Privacy policy

Last updated: 29 September 2026

This privacy policy explains how TRUE TO SOLE S.R.L. uses your personal data when you visit truetosoleedit.com, buy from our shop True to Sole Edit, use your customer account and MY EDIT, use our forms or get in touch with us. It also explains how we use cookies.

In brief

  • We use your details to sell and deliver your piece, to answer you and to meet our legal duties. We never sell your personal data.
  • After you buy, your name is registered as the owner on the piece's public Vaultik certificate of authenticity. You can ask us to remove it at any time.
  • If you sign in to your customer account, MY EDIT shows you the pieces you bought, the pieces you saved and your requests. It shows only your own information, and only while you are signed in.
  • Analytics and marketing cookies only run if you accept them.
  • You can ask to see, correct or delete your data by writing to hello@truetosoleedit.com, through our contact form or by post to our registered office.

Who we are

The controller of your personal data is TRUE TO SOLE S.R.L., a Romanian limited liability company with its registered office at Str. Iosif Vulcan nr. 7, ap. 9, Oradea, jud. Bihor, România, Trade Register number J2023001287054, fiscal code (CUI) 48162961.

For any question about your personal data, write to hello@truetosoleedit.com, send a letter to our registered office or use our contact form. We have not appointed a data protection officer.

What we use your data for

For each situation below, you will find the data we use, why we use it and our legal ground under the EU General Data Protection Regulation (GDPR).

Visiting our website

Our shop runs on Shopify. When you browse, Shopify receives technical data such as your IP address, your device and browser, and the pages you view. We use it to show you the website and keep it secure (our legitimate interest, Article 6(1)(f) GDPR). Analytics and marketing cookies are used only with your consent (Article 6(1)(a)). See "Cookies and similar technologies" below.

Buying a piece

To take and fulfil your order, we use your name, email address, phone number, billing and delivery addresses, the pieces you order, the price and the payment status. Your card or wallet details are handled by the payment provider you choose, and we never see your full card number. We also receive payment confirmations from payment providers and delivery updates from the courier.

We use this data to perform our contract with you: to take payment, deliver your piece, keep you informed, and handle withdrawals, returns and guarantee claims. The courier receives your name, delivery address, phone number and email address so that it can deliver your parcel, send you tracking updates and collect your signature. Legal ground: our contract with you (Article 6(1)(b)). We issue and keep invoices and accounting records because Romanian tax and accounting law requires it (Article 6(1)(c)).

Every piece is one of one. As soon as you order, we record your name, email address, phone number and order number against the piece in our internal stock system. This marks the piece as sold wherever it is offered, so it cannot be sold twice. Once your payment is confirmed, we also record you as the owner of the piece. This record is what your MY EDIT account shows (see "Your MY EDIT account" below). Legal ground: our contract with you (Article 6(1)(b)).

Your certificate of authenticity

Every purchase includes a Vaultik digital certificate of authenticity. Vaultik is operated by Mintouge Limited (trading as Vaultik / Collect App), 86-90 Paul Street, London EC2A 4NE, United Kingdom. Shortly after your payment is confirmed, we automatically send Vaultik your first name, last name and email address. Your name is then registered on the certificate as the owner of the piece, and Vaultik emails the certificate to you.

The certificate page is public. Anyone who has its link, or who scans its QR code, can see the registered owner's name. The owner's name is also returned by Vaultik's public certificate service, which anyone can query without logging in.

  • If you would rather not have your name on the certificate, tell us at any time and we will have it removed. The certificate then stays registered to us.
  • If you withdraw from your purchase, we remove your name from the certificate.
  • If you later sell the piece, you can ask us to have the certificate registered to the new owner. This depends on Vaultik.

Legal ground: delivering the certificate to you is part of our contract (Article 6(1)(b)). Registering your name gives you a verifiable record of ownership, which is in your interest and ours (legitimate interest, Article 6(1)(f)). You can object at any time, as described above. Vaultik also handles your data under its own privacy notice, and you can contact it at privacy@vaultik.com.

Withdrawing from a purchase

If you use our online withdrawal function, we collect your name, email address and order number, the pieces concerned, any note you add and your language. We also record a reference number with the date and time. We use this to process your withdrawal, send you an acknowledgement by email and refund you. The same applies if you withdraw by email or letter. Legal ground: our obligations under consumer law (Article 6(1)(c)) and our contract with you (Article 6(1)(b)).

Private appointments

If you book a private viewing on our appointment page, we collect your name, email address and phone number, the pieces you would like to see, any note and your language. We use them to arrange and prepare your appointment and to contact you about it. Legal ground: steps you ask us to take before a possible purchase (Article 6(1)(b)).

Dream Bag requests and saved pieces

You can tell us about the piece you are looking for on our Dream Bag page, save a piece on its product page, or ask us to find something similar to a piece that has sold. When you do this through one of our forms, we collect your name and email address, your WhatsApp number if you give it, and the details of your request, such as brand, model, colour, size, leather, hardware, condition, budget, timing and any reference you share. We keep each request and each saved piece as a separate record. We compare your requests with pieces that become available to us and contact you when one may match. Legal ground: your consent (Article 6(1)(a)), which you can withdraw at any time.

If you are signed in to your customer account, you can also save pieces and make requests in MY EDIT. We then use your account instead of asking for your details, as described under "Your MY EDIT account" below.

We used to accept requests through a separate wishlist form outside this website. That form is now closed. Requests sent through it are kept in a Google Sheets spreadsheet and in our request system, and may include your phone number and Instagram handle.

Inner Circle

If you request an invitation to our Inner Circle, we collect your name, your email address and the line you write about yourself. We read every request personally and use your details to reply. If you join, we use them to offer you first views of new arrivals and private drops. Legal ground: steps you ask us to take in reply to your request (Article 6(1)(b)). If you join, we send you first views and private drops only with your consent (Article 6(1)(a)), which you can withdraw at any time.

Your MY EDIT account

MY EDIT is a private page in your customer account, which Shopify provides for our shop. Shopify handles the sign-in, for example with a one-time code that it emails to you, so you have no password with us and we never see your sign-in details. You do not need an account to buy from us or to send us a request.

How we recognise you. When you open MY EDIT, Shopify gives our system a short-lived, signed confirmation of which account is signed in, and we rely on nothing else. We also ask Shopify for the email address and first name on your account, and check them again regularly so that they stay current. We use the email address to connect your account to your client record with us, but only to a record that relates to True to Sole Edit, such as a purchase, a request or an Inner Circle membership. If there is none, we do not create a client record for you, and what you save or request in MY EDIT is kept with the email address and first name on your account. We never connect your account to a record by name or phone number, and if more than one record could match, our team checks them by hand before anything is shown. Orders you place in our shop are connected through the Shopify customer account on the order or, if there is none, the order's email address.

What MY EDIT shows you.

  • MY COLLECTION: the pieces you bought from us or from our related company in Hungary (see below). For each piece: its reference, brand and name, its condition, a photo, the month and the way you acquired it (online, in store, at a pop-up or privately), the purchase price we recorded for it (in euros, converted if you paid in another currency), details such as dimensions, what is included and the date code, and a link to its certificate of authenticity once the certificate is registered in your name.
  • WISHLIST: the pieces you saved, whether each one is still available and, if it is, its current price and a link to its product page.
  • MY REQUESTS: your Dream Bag requests, your requests for something similar to a piece that has sold and your Inner Circle requests, each with your note and its status (received, searching, match found or closed). When our team has found one of our pieces for you, MY EDIT can show it.
  • Your Inner Circle membership, if you are a member.

Which pieces appear, and when. A piece you buy from our shop appears once your payment is confirmed. A purchase that our team records for you, for example one made in person, at a pop-up or in a private sale, appears only after we have sent you a message by WhatsApp or email to say that it is waiting for you. This lets us catch a mistyped email address before anything is shown. The same applies to pieces sold to you by our related company in Hungary, which runs truetosole.hu and shares our internal stock and request system: we receive the record of that sale through the shared system and show it with your other pieces. A piece no longer appears once you have withdrawn from the purchase, the order has been cancelled or fully refunded, or we have recorded a new owner for it.

Requests sent with your email address. Anyone can type an email address into a form, so a form request is never added to your account automatically. If we hold requests or saved pieces that were sent through our forms with the email address of your account, MY EDIT shows only their type, date and brand, and asks whether they are yours. If you choose "Add", they join your account. If you choose "Not me", we do not offer them again.

What MY EDIT never shows. MY EDIT shows only information about you and your own pieces. It never shows another person's name or contact details, or our internal business records, such as notes, sourcing and costs.

Messages about MY EDIT. We may tell you, in your order confirmation or by WhatsApp or email, that a piece is waiting for you in MY EDIT, or that we have found a piece for one of your requests. These are service messages about your account, not marketing.

Protecting MY EDIT. To prevent abuse, we count how often each account uses MY EDIT within short periods and pause it briefly when a limit is reached. These counts are kept under technical codes, not under your name, email address or IP address. Like any website, our system receives your IP address and browser details when MY EDIT loads information from it, and we do not save them to our database. MY EDIT's technical logs do not contain your name, your email address or your sign-in details.

Legal ground. MY EDIT is part of the service you use when you sign in to your customer account. We recognise your account, show your pieces and handle what you save or request there in order to provide that service (our contract with you, Article 6(1)(b)), so MY EDIT does not ask for a separate consent tick. The checks that keep MY EDIT accurate and secure are also in our legitimate interest (Article 6(1)(f)). Requests and saved pieces that you send through our forms remain based on your consent, as described under "Dream Bag requests and saved pieces" above.

Your choices. You can remove a saved piece, which deletes it, or stop a request in MY EDIT at any time. You can also ask us for a copy of your MY EDIT information in a portable format, or ask us to delete it, by writing to hello@truetosoleedit.com or through our contact form. We then remove your name and contact details, your saved pieces and your requests, and your pieces no longer appear in your account. We keep only what the law requires us to keep, such as invoices and order records, for the periods set out under "How long we keep your data". If you ask us to close your customer account or to erase your data in our shop, we remove your details from MY EDIT in the same way.

Newsletter

If you sign up for our newsletter, we use your email address to send you news about new pieces and offers. If you also give us your birthday, which is optional and only the day and month, we use it to send you a birthday greeting with a personal offer, and our team receives a reminder a few days before. Legal ground: your consent (Article 6(1)(a)). Every newsletter has an unsubscribe link.

Contacting us

When you write to us by email, through the contact form, on WhatsApp or by post, we use your name, contact details and message to answer you. Legal ground: our contract with you where your message concerns an order (Article 6(1)(b)), and otherwise our legitimate interest in answering you (Article 6(1)(f)). WhatsApp is provided by WhatsApp Ireland Limited, which also processes your messages under its own privacy policy. For anything you may need to prove later, such as a complaint, please write by email or post.

Product safety

If a piece you bought is recalled, or a safety warning is issued for it, EU product safety law (Regulation (EU) 2023/988) requires us to tell you directly. We use the contact details from your order for this (Article 6(1)(c)). If you prefer, you can give us separate contact details to be used only for safety messages. If you report a safety concern, we record it in our register of safety complaints.

Security and legal claims

We and our providers use technical and order data to protect the shop, our forms and our customers from fraud and abuse. To block automated abuse of our forms, we hold your IP address in memory for at most one hour. It is never saved to our database. We use encrypted connections and give access to your data only to the people who need it. We also keep the data we need to establish, exercise or defend legal claims. Legal ground: our legitimate interests in security and in protecting our rights (Article 6(1)(f)).

Who receives your data

We share only what each recipient needs. Our service providers act on our instructions, except where we say that a provider also acts under its own privacy policy.

  • Shopify (Shopify International Limited, Ireland): our shop platform, checkout, customer accounts (including the sign-in codes and the account page that shows MY EDIT), contact form, newsletter sign-up and cookies. For Shop Pay, fraud prevention and some other features, Shopify acts under its own Consumer Privacy Policy.
  • Payment providers: Shopify Payments (with Stripe Payments Europe, Limited, Ireland), and Apple Pay, Google Pay or Shop Pay when you choose them. They also process payment data under their own terms.
  • Couriers that deliver your parcel.
  • Vaultik / Collect App (Mintouge Limited, United Kingdom), for your certificate of authenticity.
  • Vercel Inc. (United States), which hosts our internal stock, order and client-request system. This includes the appointment, withdrawal, Dream Bag, saved-piece and Inner Circle forms, and the information shown in MY EDIT.
  • Supabase Pte. Ltd. (Singapore), which provides that system's database. The database is hosted in the European Union (Sweden).
  • Telegram (Telegram Messenger Inc.), which our team uses for internal alerts about orders, certificates, appointments, withdrawals, client requests, MY EDIT accounts and birthdays. These alerts can contain your name, email address, phone or WhatsApp number, Instagram handle, birthday, order number, the pieces or request concerned and any note you add. Telegram also handles this data under its own privacy policy.
  • Google (Google Ireland Limited / Google LLC), which hosts the spreadsheet mentioned above.
  • The online form tool that ran our earlier wishlist form.
  • WhatsApp Ireland Limited, if you chat with us on WhatsApp or we message you there, for example about MY EDIT.
  • Our email and IT providers, our accountant and our professional advisers, where they need the data to support us.
  • Our related company in Hungary, which runs the shop truetosole.hu and shares our internal stock and request system.
  • Public authorities and courts, where the law requires it. Examples are the Romanian tax authority (ANAF), to which invoices are reported electronically, the consumer protection authority (ANPC) and market surveillance authorities.

Transfers outside the European Economic Area

Some recipients are based outside the European Economic Area (EEA) or may access data from there:

  • Shopify: Canada, which is covered by an adequacy decision of the European Commission. Other countries, including the United States, are covered by Shopify's Binding Corporate Rules and standard contractual clauses.
  • Vercel and Google: the United States, under the EU-US Data Privacy Framework (adequacy decision).
  • Supabase: Singapore, under the European Commission's standard contractual clauses. The database itself is in the EU.
  • Vaultik: Mintouge Limited is established in the United Kingdom, which is covered by an adequacy decision of the European Commission. Vaultik describes its own handling of your data in its privacy notice.
  • Telegram: Telegram Messenger Inc. is established outside the EEA, and no adequacy decision of the European Commission covers it. Telegram handles our team alerts under its own terms and privacy policy.

You can ask us for a copy of the safeguards at hello@truetosoleedit.com.

Cookies and similar technologies

Cookies are small files that your browser stores. On your first visit, a banner asks for your choice, and rejecting non-essential cookies is as easy as accepting them. You can change your choice at any time through the cookie settings link at the bottom of every page.

  • Essential: set by Shopify to run the shop, for example for your cart, checkout, customer account sign-in, security and cookie choice. They do not need consent.
  • Preferences: remember settings such as your language or region, and keep the list of pieces you recently viewed in your browser's local storage. Used only with your consent.
  • Analytics: Shopify's analytics, which show us how the shop is used. Used only with your consent.
  • Marketing: Shopify's marketing cookies and pixels, which measure the results of our marketing. Used only with your consent.

Shopify's Cookie Policy lists these cookies and how long they last, which ranges from the end of your visit up to one year.

Our website also keeps a few items in your browser's local storage so that its features work, such as your filter choices and a note of the pieces you have saved on this device. If you choose to sign in to save a piece, it also keeps a note of that piece, which is used only if you sign in within 30 minutes, so that the piece can be saved once you are signed in. These items stay on your device. When you save a piece, the save itself is sent to us, with your name and email address or through your account, and we handle it as described under "Dream Bag requests and saved pieces" and "Your MY EDIT account" above.

Legal ground: your consent for non-essential cookies (Article 6(1)(a) GDPR and Romanian Law no. 506/2004). Essential cookies, and the items stored for features you actively use (such as the pieces you save and your filter choices), are exempt from consent because they are strictly necessary for the service you request (Romanian Law no. 506/2004, which implements Article 5(3) of the ePrivacy Directive). Links to Instagram, TikTok and WhatsApp take you to those services, and their own privacy policies apply there.

How long we keep your data

  • Orders, withdrawals, the record of who bought each piece, and related messages: for as long as claims about the purchase can still be made, including claims under the legal guarantee, taking into account the limitation periods under Romanian law. The record of who bought each piece is also what your MY EDIT collection shows.
  • Invoices and accounting records: for the period that Romanian tax and accounting law requires.
  • Appointments: for as long as we need them to arrange, hold and follow up on your appointment. If you buy, the details stay with your order.
  • Dream Bag requests and requests for a similar piece: while your request is open. When a request is closed, because we found a piece for you, you stopped the search or we closed it, we remove your personal details from it 30 days later. If you withdraw your consent, we remove them without undue delay.
  • Saved pieces: until you remove them in MY EDIT, withdraw your consent or ask us to delete them.
  • Inner Circle: while we consider your request and, if you join, for as long as you remain a member. Once we have answered your request and closed it, we remove your personal details from the request itself 30 days later.
  • Your MY EDIT account: the link between your customer account and your client record, until your customer account with our shop is closed or you ask us to remove the link.
  • Newsletter: until you unsubscribe. We keep a record that you unsubscribed so that we can respect it.
  • Your birthday: until you ask us to remove it or you unsubscribe from our newsletter.
  • Your name on the certificate: until you ask us to remove it or you withdraw from your purchase. Vaultik keeps certificate data under its own privacy notice.
  • Safety complaints: no longer than 5 years.
  • Team notifications: for as long as we need them to deal with the order, request or birthday greeting they concern, after which we delete them from our team chat.
  • Other messages: as long as we need them to deal with your message.
  • IP addresses used to protect our forms: at most one hour.
  • Counts used to protect MY EDIT: at most 2 days.

Where we need data for a legal claim, we keep it until the claim is resolved.

Your rights

You have the right to:

  • access your personal data and receive a copy;
  • have inaccurate data corrected;
  • have your data deleted, for example when we no longer need it or you withdraw your consent;
  • restrict how we use your data in certain cases;
  • receive the data you gave us in a portable format, where we use it on the basis of your consent or our contract;
  • object at any time to our use of your data based on our legitimate interests, and to direct marketing;
  • withdraw your consent at any time, without affecting what we did before.

To use any of these rights, write to hello@truetosoleedit.com or to our registered office, or use our contact form. It is free of charge. We reply within one month. For complex or numerous requests, we may take up to two more months and will tell you why. We may ask you to confirm your identity.

You can also complain to a data protection authority, in particular in the EU country where you live or work, or where you believe the problem occurred. Our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro. The authorities of all EEA countries are listed on the European Data Protection Board's website.

What you need to give us

To buy from us, we need your name, email address, delivery and billing addresses, and payment. Without them we cannot accept your order. Our forms mark the required fields:

  • appointments: name, email address and phone number;
  • the online withdrawal function: name, email address and order number (you can also withdraw by email or letter);
  • Dream Bag, saved-piece and Inner Circle forms: name and email address;
  • MY EDIT, which is optional: an email address at which you can receive your sign-in code.

Everything else is optional.

Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Payment providers screen payments for fraud under their own responsibility. Vaultik's AI analysis assesses the piece, not you.

Changes to this policy

We update this policy when our practices or the law change, and the date at the top shows the latest version. If a change significantly affects how we use data you have already given us, we will let you know.