Privacy policy

Who is the controller

The controller of your data is MITU D. DENNIS PERSOANĂ FIZICĂ AUTORIZATĂ (authorized natural person), CUI 51166750, Trade Register no. F2025001745006, registered office: sat Brebu Megieșesc, com. Brebu, str. Matei Basarab nr. 147, jud. Prahova, Romania, which runs the Finally Won brand ("we", "us").

For any question about your data, write to contact@finallywon.com. We do not have a data protection officer (we are not required to), but we answer you directly.

What data we process, why, and for how long

When

Data and purpose

Legal basis (GDPR)

How long we keep it

You join the launch list

Your email and the moment you agreed. To confirm your sign-up, tell you when we launch and send you launch offers and any discount code

Your consent, art. 6(1)(a)

Until you unsubscribe, or at most 12 months after launch

You add a product to your cart

The file you upload, with the size and texts you chose, stored on our servers so that your order can be made

Steps you ask for before a contract, art. 6(1)(b)

If you do not order, we delete the file after 30 days

You place an order

Name, email, phone, delivery address, invoice details (for a company: name, tax ID, trade register number, address), the product, the plate text and other texts, your notes, the discount code used, payment status. To make, deliver and charge the order and to answer you

Contract, art. 6(1)(b)

3 years after delivery (to handle the legal guarantee and any claim). For gift orders, the recipient's details have a different period (next row)

Gift order

The recipient's details, received from the buyer: name, delivery address, phone (the courier asks for it) and, if the buyer writes the message for the message plate themselves, the message they want us to print for the recipient. To deliver the gift and, if needed, print the message

Our legitimate interest, and the buyer's, in delivering the gift that was ordered (the recipient is not a party to the contract), art. 6(1)(f)

90 days after delivery, then we delete or anonymize the recipient's name, phone, address and message, separately from the buyer's invoice. We do not email them

Invoices

The data on the invoice. To issue the invoice, report it in RO e-Factura and keep our accounts

Legal obligation, art. 6(1)(c) (tax and accounting law)

As long as Romanian accounting law requires, at least 5 years

Your certificate file

The file, which usually shows your name, the amount, the date and the issuing firm. For the preview, the print and the check of the finished product

Contract, art. 6(1)(b)

Orders without an account: 90 days after delivery. With an account: while the account exists, or until you delete the file

Automatic check of the file

A reduced copy of the certificate, without metadata (EXIF, GPS). To tell you if the file is clear, whole and good to print, and to help you confirm the details

Contract and our legitimate interest in delivering correct products, art. 6(1)(b) and (f)

The result is kept with the order (3 years). The image itself, as the certificate file

You start an order and do not pay

The name, email, phone, address, texts and file from the unpaid order. So you can pick the order up again and we can sort out any payment problem

Steps you ask for before a contract, art. 6(1)(b)

30 days after the order is created; then we delete the file and your personal data and keep only the order number, the date and the status

Shipping label (AWB)

A PDF with your name, phone and address, which the workshop prints and sticks on the parcel. So the parcel reaches you

Contract, art. 6(1)(b)

30 days after delivery. The AWB number stays with the order (3 years). The workshop no longer sees your name and address 30 days after shipping

Customer account

Email, name, your Google ID if you sign in with Google, your roadmap, the personal goals and photos you add, your preferences. To give you the account and the roadmap

Contract (the account service), art. 6(1)(b)

While you have the account. Accounts with no activity for 24 months are deleted, after we warn you by email

Account created automatically at checkout

The email and name from your order, used to create an account after payment so you can follow your order and see your file. You choose the password yourself, through a link we email you; we never send it written out. For a gift order, the account is the buyer's, not the recipient's

Contract (following the order and access to your file), art. 6(1)(b)

While the account exists. Accounts with no activity for 24 months are deleted, after we warn you by email. You can delete it at any time (section 10); orders and invoices stay as long as the law requires

Name, email and profile picture received from Google. To let you sign in more easily

Contract, art. 6(1)(b)

As the account

Review request and similar-product emails

Your email and what you ordered. To ask how you like your Award and to tell you about similar products

Our legitimate interest in writing to our customers (art. 12(2) of Law 506/2004). You can refuse at checkout and in every email

Until you refuse

News, offers and roadmap reminders

Your email and your roadmap. For marketing, for example "this slot of your roadmap is still empty"

Your consent (the box is never ticked for you), art. 6(1)(a)

Until you withdraw it. We keep the proof of consent for 3 more years

Your photos on our home page, Instagram or ads

The photo or video, with the certificate visible in it. To show real customers

Your separate consent, art. 6(1)(a)

Until you withdraw it. We take them down within 7 days

The Wall (only if you say "Yes" after you buy)

Your full name as in the order (or the name you write, which we check first), your number on The Wall and the month you joined; if you add it, your Instagram account name, which appears only after we approve it. The page finallywon.com/the-wall is public: anyone can see it, and copies (for example in a search engine cache or a screenshot) are outside our control. Anyone who taps your Instagram account goes to your public profile; we send no data to Instagram. For us only, not public: the order the choice belongs to, the date and language of your agreement and the version of the text you agreed to. To show real customers

Your consent, art. 6(1)(a), given by pressing "Yes" after the purchase; for Instagram, a second consent, given when you save the account. Buying does not depend on it

Until you withdraw it. You can remove yourself from The Wall (or only your Instagram) at any time, from the order page, from your account or by writing to support@finallywon.com; we take it down within 7 days. When you withdraw, we delete the name and the Instagram account; as proof, for as long as we keep the order (3 years), we keep only the link to the order, the dates of the agreement and of the withdrawal and the version of the text. Your number is never given to anyone else

The 15% code for a photo, story or review

If you write to us on Instagram with a photo or story of your Award, or with a review on Trustpilot, to get the code from the card in the parcel: your email and what you choose to give us (phone, Instagram account name, order number, the link to the post or review). We make a personal 15% code, tied to your email and valid once, and we check that the same person does not get a second code (by email, phone, Instagram or order). You can also receive it if you did not buy the Award yourself (for example it was a gift). To give you the offer on the card and to prevent abuse

Our legitimate interest in giving the offer once per person, art. 6(1)(f); you can object at any time (art. 21)

While the code is valid and for 12 months after it expires or is used, so that we do not give a second code

A partner's discount code

If you use the code of a partner (a creator who works with us), we record the code with your order and show the partner, in their dashboard, your full email, the order date and the order amount. So the partner can check their commission and we can prevent fraud in the program (for example orders placed by the partner with their own code). The partner does not see your name, phone or address. For the data they see, the partner becomes a separate controller; under the partner program terms they accept when they sign up, they may use the email only to check the commission, may not send you marketing messages, copy it into lists or give it to anyone else, and must delete it when the collaboration ends

Our legitimate interest in running the partner program, checking commissions and preventing fraud, art. 6(1)(f). The data shown is minimal (no name or address), for a limited time, and the partner has duties under the program terms. You can object at any time (art. 21): buy without a code or write to contact@finallywon.com, and we stop showing your email to the partner

The partner sees the email, date and amount for 12 months from the order, then no longer. We keep the order data as for the order

Support (email, WhatsApp, Instagram)

Your messages, your name or phone number and what you send us (for example photos of a damaged product). To answer you and solve complaints

Contract and our legitimate interest, art. 6(1)(b) and (f)

Email: 3 years after the last message. WhatsApp and Instagram: 12 months after the last message, or 3 years if it relates to an order or a complaint

Giveaways (if we run one)

What the official rules of that giveaway say, usually name, email, the order, and for the winner the town

The rules you accept (contract) and the legal duty to publish winners

As the rules say: participants 6 months after the draw, winners as tax law requires

Security and fraud prevention

IP address, server logs, payment information. To protect the site, the payments and our discount codes

Our legitimate interest, art. 6(1)(f)

Logs: at most 30 days

Product safety

The order number on the product, linked to the order. So we can trace a product if there is a safety issue

Legal obligation, art. 6(1)(c) (Regulation (EU) 2023/988)

As the order data

We rely on our legitimate interest for quality control (automatic checks), preventing fraud, the security of the site, emails to existing customers and defending ourselves in a dispute. We checked that these uses are what a customer would expect and that they do not affect your rights disproportionately. You can object at any time (section 10).

We do not ask for your personal identification number (CNP). On an invoice to an individual, the tax code field is filled in with thirteen zeros, as the law allows.

Your certificate and your files

We use your file only to make your Award: the preview, the print and the check of the finished product.
We send it only to the workshop that makes your Award. The workshop works under a contract with us and deletes its copies within 30 days after shipping.
If your photo is small for print, we also make a sharper version of it on our own server, with a fixed mathematical enlargement (no AI that draws or invents pixels, and nothing is sent to anyone else for it). Then we keep two files in the same private storage: your original and the sharper version. When we show you both, you choose which one we print; otherwise we print your original. Both follow the same deletion rules as your file, below. In that case your file is saved as soon as you finish the photo step, not only when you add it to your cart.
We do not publish your certificate and we do not use it in ads without your separate permission.
We do not check your certificate with the firm that issued it, and we do not send the certificate to that firm.
A certificate sometimes shows details such as an account number. Upload only what you want printed. We never need passwords, identity documents or card numbers, so please do not send them.
If you need a replacement after your file was deleted, we may ask you to upload it again.
A file you upload but that is not used in a paid order (for example one left in your cart) is deleted at most 30 days after the upload. If you asked us to email you your Award and you do not order, we delete it 7 days after the last email.
If an order was cancelled or refunded, we delete the file within 30 days of the cancellation. If you have a payment dispute open, we keep the file while the dispute lasts, as proof, and for 30 more days after it closes; after a refund, at most 120 days.
When we delete your file, we tell you on your order page.

Automatic checks and decisions

When you upload a certificate, an AI model looks at a reduced copy: it checks whether the file is clear, whole and straight, and it reads the details so that you can confirm them.
We check every image you upload, certificate or personal photo, as soon as you finish the photo step (after the parts you chose to hide are blurred). The check uses a Google AI model (Gemini), reached through Vercel's AI gateway, which receives only a reduced copy of the image: at most 1568 pixels on the long side, as JPEG, without metadata. It tells us whether the image looks like a certificate, whether it looks like a phone photo of a screen or of a printed paper, whether it is sharp enough, and it reads the details for you to confirm. If it looks like a phone photo of a screen or of paper, we tell you, and you can still order.
The images may show what is on your certificate, such as your name. The AI providers do not receive the details of your order (email, phone, address, payment). We use them through a gateway that is set to use only providers that commit not to train their models on the images.
We do not take decisions about you based only on automated processing that significantly affect you (art. 22 GDPR). The AI only warns or flags. You decide at upload, and a person from our team decides before shipping. If you disagree with a warning, write to us and a person will look at it.
Custom texts (the plate text, quotes, the message for the recipient) are checked automatically only to make sure they fit and can be printed (length and characters). The check does not take decisions about you.

If you order for someone else

If you order a gift, you give us the recipient's details: name, delivery address and phone number (the courier asks for it), possibly the message you want us to print for them and, sometimes, their certificate. We received them from you, not from the recipient. We use them only to make and deliver the order. The legal basis is our legitimate interest, and yours, in delivering the gift you asked for (art. 6(1)(f) GDPR), because the recipient is not a party to the contract. We do not email the recipient and we do not ask for their email address. On the shipping label (AWB) we put your email, the buyer's, not the recipient's, so FAN Courier can notify you about the parcel. We do not put the price in the parcel. The account created automatically at checkout (section 2) is yours, the buyer's: the recipient does not get an account.

We keep the recipient's details (name, phone, address and message) for 90 days after delivery, separately from your invoice, and then delete or anonymize them. If you need a replacement after that, we ask you for the address again. The courier and the workshop receive only what they need for delivery and production (section 6).

This policy is also the information for the recipient (art. 14 GDPR). The recipient can write to us at contact@finallywon.com with any question or request about their data (access, erasure, objection, section 10). When you give us the recipient's details and their certificate, you confirm that you may do so and that they agree (Terms, section 6).

Who we share data with

We do not sell data. We share it only as much as needed, with:

Who

What for

Role and where the data is

The partner workshop in Romania: Perso.ro

Production and packing of the order

Processor, with a contract (art. 28 GDPR); Romania

FAN Courier Express SRL, our courier

Delivery and parcel notifications (SMS, email): name, phone, delivery address or the locker you chose, and the email of the person who placed the order

Independent controller for the transport; Romania

Stripe Payments Europe, Ltd.

Processing the payment

Processor for the payment; independent controller for fraud prevention and its own legal duties (see Stripe's privacy policy); EU, with transfers inside the Stripe group

Supabase (project hosted in Frankfurt)

Our database and files

Processor; EU, with possible support access from the US

Vercel Inc.

Hosting the site, logs, and the gateway to the AI models

Processor; US and EU

AI model providers, reached through Vercel's gateway (Google, for the file checks)

Automatic checks of files and photos

Sub-processors; US

Meta (WhatsApp, Instagram)

The messages you write to us on WhatsApp or Instagram

Processes the messages under its own policies, in some cases as our processor, in others as its own controller; EU and US

Resend

Sending our emails (from its Ireland region, on Amazon Web Services infrastructure)

Processor; EU, with a US company

Google (Google Workspace)

The mailbox we use to answer you

Processor; EU and US

Google (sign-in)

Signing you in, if you choose Google

Independent controller; US

Oblio (invoicing software)

Issuing invoices

Processor; Romania

The partner whose code you used (creator)

Checking the commission: the email, order date and amount, for 12 months from the order

Separate controller for the data they see; duties under the program terms the partner accepts (use only to check the commission, no marketing, no lists, no passing on, deletion at the end); may be outside the EU, depending on the partner

ANAF (RO e-Factura)

Reporting invoices

Public authority, legal obligation; Romania

Our accountant

Accounting

Processor, bound by confidentiality; Romania

Authorities and courts

Only when the law requires it

Independent controllers; Romania

Transfers outside the European Union

Some providers are US companies or may access data from the US (Vercel, Supabase support, Resend, Google, Stripe's group, the AI model providers). We only allow transfers with the safeguards the GDPR requires: an adequacy decision, namely the EU-US Data Privacy Framework for certified companies, or the Standard Contractual Clauses approved by the European Commission (art. 45 and 46 GDPR). You can ask for a copy of these safeguards at contact@finallywon.com.

Cookies and browser storage

We use only what the site needs to work, or what you asked for. We do not use advertising or analytics cookies, so we do not show a cookie banner.

Name

What it does

How long

Type

NEXT_LOCALE

Remembers the language you chose

1 year

A preference you asked for

fw-cont-auth (and numbered parts such as fw-cont-auth.0)

Keeps you signed in to your account. It is set only if you sign in

Until you sign out, at most about 13 months

Strictly necessary

fw-cart-v1 and fw-cart-discount-v1 (local storage in your browser)

Keep your cart and the discount code you applied on this device. The cart includes a small preview image of your certificate

Until you empty the cart or clear your browser data

Strictly necessary

fw-set-v1 (local storage in your browser)

Keeps the set of Awards you started (the sizes you picked and the finished Awards, with your texts and a small preview of your certificate) so you can continue it. It is forgotten after 30 days

Until you finish the set, empty it or clear your browser data; at most 30 days

Strictly necessary

Stripe cookies

Set by Stripe on its own payment pages, for the security of the payment and fraud prevention

As in Stripe's policy

Strictly necessary, set by Stripe

Google

If you choose "Continue with Google", Google may set cookies on its own sign-in pages

As in Google's policy

Set by Google

Admin panel

Set only when our own team signs in to the panel. Customers do not get them

Session

Strictly necessary

Our fonts are hosted by us, so your browser does not contact Google to load them.

What we do not use today: Meta Pixel, TikTok Pixel, Google Analytics or similar tools. If we add any of them (for example Meta Pixel for ads), we will load them only after you accept in a cookie banner, where "Accept" and "Refuse" are equally easy to use, and we will update this policy first.

Augmented reality: if you use the AR view on your phone, your phone's own AR service (for example Apple Quick Look or Google's AR services) shows the 3D model on your device, under its own privacy policy. We do not receive your camera images.

Emails

Emails about your order (confirmation, shipping, delivery, invoice) go to everyone who orders. We do not put offers in them.
If you are an existing customer, we may email you to ask how you like your Award and to tell you about similar products. At checkout you can refuse this, and every email has an unsubscribe link.
The "Your account is ready" email (with the link to choose your password) is one of the emails about your order: no offers in it.
We send news, offers and roadmap reminders only if you agreed (the box is never ticked for you). You can withdraw your consent in your account or in any email, with one click.

Your rights

You have the right to:

find out what data we hold about you and receive a copy (art. 15 GDPR);
have it corrected (art. 16);
ask us to delete it (art. 17), except for what the law requires us to keep, for example invoices;
restrict the processing (art. 18);
receive your data in a portable format (art. 20);
object at any time to processing based on our legitimate interest, including marketing emails (art. 21). For marketing, we stop right away;
withdraw your consent at any time, without affecting the processing done before (art. 7(3));
not be subject to a decision based only on automated processing (art. 22).

Write to us at contact@finallywon.com and we reply within one month at the latest (art. 12(3)). We may ask you to confirm who you are, for example with an email from the address you used for the order.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, www.dataprotection.ro.

Is giving us your data required?

Your contact, delivery and invoice details are needed to conclude and carry out the contract. Without them we cannot deliver your order. Everything else (the account, reviews, news and offers, photos on our site) is optional.

Our Instagram, TikTok and Facebook pages

When you write to us or interact with our pages, the platforms (Meta, TikTok) also process your data under their own policies. For the statistics of our Facebook and Instagram pages, we are joint controllers with Meta. We answer your messages and keep them as long as the conversation needs.

Instagram (the "Write to us" button): if you write to us on Instagram (direct messages), your message, your name and what you send us reach us and are also processed by Meta under its own policies (in some cases as our processor, in others as its own controller). We use them only to answer you and solve your order or complaint. We keep the conversation for 12 months after the last message, or 3 years after the last message if it relates to an order or a complaint. Do not send us passwords, ID documents or card details. We do not send you ads on Instagram without your consent.

Children

We do not sell to people under 18 and we do not knowingly collect data from children.

Security

We use encrypted connections (HTTPS), access based on accounts and roles (the workshop sees only its own orders), backups, and strong passwords and two-factor authentication where available for administration accounts. If an incident puts your data at risk, we tell you and the authorities, as the law requires.

Changes to this policy

If we change this policy, we update the date at the top. If the change is important, we tell you by email.

01Who is the controller

02What data we process, why, and for how long

03Your certificate and your files

04Automatic checks and decisions

05If you order for someone else

06Who we share data with

07Transfers outside the European Union

08Cookies and browser storage

09Emails

10Your rights

11Is giving us your data required?

12Our Instagram, TikTok and Facebook pages

13Children

14Security

15Changes to this policy

Who is the controller

What data we process, why, and for how long

Your certificate and your files

Automatic checks and decisions

If you order for someone else

Who we share data with

Transfers outside the European Union

Cookies and browser storage

Emails

Your rights

Is giving us your data required?

Our Instagram, TikTok and Facebook pages

Children

Security

Changes to this policy