals, the photos and the prices without an account. In that case we do not ask for any personal data (the app only counts, with a random code that is not linked to any account, what is being used: see “Pseudonymized usage statistics” below). The data below appears only if you create an account and reserve a piece or place a firm order, and some of it only if you choose to give it (consent for offers and news, notifications).

The “Coming soon to stock” wait list. The pieces from the truck that is on its way can be seen without an account. If you tap “Let me know when it arrives”, we save in your account only the piece you chose, the date, its status and whether you have seen the announcement. We use them only to let you know by email and, if your notifications are on, on your phone, about the pieces you chose (they reached the store, or they did not arrive), not for offers. It is not a reservation: a piece can be reserved only after it reaches the store. The list is deleted together with the account and it also appears in “Download my data”.

We do not collect your location, your contacts, the photos on your phone, payment data (card, bank account) or sensitive data. We do not use advertising, we do not use third-party analytics or tracking tools (for example Google Analytics) and we do not track what you do in other apps. Nothing is paid for in the app, neither for a reservation nor for a firm order: pieces are paid for at the store (or in the way arranged by phone with the store, if you choose delivery).

Pseudonymized usage statistics. To see how much the app is used and which products interest customers, we count, without an account and without saving data that names you, a few things that happen in the app (and on the app’s website). We call them “pseudonymized”, not “anonymous”, because each event carries a random session code, and together with the product and its time this is not a number completely unrelated to a person (we explain this below). We count:

• that the app is open (a signal every half minute, only while it is on screen);
• which product (a piece or a catalog product) you opened and which product you added to or removed from favorites;
• that you tapped “Reserve this piece” (only the tap, for the product; real reservations are not counted here, they exist only in your account);
• which product you put in the cart or took out of the cart (with the size, colour and options chosen, as a short text) and that you opened the cart;
• that you started the order from the cart (only the fact that you tapped “Checkout”, without the form data) and that an order was sent (only the fact, with no link to the session);
• which banner you tapped and which category or list (for example “Sale”) you opened;
• that you ran a search. The searched text is never sent.

What we save and what we do not:

• A random session code. Each start of the app (or page load) gets a random code, generated on the spot. The code exists only in the app’s memory while it is open: we do not save it on the phone or in the browser (neither in cookies nor in local storage). It changes at every start and, if the app stays open, after at most 12 hours (or after 30 minutes in which the app sends nothing, for example while it is hidden or in the background). It cannot be used to recognize you from one visit to the next.
• The product, not the piece. For pieces that are opened, added to favorites or for which you tapped “Reserve this piece”, we save only the product (the model), not the specific piece from the stock. For the cart we also save only the product (and, for catalog products, the size, colour and options chosen, as a short text), not the whole cart: the list of products in your cart does not reach the statistics (for the availability check of the pieces in the cart, see the table above). The tap on “Reserve this piece” and the fact that an order was sent are saved with no link to the session, with their own random code, different every time. The steps before that (a product put in or taken out of the cart, the cart opened, the order started) do, on the other hand, carry the random session code.
• No identifying data. In these statistics we do not save your email, name, phone, account, IP address, user agent (browser type), phone model or other device data. We save only the platform type (web, Android or iOS).
• Real reservations stay separate. They are kept only in your account and reservation data, not in these statistics. The same goes for orders (firm orders and cart orders): their content, prices, contact, delivery and invoice details are not part of these statistics, they are kept only in your account and in the store’s order records. How many orders were completed, and for what value, we count from the real orders, not from these statistics.
• Abandoned carts. To see at which step customers stop, we count how many sessions put something in the cart and never sent the order. The result is a total (for example “12 out of 40”), not a list of people; the session is not linked to your account.
• We do not match them with customer accounts and we do not allow it. To be honest, though: in theory, someone with access to both these statistics and the reservations or the orders could try to match them by product, size, colour or options and by time, especially when there are very few visitors. The cart events (a product put in or taken out of the cart, the cart opened, the order started) carry the random session code and, for catalog products, the size, colour and options chosen; the order that is sent, on the other hand, has in the order records the products, the options, the time and your contact details. Only the tap on “Reserve this piece” and the fact that an order was sent are saved with no link to the session. That is why we keep the statistics for a short time (section 5), and access to them is limited to the company’s authorized staff who manage the stock (management and those with the right to manage the stock); we do not use them to identify a customer.
• If you are signed in, the request to our servers carries, like any other request, your account session as well. We do not save it together with the statistics.
• The providers’ technical logs. The hosting providers (Vercel for the website and the web app, Supabase for the database) may keep the IP address in their technical logs, as for any request (see the table above and section 4). We do not copy it into the statistics.
• The company’s employees are not counted when they are signed in with the employee account; without an account, an employee who opens the app is counted like any visitor.

What we see are totals (for example how many customers are in the app right now or how many times a product was opened). We use them only to improve our offer: what we bring to the store, which prices we reduce, which banners we show. We do not use them for advertising, we do not try to identify you and we do not give them to other companies. How long we keep them: see section 5.

3. On what legal basis

• Steps at your request before a sale (Art. 6(1)(b) GDPR): the account, the reservations and the firm orders (the contact, delivery and invoice details given with the order).
• Legal obligation (Art. 6(1)(c) GDPR): issuing the invoice and keeping the accounting documents for the period required by the accounting law (the invoice details).
• Your consent (Art. 6(1)(a) GDPR): the offers and news sent by notifications and by email, as well as the notification token. It is optional, not ticked by default, and you can withdraw it at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): the security of the app and the prevention of abuse, for example limiting the number of reservations, as well as the pseudonymized usage statistics (section 2), through which we see which products interest customers and improve our offer. The balance against your rights: we do not save data that identifies you directly (a random code kept only in memory, no account, no IP, no user agent), we save the product and not the piece, the tap on “Reserve this piece” and the fact that an order was sent are saved with no link to the session (the cart events, on the other hand, carry the session code and, for catalog products, the size, colour and options chosen, as a short text), we do not match the data with customer accounts, reservations or orders, we keep it for a short time (120 days) and access to it is limited to the staff who manage the stock. Because a random code together with the product, the options and the time is not a number completely unrelated to a person, we treat this data with care, as personal data, and you can object (section 6).

4. Who we share the data with

We do not sell or rent your data. It may be seen or processed by:

• the store’s employees, strictly to prepare and hand over the piece you reserved or ordered, to call you for confirmation and, if you chose delivery, to organize it;
• the company that carries out the delivery (for example a courier or a transport company), only if you choose delivery and only if the delivery is made through it: it receives your name, phone and delivery address, strictly for the delivery;
• the provider of the company’s invoicing software and the company’s accountant, so that the invoice can be issued and the accounting records required by law can be kept (the order’s invoice details);
• the provider that hosts the website and the web app (Vercel): it serves the app’s files and keeps visitors’ IP addresses in its technical logs (including those of visitors without an account who use the web app), as a processor, with the safeguards required by the GDPR (standard contractual clauses) for transfers outside the European Economic Area;
• the hosting and database provider (Supabase), which processes the data on our behalf under a data processing agreement, and which may keep in its technical logs the IP address of requests to our server (including those for statistics). If the servers are outside the European Economic Area, the transfer is made with the safeguards required by the GDPR (standard contractual clauses);
• the Expo Push notification service, only if you gave consent for offers and news and allowed notifications. Expo receives the notification token and the text of the notification, and forwards them through Apple (APNs) or Google (FCM) services so that they reach your phone. We do not send Expo your name or email;
• Google (the Gmail service), which provides the company’s email server (the account contact@arkka-home.ro), through which we send (a) the emails with offers and news, only to those who gave consent, and (b) an internal email to the store staff each time a firm order is placed, with the order summary (your contact, delivery and invoice details, the pieces and your notes), so that we can prepare it, and (c) a confirmation email to you, at the address in the order or of your account, with the same details and the amount to pay. For marketing offers Google receives your email address, the first name in the greeting and the content of the message; for the order emails it receives the details in the order summary; in all cases only to deliver the email on our behalf. If the processing takes place outside the European Economic Area, the transfer is made with the safeguards required by the GDPR. Every offers email has a one-click unsubscribe link; the order emails (the internal one and the confirmation sent to you) are not marketing;
• Google, only if you open the review link: the store’s Google page opens in the browser, and what you write there is subject to Google’s policy. We do not send Google any data about you;
• the apps you open yourself from the app’s buttons (for example WhatsApp or another messaging app for “Send the piece”, Google Maps, Waze): they receive only what you send or open there, for example the link of a piece;
• the authorities, only if the law requires us to.

5. How long we keep the data

As long as your account is active. When you delete your account, your personal data (email, name, phone, marketing consent, notification token) is permanently deleted, and the reservations remain only as records without a name, email, phone or account, with no link to your account. Active firm orders are cancelled and the pieces go back to stock. If you withdraw your consent for offers and news, we no longer send you marketing messages. Favorites, the language and the cart stay only on your device, not on our servers (the cart is emptied when the order is sent). On Android they are usually deleted together with the app (on uninstall or when you clear its data), and on the web when you clear the site data in the browser. On iPhone, the secure storage (Keychain) may keep these values even after you delete the app, and they may reappear on reinstall. The same applies to the session token and to the local copy of the notification token; we delete both when you sign out or delete your account. You can remove them from the app at any time: favorites by tapping the heart again, the language by changing it from the header, and the cart by taking the products out of it. If you want nothing to remain on the iPhone, remove your favorites, empty the cart and sign out before you delete the app.

Firm order data. The contact details, the delivery address and the notes are kept while the order is active and for as long as needed for handover, delivery and any complaints. The invoice details and the accounting documents issued on their basis are kept for the period required by the accounting law, even if you delete your account; after that period we delete them at your request (write to us at contact@arkka-home.ro). The address and company saved in your account (above) are kept while you have the account and are deleted when you delete the account or at any time from Account. While you have an account, your orders stay in your “My orders” history. When you delete your account, the contact and delivery details of your orders are deleted or anonymized; the orders remain on record only as far as accounting requires (the pieces, the value, the date and the invoice details). The order summary emailed to the store staff (section 4) stays in the staff mailboxes and is not deleted automatically along with the account: we delete it manually, at your request, within 30 days.

The pseudonymized usage statistics (section 2) are kept for a limited time and deleted automatically: the events (product opened, favorite, product put in or taken out of the cart, order started or sent, “Reserve this piece” tapped, banner tapped etc.) 120 days, the daily visit count 120 days, and the information about active sessions (the random code and the last hour it was used) 2 days. Since they are not linked to your account, deleting the account does not change them.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent. In the app, in the Account section, you can:

• download your data;
• turn off offers and news with a single button;
• delete your account and your personal data.

How to withdraw your consent for offers and news (at any time, without explaining why):

• in the app, in Account, turn off the “I receive offers and news” switch;
• from any email with offers, by tapping the Unsubscribe link (one click, no password);
• for phone notifications, you can also turn them off from the phone settings (Notifications → Arkka Home);
• or by writing to contact@arkka-home.ro.

Withdrawing your consent does not affect the lawfulness of the processing carried out before the withdrawal.

Pseudonymized usage statistics: the session code is random and is not saved on your device, and we do not save anything that names you or links the data to your account. That is why we cannot find “your events” in order to show them to you, correct them or delete them individually (and we do not try to match them with your account in order to do so). You do, however, have the right to object to these statistics and to ask us for clarifications about them: write to us at contact@arkka-home.ro, we will review the request and answer within 30 days at most. In any case, the events are deleted automatically after 120 days.

You can send any other request to contact@arkka-home.ro; we answer within 30 days at most. If you are not satisfied, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

7. How to delete your account

In the app: Account → Delete my account → confirm. The account and the personal data are deleted immediately (including the consent for offers and the notification token), and active reservations and firm orders are cancelled (the pieces go back to stock). The invoice details of orders already fulfilled are kept only as long as the accounting law requires (section 5).

Without the app: send an email to contact@arkka-home.ro, from the address you used to create the account, with the subject “Account deletion”. We delete it within 30 days at most.

8. How we protect the data

• Communication between the app and the server is encrypted.
• Passwords are stored only in encrypted form, and the session token stays in the phone’s secure storage.
• The app uses only limited access to data: customers see only the public stock and their own reservations and orders, not other customers’ data or the company’s internal data.
• Marketing messages are sent only to those who gave their consent. The unsubscribe link in the emails uses a unique, hard-to-guess code that does not reveal your data.

9. Minors

The app is not intended for people under 16. If you find out that a minor has created an account, write to us and we will delete it.

10. Changes

If the app starts processing other data (for example the location), we update this page beforehand and notify you in the app. The date at the top shows the latest version.

What changed in the update of 18 October 2026: we added the "Coming soon" wait list (the chosen piece, the date, its status and whether you have seen the notice, kept in your account and deleted together with it), with a notice by email and, if you have notifications on, on your phone; sections 2 and 5.

What changed in the update of 14 October 2026: we added the shopping cart (kept only on your device until you send the order) and, in the pseudonymized statistics, the products put in or taken out of the cart, the opening of the cart, the start of the order and the fact that an order was sent (the last one with no link to the session); sections 2, 3 and 5. We also stated that, in theory, the cart events could be matched not only with reservations but also with orders by anyone with access to both (sections 2 and 3).

What changed in the update of 12 October 2026: we added the firm order with no online payment (the contact, delivery and invoice details you enter with the order, used only to prepare, deliver and invoice it; sections 2-5, 7 and 8). The free reservation now lasts 4 hours. At the same time: the delivery address and company can be saved in your account (an option, on by default, deletable from Account), the company can be looked up by tax ID in the ANAF register (only the tax ID is sent), and after each order you receive a confirmation email.

What changed in the update of 10 October 2026: we added phone notifications and emails with offers (only with your consent, with one-click withdrawal), favorites and the language kept only on the phone, the Google review link and the pseudonymized usage statistics (not linked to the account, with a random code kept only in memory, the product instead of the specific piece; section 2).