Privacy policy
Last updated: 2 November 2026.
1. Who is responsible for your data
The data controller is SC Dermo Line SRL (Nomasvello Mega Mall Point), VAT ID RO36144040, Trade Register No. J40/7606/2016, registered office Calea Moşilor 131, Sector 2, Bucharest; place of business: Mega Mall Bucharest, Bd. Pierre de Coubertin 3-5, Level -1, Sector 2. For any question about your data: megamall@nomasvello.ro or 0722 227 893.
2. What data we use, why and for how long
| When | What data | Why | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|---|
| Online booking (EvoBeauty), by phone or on WhatsApp | name, phone, email, service, date and time | setting up and confirming your appointment, appointment notices | contract (Art. 6(1)(b)) | while you are our client and then as long as needed for possible complaints |
| Purchase on the website (packages, memberships, gift cards) | name, email, phone, billing address, the order | providing the service, invoicing | contract and legal obligation (Art. 6(1)(b) and (c)) | accounting documents, as long as tax and accounting law requires |
| Contact form | name, email, phone, your message | answering your question | legitimate interest in replying to you (Art. 6(1)(f)) | as long as needed to handle the request |
| Newsletter (email) | email address, which emails you open | information about treatments and offers | consent (Art. 6(1)(a)) | until you unsubscribe (link in every email) |
| Browsing the website | cookies and online identifiers (see the Cookie Policy) | running the website; statistics and ad measurement | strictly necessary: legitimate interest; analytics and marketing: your consent in the banner | see the Cookie Policy; Google Analytics statistics are kept for 14 months |
Health data. We do not ask for health data on the website. If, at the salon, you tell us health information relevant to your treatment (for example contraindications), we use it only for the safety of the treatment, with your explicit consent (Art. 9(2)(a)), and we do not share it for marketing.
Contact details are needed to make your booking or order; without them we cannot confirm it. We do not make automated decisions with legal effects on you.
3. Who else receives the data
We work with providers who process data on our behalf, only for the service they provide to us:
- Shopify (Shopify International Ltd., Ireland): the website platform, orders, customer accounts, card payments through Shopify Payments;
- EvoBeauty (live.evobeauty.ro): the online booking system;
- NETOPIA Payments: payment processing, including instalments through Oney or PayPo, when you choose these options;
- Klaviyo (USA): sending the newsletter;
- WhatsApp (Meta): when you write to us on WhatsApp;
- only with your consent in the cookie banner: Google (Google Analytics, Google Ads), Meta (Facebook, Instagram), Microsoft (Clarity) and OpenAI (ads in ChatGPT), for statistics and ad measurement;
- our accountant and invoicing provider, for tax documents; public authorities, only when the law requires it.
We do not sell your data.
4. Transfers outside the EU
Some providers (Google, Meta, Microsoft, OpenAI, Klaviyo, Shopify) may also process data in the USA, under the EU–US Data Privacy Framework (DPF) or standard contractual clauses approved by the European Commission.
5. Your rights
You have the right to access your data, have it corrected or deleted, restrict processing, receive your data (portability) and object to processing based on legitimate interest. You can withdraw your consent at any time (from the unsubscribe link, from “Cookie preferences” in the website footer, or by writing to us), without affecting processing carried out before. Write to us at megamall@nomasvello.ro; we will reply within one month.
You can lodge a complaint with the Romanian data protection authority (ANSPDCP), www.dataprotection.ro.
6. Security and minors
The website uses an encrypted connection (HTTPS), and card payments are processed directly by the payment processor; we do not see or store your card details. The website is not intended for children under 16; we do not knowingly collect their data without the consent of a parent or guardian.
7. Changes
We may update this policy when we change how we handle data. The current version is always on this page, with the date of the last update.