The Highest Expression of Craftsmanship
Rare gemstones. Extraordinary craftsmanship. Timeless masterpieces. Nestelli High Jewellery represents the House's most exceptional creations, produced in limited numbers for collectors and connoisseurs.
Nestelli
Diamonds for Generations
Data Protection
Privacy Policy on the processing of personal data
This Privacy Policy has been prepared by NESTELLI DIAMONDS S.R.L., a company with its registered office in Romania, Bucharest, District 1, Strada Atena no. 2, registered with the Trade Register under no. J40/6860/2023 and sole registration code (CUI) 47970411 (hereinafter “we”, the “Company” or “Nestelli Diamonds”), as the owner of the platform https://www.nestelli.ro/ (hereinafter the “Site”).
Through this document, we wish to explain why and how we use the personal data of visitors to our Site. This Privacy Policy applies to our relationship with visitors to our Site and with persons who purchase from us or contact us.
“Personal data” means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, economic, cultural or social identity.
We encourage you to take the time to read it in full and carefully before interacting with us. We want it to be clear to you why and how we use your data, how we protect it, and what your rights are in connection with our use of your data.
This Privacy Policy is drawn up by NESTELLI DIAMONDS S.R.L. acting as data controller, under the data protection legislation applicable in Romania, in particular Articles 13–14 of Regulation (EU) 2016/679 (“GDPR”).
01
Purposes, legal grounds and categories of data
Depending on the context in which you interact with us, we use the following categories of personal data, for the purposes and on the legal grounds described below.
If you are a visitor to the website www.nestelli.ro
| Activity | Purposes | Categories of personal data | Legal ground |
|---|---|---|---|
| Contact with you through the contact form on nestelli.ro | Communicating with you regarding the scheduling of an appointment, or in connection with our activity and/or the products we sell | First and last name, email, phone number | Processing is necessary in order to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) |
If you are subscribed to our newsletter
| Activity | Purpose | Categories of personal data | Legal ground |
|---|---|---|---|
| Sending newsletters with information or news about our products and the Company’s activity on nestelli.ro | Sending newsletters with information or news about the Company’s products and activity on nestelli.ro | Email address, your name | Your consent (Art. 6(1)(a) GDPR) |
| We analyse and record whether you open our newsletters and how you interact with them | Structuring our newsletters according to your needs and improving the reach of our information or marketing campaigns | Email address, your name; data about the device used to access our newsletters (operating system, device type, etc.) | Our legitimate interest in structuring the newsletter according to your needs and improving the reach of our campaigns (Art. 6(1)(f) GDPR)Your consent (Art. 6(1)(a) GDPR) |
If you make purchases from the Site or from our store
| Activity | Purposes | Categories of personal data | Legal ground |
|---|---|---|---|
| Placing an order and the sale of products | Receiving and dispatching orders, invoicing, resolving your requests and complaints — including return and exchange requests — refunding the price paid, and performing the sales contract | The desired product, first and last name, contact details (phone number, email address), delivery address, billing address, payment method, bank card details, invoice data | Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR)Our legitimate interest in defending our rights and interests in the event of a claim or complaint (Art. 6(1)(f) GDPR) |
| Archiving documents relating to the products sold | Keeping an archive of accounting documents | Identification data; financial data (invoices, contracts, payments, other data) | Our legal obligation to archive and to comply with accounting provisions (Art. 6(1)(c) GDPR) |
02
Providing data and consent
When you communicate your personal data directly to us, please provide all the categories of personal data we request. Otherwise, we may not be able to properly carry out the activity for which you contact us (including, among other things, responding to your requests).
Where we use your data on the basis of your consent, you may withdraw this consent at any time, and we will no longer use your data from that moment on. However, activities carried out before the withdrawal of your consent, including those involving your data, will remain valid. You may withdraw your consent by contacting us using the contact details indicated below.
03
To whom we disclose your personal data
We disclose your personal data to our external service providers, such as IT service providers, consultancy and marketing service providers, or newsletter delivery providers. They will access and use only the personal data necessary to provide the services contracted by us, on the basis of adequate contractual documentation, the legal ground being our legitimate interest in contracting and benefiting from these providers’ services.
We may also disclose your personal data as follows:
- to our auditors, consultants, lawyers or other specialised professional service providers, where necessary for them to provide the services contracted by us, in view of our legitimate interest or legal obligation;
- to public authorities and institutions, where we have a legal obligation to do so or upon their express request, where permitted by law.
As a rule, we transfer your personal data only to recipients in states belonging to the European Union (EU) and/or the European Economic Area (EEA); we do not transfer your data to states outside the EEA, and we require the same of our service providers.
04
How we protect your data
Protecting your personal data is very important to us. To this end, we apply appropriate measures to ensure the security of personal data, including: dedicated policies, specific technical measures, oversight of our service providers, and data minimisation.
We also undertake to adopt any further measures required by law in the field of personal data protection in connection with the use of your data.
05
How long we keep your data
We intend to keep your personal data for as long as necessary to fulfil the processing purposes we pursue.
When we use your data on the basis of your consent — for example, when sending newsletters or when interacting with you through social media — we will in principle keep your data until you withdraw your consent.
If you contact us through the contact form, we will keep your data for no longer than the time needed to resolve your request and for a reasonable period after its completion, which will not exceed 3 years from the completion of your request — unless we consider it necessary to keep the data for longer in order to protect our rights and interests, or in accordance with our legal obligations (such as archiving for financial and accounting purposes).
06
Your rights
Under the law, you have the following rights in relation to the processing of your personal data carried out by us:
Right of access
You may obtain from us confirmation that we process your personal data, as well as information on the specifics of the processing, such as the purpose, the categories of data processed, the recipients, the retention period, and the existence of the right to rectification, erasure or restriction. This right allows you to obtain, free of charge, a copy of the personal data processed, and, for a fee, any additional copies.
Right to rectification
You may ask us to correct inaccurate personal data or, where appropriate, to complete data that is incomplete.
Right to erasure
You may request the erasure of your personal data when: (i) it is no longer necessary for the purposes for which we collected and process it; (ii) you have withdrawn your consent and we can no longer process it on other legal grounds; (iii) it is processed unlawfully; or (iv) it must be erased in accordance with the relevant legislation.
Withdrawal of consent
You may withdraw your consent at any time with regard to data processed on the basis of consent, without affecting in any way the processing carried out prior to withdrawal. For newsletters, you may withdraw your consent at any time by clicking the UNSUBSCRIBE button in each message we send.
Right to object
You may object at any time to processing based on the Company’s legitimate interest, by presenting us with reasons relating to your specific situation. For details on the processing we carry out on the basis of legitimate interest, please see Section 01 above.
Restriction of processing
You may request the restriction of our processing of your personal data if: (i) you contest the accuracy of the data, for a period enabling us to verify it; (ii) the processing is unlawful and you oppose erasure, requesting restriction instead; (iii) we no longer need the data for processing, but you require it for a legal claim; or (iv) you have objected to processing, pending verification of whether our legitimate grounds as controller override yours.
Right to data portability
You may ask us, under the conditions of the law, to provide the personal data you have supplied to us in a structured, commonly used and machine-readable format (for example, CSV). At your express request, we may also transmit your personal data to another entity, where technically feasible. You may exercise this right only where (cumulatively): (i) the processing is carried out by automated means; and (ii) the processing is based on your consent or on the performance of a contract with you.
Automated individual decision-making
At present, we do not process your personal data solely through automated individual decision-making, including profiling. Should we initiate such processing, we will supplement this Privacy Policy accordingly.
Right to lodge a complaint
You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro) if you consider that your rights have been infringed. We respectfully ask, however, that you contact us with any complaint or concern before contacting the authority.
Contact
To exercise any of the rights set out above, to ask a question about these rights, or about our processing of your personal data, please contact us by email at contact@nestelli.ro.