Choose an industry

Medical & dental clinics Online stores Homeowners associations Accounting firms

Online stores

Data protection for online stores

An online store is the controller of customer data and needs a legal basis for each purpose (art. 6), usually the performance of a contract for orders and deliveries. Customers are informed at collection, and providers that process data on the store’s behalf sign a written contract. Customers may object to direct marketing at any time (art. 21).

Request a quote →Request a free consultation

An online store on screen with an order ready for delivery

Industry-specific risks

! 01

Pixels and analytics without a legal basis

Cookies and marketing pixels can collect online identifiers, that is, personal data. Where they rely on consent, the store must be able to demonstrate that it obtained it, and withdrawing consent must be as easy as giving it. art. 4 art. 6 art. 7

! 02

Offers sent after an objection

The store sends offers without a legal basis or after the customer has objected. Once a customer objects, their data may no longer be processed for direct marketing. art. 6 art. 21

! 03

Providers without a contract

The store platform, email service or CRM that processes data on the store’s behalf needs a written contract. For providers in states outside the European Economic Area, the Law’s conditions for transfers also apply. art. 28 art. 44

Data you process

Name and delivery addressPhone and emailOrder historyPayment dataOnline identifiers and cookiesNewsletter subscriptions

Your obligations under Law No. 195/2024

01A legal basis for each purpose: order, delivery, marketing, analysis of visits art. 6
02Informing customers at the time their data is collected art. 13
03Demonstrable consent, where consent is the legal basis art. 7
04Clear and complete information before cookies are used, under art. 116(5)-(6) of Law No. 72/2025, and consent for analytics and advertising cookies art. 6 art. 7
05The right to object to direct marketing, explicitly brought to the customer’s attention at the latest at the first communication art. 21
06Written contracts with processors art. 28
07Transfers to states outside the European Economic Area only under the conditions of the Law art. 44 art. 45 art. 46

Documents we deliver

Every document is tailored to your activity, not copied from a template.

Record of marketing consents art. 7

Contracts with processors art. 28

Records of processing activities art. 30

Data subject requests policy art. 12 art. 24

How we work

From the first conversation to a complete compliance file

1
Free consultation
15 minutes online or by phone. We learn what your company does and what personal data it processes.
2
Assessment
We take stock of your data, processes and existing documents. You receive a gap report.
3
Documentation
We draft the records, policies and privacy notices tailored to your activity.
4
Implementation
We walk you through the documents and leave a written note for employees; on request, we hold a briefing session for them.

For a typical online store

The Essential package + extra work, 19,900 MDL

This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data.

Calculate the exact price →

Packages

Fixed prices, no surprises

Choose a package by how your company processes data, not by headcount. Prices start from the lawyer's work, and a package costs less than its modules bought separately.

Essential

5,900MDL

Module value: 18,500 MDL · you save 12,600 MDL

Up to 3 processing activities · 2 privacy notices · 2 processor contracts

For a small company with simple processing: a shop, an office, an accounting firm, a homeowners' association.

✓Data inventory and gap report
✓Records of processing activities, with the legal basis and retention period of each
✓Data protection policy and a description of the security measures
✓Privacy notices for each group of people: clients, employees, patients
✓Contracts with processors, new or reviewed
✓Internal rules for data subject requests and for personal data breaches
✓The confidentiality commitment and the written note for employees

Online · delivered in 10 working days · 1 round of revisions · 14 calendar days of email questions

Choose Essential →

Extended

Custom

from45,000MDL

No limits · analysis at your premises

For clinic networks, banks and microfinance companies, groups of companies, public bodies, or companies that must appoint a data protection officer.

✓Everything in Extended, with no limits
✓Data protection impact assessments, as many as needed
✓Review of data flows and IT systems
✓Joint controller agreements, profiling, complex transfers

Priced after analysis, at module prices

Request a quote →

Not sure which package fits? Calculate the price → Request a free 15-minute consultation →

Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate.

Case studyIllustrative example

Case study: online store

An online cosmetics store with around 3,000 orders a month. A social network's tracking pixel collected data on visitors with no established legal basis and without informing them, and the newsletter went to every customer, none of whom had been told of the right to object. The customer list was uploaded to an email marketing platform with servers outside the European Economic Area.

ResultThe store now has an established legal basis for each purpose, direct marketing included, checked also against the rules on electronic commercial communications, a published privacy policy, a configured cookie banner, a contract with its email marketing platform and a cleaned-up subscriber list.

Free checklist

Online stores

Check in 10 minutes whether your organisation meets the basic requirements of Law No. 195/2024.

Complete the checklist →

FAQ

What clients ask us

Do I need a cookie banner?

Yes, if the site uses cookies or pixels for analytics or advertising. Art. 116(5) and (6) of Law No. 72/2025 on electronic communications allows information to be stored on a visitor's device, or read from it, only after clear and complete information about the purposes, except where this is strictly necessary for transmitting a communication or for a service the visitor has expressly requested. Law No. 195/2024 does not regulate cookies separately, but the online identifiers they collect are personal data, and for analytics and advertising the defensible legal basis is consent: you obtain it before switching these tools on, you can demonstrate it, and visitors can withdraw it as easily as they gave it. art. 4 art. 6 art. 7

Can I send a newsletter to existing customers?

It depends on the legal basis you rely on and on how the data was collected. In any case, customers have the right to object to direct marketing at any time, and this right must be explicitly brought to their attention at the latest at the first communication. After an objection, the data is no longer used for that purpose. art. 6 art. 21

What conditions must consent to a newsletter meet?

Consent is a freely given, specific, informed and unambiguous indication of wishes, by a statement or a clear affirmative action. If it is requested in a document that also concerns other matters, the request is clearly distinguished from them. The store must be able to demonstrate it, customers are told beforehand that they can withdraw it at any time, withdrawing is as easy as giving it, and making an order conditional on subscribing casts doubt on whether consent was freely given. art. 4 art. 6 art. 7

What do we do with the data after delivery?

Keep it only for as long as the purposes for which it was collected require, including legal obligations such as accounting. Once it is no longer needed, you are obliged to erase it without undue delay. art. 5 art. 6 art. 17

Free consultation

Not sure where to start?

Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.

Request a quote →Request a free consultation

Data protection for online stores

Industry-specific risks

Pixels and analytics without a legal basis

Offers sent after an objection

Providers without a contract

Data you process

Your obligations under Law No. 195/2024

Documents we deliver

From the first conversation to a complete compliance file

Free consultation

Assessment

Documentation

Implementation

Fixed prices, no surprises

Essential

Extended

Custom

Case studies and checklist

Case study: online store

Online stores

What clients ask us

Not sure where to start?

Find out what compliance costs for your company