1. Controller and contact details
GLOBAL STORE MOBILE SRL
Tax ID: 44332613 · Trade Register: J06/678/2021
Strada Liviu Rebreanu nr. 13, Bistrița, Județul Bistrița-Năsăud, 420008, România
contact@pinkmobilegsm.ro · +40 724 051 122
2. Data that may be processed
Depending on the request, processed data may include: name, phone number, email address, company/website for partnerships, device brand and model, IMEI/S/N if provided, fault description, cosmetic condition, repair-ticket number, repair status and photographs used to document the device. Do not send passwords, unlock codes or other secrets through the form.
3. Purposes and legal bases
Data is used to answer enquiries, take requested steps before providing a service, perform and document the service, communicate about a repair, secure the application and meet legal obligations. Depending on the situation, the legal basis may be performance of a contract or pre-contractual steps requested by the person, a legal obligation, or legitimate interests in security, abuse prevention and the defence of rights. The checkbox in Contact confirms that this notice has been read; it does not make consent the legal basis for every processing activity.
4. Contact form
The message is validated on the server and sent by email to PinkMobileGSM. The website does not store the message content locally in a request database. The resulting email may remain in the controller’s mail system under its operational correspondence policy. The form uses CSRF protection, a honeypot, rate limiting and an anti-abuse timing check.
5. Repair records, photos and Status portal
Repair records and photographs are stored in the application’s private area outside public_html. The customer sees only the information intended for the client portal after authentication with the repair-ticket number and PIN. The PIN is stored only as a hash. Internal service notes are not exposed to the customer. Records and photos can be deleted administratively when they are no longer needed, taking into account the service performed, warranties and applicable legal obligations.
6. Cookies, sessions and technical data
Ordinary public pages do not start a session. Separate technical sessions are used for Contact, Status and Admin. To limit abuse, identifiers derived from the IP address are temporarily used in private files. Unused rate-limit files are automatically cleaned after approximately 48 hours. This build does not include Google Analytics, Meta Pixel, Hotjar, Clarity or other advertising/behavioural-tracking systems.
7. Recipients and technical providers
Data may be accessed by authorised controller personnel and, to the extent technically necessary, by providers used for hosting and email. If shipping is arranged, the data required for delivery may be shared with the selected courier. The website does not sell personal data and does not intentionally send contact-form content to social networks. The exact list of active technical providers can be requested from the controller using the contact details above.
8. External services and transfers
Google Maps loads only after an explicit user action. Facebook, Instagram, TikTok and WhatsApp links open external services only after user action. Those providers apply their own policies. If a technical provider used by the controller involves a transfer outside the EEA, that transfer must rely on an applicable legal mechanism; details can be requested from the controller.
9. Data retention
There is no single retention period that applies to every data category. Contact messages are not stored in a local database, although resulting emails may be kept under the correspondence policy. Repair records and photos are kept for as long as necessary to perform and document the service, handle warranties, defend rights and meet legal obligations, and can then be deleted from Admin. The Admin log is rotated by size and is designed not to include passwords, PINs, IMEI/SN, customer contact details, messages or internal notes.
10. Security
Production uses HTTPS, security headers, CSRF protection, rate limiting, separate sessions, hashed passwords and PINs where applicable, private data outside the web root, and validation/re-encoding for uploaded images. The Admin panel supports optional TOTP two-factor authentication, with recovery codes stored only as hashes.
11. Your rights
Subject to the GDPR and applicable law, you may request access, rectification, erasure, restriction, portability or objection where applicable. To exercise your rights, contact the controller using the details in section 1 and provide enough information to identify the relevant record safely.
12. Complaint to the supervisory authority
If you believe your personal data is processed in breach of applicable law, you may lodge a complaint with Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), 28–30 G-ral. Gheorghe Magheru Blvd., District 1, 010336 Bucharest, email: anspdcp@dataprotection.ro, phone: +40 318 059 211 / +40 318 059 212. ANSPDCP ↗
13. Automated decisions
The website does not make decisions producing legal or similarly significant effects on customers solely through automated processing and does not perform commercial profiling in this build.
Last updated: 20 September 2026.
