Privacy Policy

Last updated: July 3, 2026

Introduction

This Privacy Policy describes how DRIMSSY (the "Site", "we", "us", or "our") collects, uses, and discloses your personal information when you visit, use our services, make a purchase, or otherwise communicate with us. This Privacy Policy supplements our Terms of Service with respect to the handling of your personal information. DRIMSSY SRL CUI: 52129815 VAT: RO52129815 Registered Address: Jud. Brașov, Sat Hărman, Comuna Hărman, Strada Livezii, Nr. 22, 507085, Romania Email: official@drimssy.com Our platform is built on a custom technology stack using React and FastAPI. Payments are securely processed by Stripe. We do not store your full payment card details on our servers — all payment data is handled directly by Stripe in compliance with PCI DSS standards.

Personal Information We Collect

When you visit our site, use our services, make a purchase, or communicate with us, we collect the following categories of personal information: Contact Details — name, billing and shipping addresses, phone number, and email address. Financial Information — payment transaction records. Full card numbers and payment details are processed and stored by Stripe and are never stored on our servers. Account Information — username, password, security questions, and preferences. Transaction Information — items viewed, cart contents, wishlist, and purchase history. Communications — customer support inquiries and correspondence. Device Information — device type, browser, IP address, and unique identifiers. Usage Information — how you interact with our services, pages visited, and browsing patterns.

How We Collect Information

We collect personal information from the following sources: • Directly from you — when you create an account, make a purchase, subscribe to our newsletter, or contact us. • Automatically — through cookies, analytics, and similar technologies when you use our services. For more details, see our Cookie Policy (/cookie-policy). • From service providers — including Stripe (payment processing), shipping partners, and analytics tools. • From partners and third parties — marketing and advertising partners.

Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your personal information based on the following legal grounds as set out in Article 6(1): • Consent — Art. 6(1)(a) — for sending marketing communications, newsletters, and for placing non-essential cookies on your device. You may withdraw consent at any time. • Contract Performance — Art. 6(1)(b) — for processing your orders, managing your account, providing customer support, and fulfilling our contractual obligations to you. By placing an order, your personal data (name, email, phone number, shipping address) will be processed for order fulfillment, delivery, and customer support. This data is stored securely and used only for these purposes. You can request deletion of your data at any time by contacting official@drimssy.com. • Legal Obligation — Art. 6(1)(c) — for maintaining tax and accounting records as required by Romanian law and EU regulations. • Legitimate Interests — Art. 6(1)(f) — for fraud prevention, platform security, website analytics, and improving our services. We balance our interests against your rights and freedoms.

How We Use Your Information

We use your personal information for the following purposes: Service Provision — account management, order fulfillment, payment processing via Stripe, and providing a customized experience. Marketing — sending promotional communications via email, text, and targeted online advertising. You can opt out of marketing emails at any time. Security — fraud prevention, account authentication, and detection of illegal activity. Communication — responding to your inquiries, customer support, and maintaining our business relationship. Legal Compliance — responding to legal requests, maintaining tax records, and enforcing our policies.

Marketing & Advertising Communications

We use your personal information to keep you informed about our products, offers, and campaigns. We want to be transparent about how and when we may contact you. Existing customers (soft opt-in) — if you have purchased a product from us, we may send you marketing about our own similar products and campaigns based on our legitimate interest, in accordance with Article 6(1)(f) GDPR and applicable ePrivacy rules. Every such message includes a clear, one-click way to opt out. Newsletter and prospects — where you subscribe to our newsletter or otherwise provide your details without buying, we send marketing based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time. Channels — with the appropriate legal basis, we may contact you by email, SMS, push notification, and messaging platforms, and we may target and personalise advertising shown to you on third-party platforms. Personalisation — we may use your purchase history, browsing behaviour, and preferences to tailor the offers, product recommendations, and advertising you see, so that they are more relevant to you. Your control — you can opt out of marketing at any time using the unsubscribe link in any message, your account preferences, or by emailing official@drimssy.com. Opting out of marketing does not stop essential service messages about your orders, account, or legal notices.

Cookies, Analytics, Profiling & Personalised Advertising

To operate, measure, and promote our store, we and our partners use cookies and similar technologies to analyse how our Website is used and to deliver relevant advertising. Analytics and advertising partners — with your consent for non-essential cookies, we may share online identifiers, device data, and browsing activity with third-party analytics and advertising providers, which currently may include Google (Google Analytics and Google Ads), Meta Platforms (Facebook/Instagram Pixel), and TikTok. These partners help us understand traffic, measure campaign performance, and show you our ads on their platforms. Retargeting and audiences — we may build audiences and use retargeting and 'lookalike' audience tools so that people who have visited our Website, or who resemble our customers, see our advertising on other websites, apps, and social platforms. Profiling — we may create a profile based on your interactions with us, such as products viewed, cart activity, and purchase history, to personalise content, recommendations, and advertising. This profiling is used for marketing and service improvement only. We do not make decisions producing legal or similarly significant effects on you based solely on automated processing. Your control — you can manage or refuse non-essential cookies at any time through our cookie banner and your browser settings, and you have the right to object to profiling for direct marketing at any time by contacting official@drimssy.com. For full details, see our Cookie Policy (/cookie-policy).

mi mi Missions & Community Content

If you take part in our MiMi Missions community challenges — by submitting an entry, pitching a mission idea, or taking a mission — we process the following personal data: What we collect — your name, email address, social media handle (if provided), the link to your public post, the photo or video content you create, the mission you selected, and technical data such as your IP address (used to prevent abuse and rate-limit submissions). Why we use it — to operate the Program; to review submissions and to identify and contact reward recipients; to pay rewards; and, based on the consent and content licence you grant when you submit, to use, edit and display your content and handle in our marketing, including on our website, on social media and in paid advertising. Legal bases: your consent, the performance of the campaign terms (contract), and our legitimate interest in promoting our products. Retention — we keep entries and mission ideas for as long as needed to run and evidence the campaign and to support the ongoing use of licensed content, after which they are deleted or anonymised, unless a longer period is required by law. Your choices — you may withdraw consent, or ask us to stop using your content or to delete your submission, at any time by contacting official@drimssy.com. Withdrawal does not affect processing carried out beforehand, or content already published in reliance on the licence where removal is not reasonably possible. Missions are for participants aged 18 or over (or with verifiable parental or guardian consent).

Reviews, Photos & User-Generated Content

When you submit a review, rating, comment, photo, video, testimonial, or other content to us or about our products (including by tagging us on social media), we process the personal data contained in that content, such as your name or username, your image, and the opinions you share. How we use it — by submitting such content, you grant DRIMSSY SRL a worldwide, royalty-free, transferable, and sub-licensable licence to use, reproduce, adapt, publish, and display that content and your associated name or handle for marketing, advertising, and promotional purposes, on our Website, in our communications, and on our social media and advertising channels. You confirm you own or control the rights to the content and that it does not infringe the rights of any third party. Your control — you can ask us to remove your published review or content at any time by contacting official@drimssy.com. Where content has already been reproduced in materials that cannot reasonably be recalled (for example, printed or previously distributed advertising), removal may not be fully possible, but we will stop further use going forward.

How We Share Your Information

We may share your personal information with: • Service Providers — Stripe (payment processing), IT providers, analytics tools, and shipping partners who help us operate our business. • Marketing Partners — for advertising purposes, with your consent where required. • Third Parties — at your direction or with your consent. • Corporate Affiliates — entities within our corporate group. • Legal Parties — when required by law or to protect our rights. You can opt out of targeted advertising through our privacy settings.

Business Transfers & Corporate Restructuring

If DRIMSSY SRL is involved in a merger, acquisition, financing, reorganisation, insolvency, or sale of all or part of its assets or business, your personal information may be transferred to the successor or acquiring entity as part of that transaction, or shared during due diligence in contemplation of it. Any such recipient will be required to honour the commitments made in this Privacy Policy, or you will be notified and given any applicable choices before your personal information becomes subject to a materially different privacy policy.

International Data Transfers

Some of our service providers, including Stripe, are based outside the European Economic Area (EEA). When your personal data is transferred to countries outside the EEA that do not benefit from an adequacy decision by the European Commission, we ensure appropriate safeguards are in place. For transfers to Stripe and other US-based processors, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, as well as any additional supplementary measures necessary to ensure an adequate level of data protection.

Data Retention

We retain your personal information for specific periods depending on the category and purpose: • Order data — 10 years from the date of the transaction, as required by Romanian tax and accounting legislation. • Customer account data — retained for the duration of your account. Upon account deletion, data is permanently removed within 30 days. • Payment data — full payment card details are handled entirely by Stripe and are not stored on our servers. Transaction references are retained alongside order data. • Cookie preferences — 12 months from the date of your last preference setting. • Marketing consent records — retained until you withdraw your consent. After the applicable retention period expires, your data is securely deleted or anonymized.

Third-Party Links & Cookies

Our site may contain links to third-party websites that are not operated by us. We do not control and are not responsible for the privacy practices of these websites. We encourage you to review the privacy policies of any third-party sites you visit. Information shared on public platforms may be viewable without restrictions. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy (/cookie-policy).

Children's Privacy

Our services are not intended for children under the age of 16, in accordance with Article 8 of the GDPR as implemented under Romanian law. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at official@drimssy.com so we can promptly delete it. If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will take steps to remove that information from our servers.

Security & Data Breach Notification

We implement appropriate technical and organizational measures to protect your personal information, including encryption, access controls, and regular security assessments. However, no security measures are perfectly impenetrable, and information transmitted over the internet may be vulnerable. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (ANSPDCP) without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with Article 34 of the GDPR.

Your Rights & Choices

Under the GDPR, you have the following rights regarding your personal information: • Right of Access (Art. 15) — request what personal information we hold about you. • Right to Rectification (Art. 16) — request correction of inaccurate data. • Right to Erasure (Art. 17) — request deletion of your personal information. • Right to Restriction (Art. 18) — limit how we use your personal information. • Right to Data Portability (Art. 20) — receive copies of your data in a structured, machine-readable format or request transfer to a third party. • Right to Object (Art. 21) — object to processing based on legitimate interests or for direct marketing purposes. • Right to Withdraw Consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. • Manage Communications — unsubscribe from promotional emails at any time. To exercise any of these rights, please contact us at official@drimssy.com. We will respond to your request within one month, as required by the GDPR. We recognize Global Privacy Control (GPC) preference signals where applicable. Note that non-promotional emails about your account and orders will continue regardless of your marketing preferences.

Right to Lodge a Complaint

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Romanian supervisory authority: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania Email: anspdcp@dataprotection.ro Website: www.dataprotection.ro You also have the right to lodge a complaint with the supervisory authority in your country of residence if you are located in another EU/EEA member state.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at: DRIMSSY SRL CUI: 52129815 VAT: RO52129815 Email: official@drimssy.com Address: Jud. Brașov, Sat Hărman, Comuna Hărman, Strada Livezii, Nr. 22, 507085, Romania