Solutions · Online commerce

AI voice agents for e-commerce.

Taking and initiating calls, with configured sources and actions. This page places the service mechanism alongside the rules that apply in online commerce — without claiming a project we have not done.

Discuss your scenario

Starting point

What online commerce looks like before any software

An online shop is not one system, but three that do not know each other. The storefront, with the catalogue and prices. The order system, which may be a spreadsheet. And the messaging thread through which half the sales are actually made — that is where the size is negotiated, the product photo is sent, the address is dictated. The third does not appear in any shop diagram, although it contains exactly the same data as the second and more than the first.

The order gathers, in five fields, more than it seems: name, phone number, address, floor, intercom code, sometimes an instruction about who opens the door or at what time nobody is home. All of them were collected so that a parcel would arrive on a particular day. All of them remain in the orders table as much as the price and quantity, because nobody ever separated data with a one-day purpose from data with a purpose of several years.

The abandoned basket is the best-defined example of processing that nobody declares. Someone entered the email address at step two and changed their mind at step three. There is no order, no contract, no account — but there is a row in a database and, in many shops, an automated sequence of messages that goes out in the next hour. The tool was bought as a marketing function, so nobody wrote its legal basis, or its term, or how it stops.

Withdrawal from an order is handled through discussion, not through procedure. The client writes that they want to return it, someone replies that it is possible if the product is unopened, it is negotiated who pays the transport, and if the discussion goes badly the phrase “our policy” appears. Throughout all this time, the rights and terms are already set by law, and the information that should have been given before the order is missing from the page — which does not cancel the right, but extends it.

Above all this is a layer the shop does not see: tracking tags, remarketing pixels, synchronised audience lists sent to advertising platforms. Each was added with a line of code, on a date, by someone who no longer works there. The data goes to other recipients, sometimes to other states, and the cookie banner on the site — copied from another site — promises a behaviour the page does not have.

The order of a call, with the branch that costs nothing

Regulile

What applies in online commerce, with the article it comes from

Each rule below carries the normative act that imposes it. Verification does not require you to take our word for it.

Pre-order information is not website content, it is a contractual clause

Before a distance contract produces binding effects, the trader must provide, in a clear and intelligible manner, a long, enumerated list: the main characteristics, the full name in Romanian and the state identification number — IDNO for a legal person, IDNP for a sole trader — the registered office address, telephone number and email address, the total price including all taxes and the additional transport costs, the payment and delivery methods and the delivery deadline, the conditions, term and procedures of the right of withdrawal together with the standard form, who bears the cost of return, the cases in which the right is lost, the mention of the legal guarantee of conformity, the duration of the contract and the conditions for termination, and the possibility of using an out-of-court complaint-resolution procedure. This information forms an integral part of the contract and may not be changed unless the parties expressly agree otherwise. It is presented in Romanian. And the burden of proving that it was provided lies with the trader.

SourceCivil Code No. 1107/2002, art. 1015 para. (1) items a)–t), paras. (5), (7) and (9); art. 1013 (definition of “distance contract”)

The order button has a required text, and the sanction is not the fine

If a distance contract concluded by electronic means obliges the consumer to pay sums, the key information must be brought to their attention “in a clear and highly visible manner, immediately before they place the order”, and on web pages it “is displayed in the immediate vicinity of the confirmation required to place the order”. The button is labelled legibly only with “Order with obligation to pay”, “Buy now”, “Pay now”, “Confirm purchase” or another unambiguous wording indicating the obligation to pay. The consequence written in the law text, if the rule is breached: “the consumer has no obligation under the contract or the order”. Separately, the pages through which electronic commerce is carried out must clearly and legibly indicate, no later than the start of the ordering process, whether delivery restrictions apply and what the accepted means of payment are.

SourceCivil Code No. 1107/2002, art. 1017 paras. (2), (3), (4) and (5)

The withdrawal period is 14 days, but the missing information makes it 12 months and 14 days

The consumer has the right to withdraw from the distance contract without giving reasons. The period is 14 days and runs differently depending on the subject matter: for services, from the day after the conclusion of the contract; for sales, from the day on which the consumer or a third party indicated by them takes physical possession of the goods; for an order with several goods delivered separately, from the last good; for periodic deliveries, from the first good. The part that changes the risk calculation is elsewhere: if the trader has not provided the information on the right of withdrawal, the period expires 12 months from the end of the initial period; if the information is provided within those 12 months, the period expires 14 days after receipt of it. A text missing from the page is not a drafting omission, it is an exposure that lasts a year.

SourceCivil Code No. 1107/2002, art. 1053 para. (1), art. 1054 para. (2), art. 1059 para. (1), art. 1060 para. (1) items a)–f), art. 1061 paras. (1) and (2)

Withdrawal may not be conditioned by a questionnaire

The consumer notifies the decision either by the standard form provided in Annex No. 6 to the law implementing the Civil Code, or by any other unequivocal notification. The professional may provide an electronic form on its own page — but then it must promptly communicate, on a durable medium, the acknowledgement of receipt, and if it requests additional information, “the additional questions shall be presented separately, it being possible to submit the statement without providing answers to such questions”. The professional shall refund all amounts received, including the delivery costs to the consumer, without unjustified delay and within no more than 14 days from the date on which it is informed, in the same currency and using the same payment methods. It may withhold the refund until it receives the goods or proof of shipment — no longer.

SourceCivil Code No. 1107/2002, art. 1062 paras. (1) and (2), art. 1057 paras. (1) and (2), art. 1063 para. (2)

The exclusions from withdrawal are exhaustively listed, not a shop policy

The law lists the cases in which the right does not apply: goods personalised or made according to the consumer’s individual choices; goods liable to deteriorate or expire rapidly; sealed goods that cannot be returned for health protection or hygiene reasons and that have been unsealed; sealed audio or video recordings or software unsealed after delivery; services fully performed with prior express agreement and acknowledgement of the loss of the right; digital content not supplied on a tangible medium, under the same conditions; catering services or services related to leisure, where the contract provides a specific date or period of performance. The exception for fully performed services does not apply if the professional did not obtain explicit consent, but inferred it from pre-ticked options that the consumer had to reject. What is not on the list cannot be excluded by a paragraph in the shop terms.

SourceCivil Code No. 1107/2002, art. 1065 para. (1) items a)–m) and para. (2); art. 1018 para. (2)

The abandoned cart has two separate questions, in two different laws

First: on what basis do you keep the entered address when there is no order. It is not performance of a contract, because there is no contract; what remains is legitimate interest, which is a valid basis, but it comes with the person’s right to object at any time, for personal reasons, including the creation of profiles based on this provision — and if they object, the controller no longer processes, except where it demonstrates legitimate and compelling grounds that override. The second question is about the message itself, and its answer is not in data law: sending commercial communications by electronic mail is prohibited, except where the recipient has given prior consent. A processing ground does not remove a ban on sending. And the right to object must be brought to attention explicitly, clearly and separately from any other information, at the latest at the first communication.

SourceLaw 195/2024, art. 6 para. (1) lit. f), art. 21 para. (1)–(5), art. 4 (definition of “direct marketing”); Law 284/2004, art. 22 para. (1) and (2)

Marketing cookies have their own legal provision in the Republic of Moldova

No need for analogies with European regulations: providers of information society services must make public the terms and conditions of processing and provide detailed information, including “the mechanisms and mode of monitoring the consumer’s online activities (cookies) for marketing purposes, the procedure for obtaining consent for such practices”, “the right to refuse the collection of personal data” and “the method of withdrawing consent”, plus the categories of information collected, the purpose, the cases of disclosure to third parties and the contact point. On top of that, data law treats the online identifier as an element by which a person becomes identifiable, and withdrawal of consent must be possible as easily as giving it — which means that a banner with a visible “Accept” and refusal hidden in two screens does not meet the condition.

SourceLaw 284/2004, art. 10 para. (2) lit. b), c), d), e), f), g) and h); Law 195/2024, art. 4 (definition of “personal data”, online identifier), art. 7 para. (2) and (3)

The seller’s identity is published, not hidden behind a form

The service provider is obliged to ensure recipients and control authorities easy, direct and permanent access to authentic information about itself, in electronic format, in Romanian: the full name with the legal form, the state identification number, the registered address, the email address and contact telephone number, the number and term of the authorisation if the activity requires it, the VAT code, shipping conditions, prices with an indication of discounts and whether taxes are included or not, whether delivery costs are included or not and their amount, payment terms and the validity period of the offer and the price. The same obligation appears, in different wording, in the pre-contractual requirements of the Civil Code — and if the two conflict, the provisions of the Civil Code section apply.

SourceLaw 284/2004, art. 12 para. (1) lit. a)–i), k) and l); Civil Code no. 1107/2002, art. 1015 para. (1) lit. b), c) and e), para. (8)

Mecanica

What AI voice agents actually do

The same capabilities that appear on the service page, where each has its own file and back-end line.

The session is requested from the platform, not from the voice provider

The page sends `POST /functions/v1/widget-voice-session` with the widget's public identifier and receives a signed URL back. It never has the agent identifier or any key. The wrong variant — `startSession({ agentId })` directly in HTML — completely bypasses the platform's session, credit and log layer, and exposes the agent to anyone who opens the page source. It is the first check we make on any implementation we take over.

The microphone is requested before the session, so a refusal costs nothing

The order is fixed and it matters: request the microphone with `getUserMedia({audio:true})`, and only if the person accepts request the session. If the visitor refuses, no signed URL is issued and no minute is consumed. The microphone request is made inside the button press, before any wait that could outlast the gesture — otherwise the browser ignores the request.

The agent can be interrupted, and this is adjusted with numbers

On OpenAI Realtime: semantic speech detection, threshold 0.5, 300 ms cushion, 500 ms of silence, interruption enabled by default. On ElevenLabs: the `interruption` event is passed to the controller to stop playback. On top of that, per-agent `turn_timeout` decides after how much silence the agent considers it is their turn — 15 seconds by default, tightened to 12 on a sales agent. And a client-reported “I can’t interrupt it” often has another cause than the thresholds: responses that are too long. We address that in the prompt and in the token limit, not in speech detection.

Call tools during the conversation

The agent is not trapped in what it knows. It can call server functions while speaking — to read availability, write an appointment, send an SMS, or query a catalogue. Tools are declared per agent, with typed parameters and their own execution timeout, so a slow tool does not block the conversation.

Handing off to a human is part of the scenario, not an exception

In messaging, handover to a colleague has its own state on the thread — `handoff_status`, handover time, reason, who is assigned, resolution notes — implemented in a dedicated 619-line module. On the phone, the transfer is handled by the switch: blind transfer via `##` and assisted transfer via `*2`, with the call landing in a dialplan context written for that purpose. These are two different mechanisms because they are two different channels; we write both into the scenario.

The engine and the voice are chosen explicitly, not implicitly

Four supplier positions: `elevenlabs`, `openai-realtime`, `gemini-live` and `auto`. For speech synthesis in languages other than English, the default is `eleven_flash_v2_5` — 32 languages, around 75 ms; the higher-quality version, `eleven_turbo_v2_5`, is around 250 ms. On OpenAI Realtime there are ten voices and engines up to `gpt-realtime-2.1`. The choice is a field in the agent configuration, not an assumption on our part.

The service, in detail

The data

What every system in the industry addresses

The data classes held by e-commerce, with the basis for retention where the law provides it.

Order and delivery details: Name, phone number, full address, floor, intercom code, notes for the courier. The legal basis is performance of the contract or steps taken at the request of the person before the contract, so the legal side is straightforward. The difficult part is the principle of data minimisation: the data must be adequate, relevant and limited to what is necessary in relation to the purpose. The intercom code has a purpose that ends on the day of delivery; the order number has a purpose that lasts longer. A single table, in which all fields have the same lifespan, treats the two the same because no one separated them, not because the law would require that.Keep: Determined by purpose, with planned terms by categories that are expressly included in the record of processing activities. The specific term imposed by accounting and archiving obligations for the documents accompanying the order remains unverified in this dossier — we were unable to open those texts on the day of verification.SourceLaw 195/2024, art. 6 para. (1) lit. b), art. 5 para. (1) lit. c) and e), art. 30 para. (1) lit. c) and f)
Customer account and order history: Authentication data, saved addresses, the list of previous orders. It is the set that makes it possible to repeat an order and, at the same time, the one that feeds recommendations. The distinction that matters: keeping the history so that that customer can consult it is a continuation of the relationship with them; using the same history to assess preferences, behaviour or economic situation is profiling by the law’s definition, so a different purpose, with its own notice. The compatibility of a new purpose is assessed by explicit criteria, including the link with the initial purpose, the context of the relationship and the possible consequences for the person.Keep: As long as the account is active and as long as the contractual relationship requires. The criteria for determining the period must be communicated to the person at the time of collection if the exact period cannot be indicated.SourceLaw 195/2024, art. 4 (the definition of “profiling”), art. 6 para. (5), art. 13 para. (2) lit. a), art. 5 para. (1) lit. b)
Abandoned cart: An email address or phone number, the selected products, the moment of interruption, sometimes a session identifier linking the row to subsequent visits. It is not an order and it is not an account; it is a standalone processing operation, with its own purpose, which must be described in the record with its real purpose. When the basis is legitimate interest, the information at the time of collection must say what legitimate interests are being pursued — that is, the shop is obliged to write, in words, why it keeps the address of someone who did not buy.Keep: Short and explicit, by the nature of the purpose: recovery of a purchase intent has a window of days, not years. The term is decided and written down; the right to object may end it at any time, and from that moment the data are no longer processed for that purpose.SourceLaw 195/2024, art. 6 para. (1) lit. f), art. 13 para. (1) lit. c) and d), art. 21 para. (1)–(3), art. 30 para. (1) lit. b) and f)
Online identifiers and tracking tags: Cookies, device identifiers, remarketing pixels, synchronised audience lists with advertising platforms. The law’s definition expressly includes the online identifier among the elements by which a person becomes identifiable, so the discussion “these are not personal data, they are just cookies” ends at the level of definition. What is added: each platform to which the list is sent is a recipient, and the recipients or categories of recipients are communicated to the person at the time of collection, together with the intention to transfer to another state and the safeguards on which the transfer relies.Keep: Determined by the declared marketing purpose and limited by withdrawal of consent, which must be as easy as giving it. The categories of recipients and transfers are included in the record of processing activities.SourceLaw 195/2024, art. 4 (the definition of “personal data”), art. 7 para. (3), art. 13 para. (1) lit. e) and f), art. 30 para. (1) lit. d) and e); Law 284/2004, art. 10 para. (2) lit. f)
The conversation thread with the customer: The messages through which size is negotiated, a photo of the defective product is sent, the address is dictated, it is explained for whom the gift is. The content is largely the same as the order, but with one important difference: it is a free field, and free fields collect data that nobody asked for, including, occasionally, health reasons for a return. The place is not the shop’s; it is the infrastructure of a channel provider, often in another state — so the provider is a processor and requires a written contract with the subject, duration, nature, purpose, type of data and categories of data subjects, and the storage location falls under the transfer regime.Keep: Undefined in practice, because the threads remain in the application. Exactly for this reason, the term must be decided explicitly and written into the record, not left to the application’s implicit behaviour.SourceLegea 195/2024, art. 28 alin. (3), art. 44 alin. (2), art. 9 alin. (1), art. 30 alin. (1) lit. f)
The cancellation and refund file: The revocation statement or completed standard form, the acknowledgement of receipt sent on a durable medium, proof of dispatch of the goods, and sometimes a bank account for reimbursement when the initial payment cannot be reversed. The law requires reimbursement to be made in the same currency and using the same means of payment as those used by the consumer, except where they have expressly agreed to another method — so an IBAN collected implicitly, without that agreement, is a collection that was not necessary. The burden of proof regarding the exercise of the right of revocation lies with the consumer, which makes the acknowledgement of receipt not just a courtesy, but a piece of the dossier.Keep: Related to the period during which the mutual obligations from revocation may be challenged. Processing necessary for the establishment, exercise or defence of a right in proceedings is an express limit to the right to erasure, so the term is justified by that purpose, not by habit.SourceCodul civil nr. 1107/2002, art. 1057 alin. (2), art. 1054 alin. (4), art. 1062 alin. (2); Legea 195/2024, art. 5 alin. (1) lit. c), art. 17 alin. (3) lit. e)

Limbajul

The words people there use

An agent that says “programming” where the industry says otherwise is immediately heard as foreign. That is why vocabulary goes into configuration, not into the glossary at the end.

Distance contract: The contract negotiated and concluded between a trader and a consumer within an organised distance sales system, without the simultaneous physical presence of the parties, using exclusively one or more means of distance communication — including any order placed by the consumer that produces binding effects on them. An online shop falls here by definition, and so does a sale concluded entirely via messaging.
Revocare: The law’s term for what the market calls a „return” or „cancellation”. The difference is not stylistic: withdrawal extinguishes the obligations of both parties and generates no cost and no liability for the consumer, except for the exceptions expressly provided. A „return” refused on the basis of an internal policy and a refused withdrawal do not have the same consequences.
Trader / consumer: The pair on which the whole chapter rests. The consumer is the natural person acting predominantly for purposes outside their business or professional activity. When the buyer is a company, the withdrawal rules here do not apply — which is why the same platform may have two different flows for the same product.
Order with obligation to pay: One of the formulations the law accepts for the final button, alongside „Buy now”, „Pay now” and „Confirm purchase”. This is not a copywriting recommendation: if the button does not unambiguously indicate the obligation to pay, the consumer has no obligation under the order.
Durable medium: The form in which the law requires certain information and confirmations to be sent. It matters because an ephemeral message in a chat app and an e-mail that the recipient can keep and reproduce do not have the same status, even though both have „reached the customer”.
Withdrawal period: The 14 days, with a different starting point depending on the subject of the contract. The period is deemed complied with if the notice was sent before expiry — so what matters is not when the shop reads it, but when it left the consumer.
Standard withdrawal form: The document provided in Annex no. 6 to Law no. 1125/2002 for the implementation of the Civil Code, to which the law expressly refers. The shop may make it available electronically on its own page, but then it owes an acknowledgement of receipt on a durable medium.
Statutory guarantee of conformity: Its existence is one of the mandatory pre-order mentions. It is a distinct institution from the right of withdrawal and from the commercial guarantee offered by the seller — three different things, which shop pages often mix together in a single paragraph called „guarantee”.
Abandoned basket: Industry term, not legal term. It describes a session interrupted between product selection and order confirmation. We use it here because that is what people in commerce call it, but in legal terms there is no „abandoned basket” — there is a data processing operation without a contract behind it, which must be described with its purpose and legal basis.
Information society services: The legal category the online store falls under. Law 195/2024 takes it over by defining its meaning by reference to Law No. 284/2004 on information society services — the act still known on the market by its old title, “on electronic commerce”.

Where it breaks down

What goes wrong when online commerce is digitalised in a rush

Mandatory information lives on a page that no one opens

Terms and conditions are written once, placed in the footer and left there. But the law requires something else for electronic ordering: key information must be brought to the consumer’s attention in a clear and highly visible manner immediately before ordering, and on web pages it must be displayed in the immediate vicinity of the confirmation requested for placing the order. A link to a separate page is not “in the immediate vicinity”. The difference is not theoretical: information that did not reach that point was not provided, and the burden of proving that it was provided lies with the shop.

The abandoned basket is bought as a feature, not designed as processing

The module is activated from an administration panel, with a title that promises sales recovery. No one opens a discussion about the legal basis, about how long the address stays in the database, about what the information at the time of collection says, or about how the sequence stops if the person objects. The result is processing that does not appear in the record of activities, with a legitimate interest invoked retroactively and never formulated in words, in a system where the unsubscribe button stops the messages but does not delete the row.

The cookie banner promises behaviour that the page does not have

A solution seen on a European site is copied, translated, placed. From that moment the site states in writing that tracking tags load only after consent — while, technically, they load on the first visit, because no one linked consent to the code that runs. It is the easiest non-compliance to verify of all, because anyone can open the browser tools, and it is the only one in which the shop’s public statement is evidence against it.

The return form becomes a retention questionnaire

To find out why customers leave, the shop asks mandatory questions before the submit button: the reason, what would convince them to stay, whether they accept a voucher instead of money. The law says exactly the opposite: the consumer is not obliged to justify the decision, and if the electronic form asks for additional information, the questions are presented separately and the statement must be able to be submitted without answering them. A flow that does not let the user move on does not collect data for the product, it blocks the exercise of a right.

The free-text field “courier notes” gathers what no one asked for

A plain field ends up containing access codes, the hours when no one is home, the neighbour’s name who receives the parcel and, occasionally, the reason the person cannot go downstairs. The data was not requested, but it was collected, and the principle of minimisation applies to what is in the database, not to what was intended. Most often, the field is then copied into the e-mail to the courier company, which also turns it into a disclosure to a recipient about whom the customer was not informed.

Questions

What someone in online commerce asks before buying software

When do the 14 days start — from the order or from delivery?

It depends on the subject matter, and the law states it by case. For service contracts, from the day following the date the contract is concluded. For sales contracts, from the day on which the consumer or a third party indicated by them, other than the carrier, acquires physical possession of the goods. If multiple goods were bought in a single order and delivered separately, from the last good; if a good is delivered in multiple lots or pieces, from the last lot; for regular deliveries over a fixed period, from the first good. In addition, in a sale the consumer may withdraw even before acquiring possession of the good.

What happens if I do not write anything on the site about the right of withdrawal?

The right does not disappear, it is extended. If the trader has not provided the information on the right of withdrawal, the period expires 12 months after the end of the initial period. If the information is provided within those 12 months, the period expires 14 days after receipt of it. There are two further consequences in the same direction: the consumer does not bear the costs of return if they were not informed of the obligation to bear them, and does not bear liability for the reduction in the value of the goods if the trader failed to inform them about the right of withdrawal. Missing information does not save anything, it shifts the cost.

Can I ask for the reason for the return before accepting it?

You can ask, you cannot make it conditional. The consumer is not obliged to justify the decision to withdraw. If you provide an electronic form on your page and ask for other information too, the additional questions must be presented separately, and the statement must also be able to be submitted without answering them. What you can legitimately do is suspend the refund until you receive the goods or proof that they were dispatched, taking into account the earlier date — except where you offered to collect the goods yourself.

What must be written on the order completion button?

One of the wordings accepted by law — “Order with an obligation to pay”, “Buy now”, “Pay now”, “Confirm purchase” — or another unambiguous wording indicating that placing the order entails an obligation to pay. The label must be readable and only that. A button reading “Send”, “Continue” or “Finish” does not meet the requirement, and the wording of the law states what follows: the consumer has no obligation under the contract or the order. It is one of the few interface rules with a sanction written directly into the code.

Can I send abandoned cart e-mails?

There are two conditions, not one, and usually only the first is checked. Processing the address may rely on legitimate interest, with the obligation to inform the person what legitimate interests are pursued and with their right to object at any time for personal reasons. The actual sending is something else: commercial communications by electronic mail are prohibited without the recipient’s prior express consent. And the right to object must be brought to attention explicitly, clearly and separately from any other information, at the latest at the first communication. In practice, the useful question is whether at the step where the address was entered there was a separate request for consent, not whether the tool has the function.

Do I need a cookie banner and what must it say?

Moldovan law on information society services explicitly requires the publication of the mechanisms and the method of monitoring the consumer’s online activities through cookies for marketing purposes, together with the procedure for obtaining consent, the right to refuse collection and the method of withdrawal. Data law adds the form: consent is a free, specific, informed and unambiguous expression of will, by a statement or an unequivocal action, and withdrawal must be as simple as giving consent. A banner that offers “Accept” with one click and refusal after two screens does not meet the last condition.

Do I need to register as a personal data controller?

Law 284/2004, in the text I was able to open, requires the shop to publish the “registration number as a personal data controller”. Law 195/2024, in force today, does not establish such a register — searching the full text finds no register of controllers, and the only registers kept by the Centre are the register of codes of conduct and the register of certification mechanisms. What replaced state registration is the internal record of processing activities, with the purposes, categories of persons and data, recipients, transfers, intended deletion periods and a description of the security measures. I could not verify whether the reference in Law 284/2004 has meanwhile been aligned — the consolidated source is inaccessible — so I am stating neither that it is still required nor that it has been repealed.

Can an automated assistant refuse an order on its own or change the price for a particular customer?

A person has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or affects them in a similarly significant way. There are three exceptions: a decision necessary for the conclusion or performance of the contract, authorisation by legal acts, or explicit consent. In the first and third cases, the controller is obliged to implement at least the person’s right to obtain human intervention, to express their point of view and to contest the decision. In addition, the information at the time of collection must include the existence of the automated process and relevant information regarding the logic used. The design conclusion: automation is permitted, but with a route to a human, built in from the start.

What real risk do I have if I do nothing this year?

There are two different risks, with different mechanisms. The civil law one is immediate and does not depend on any control: missing pre-contractual information extends the right of withdrawal by 12 months, a wrongly labelled button leaves the order without obligation for the consumer, and unannounced costs remain with the shop. The data protection one is sanction-based: the law is in force from 23 August 2026, with fines of up to 1,000,000 lei or 1% of total turnover for the controller’s obligations and up to 2,000,000 lei or 2% for principles, data subjects’ rights and transfers, taking the higher value — but with an explicit phasing: 10% of the amount in the first year, 40% in the second, 100% in the third.

What we cannot claimNu avem un rezultat măsurat de-al nostru pentru comerțul online pe care să-l punem în această pagină, și nu punem în locul lui o cifră împrumutată. Nu suntem furnizor de servicii de responsabil cu protecția datelor și nu emitem avize juridice — ce e scris aici sunt reguli citate cu articol, nu consultanță pentru un caz anume. Nu procesăm plăți, nu suntem prestator de servicii de plată și nu ne ocupăm de conformitatea unui magazin cu regulile schemelor de card. Nu am putut deschide versiunile consolidate ale actelor: copia Codului civil pe care am citit-o are ca ultimă modificare menționată LP134 din 30.05.2024, în vigoare 20.07.2024, iar copia Legii 284/2004 este republicarea din 09.02.2018 — deci acolo unde textul trimite la instituții reorganizate sau la o lege abrogată, raportez divergența, nu o rezolv. Sursa oficială consolidată a returnat 403 în ziua verificării și nu am ocolit protecția. Termenul concret de păstrare a documentelor contabile care însoțesc o comandă rămâne neverificat. Nu numim niciun magazin și nu publicăm nicio informație despre clienții cuiva.

The service, in detail What we actually built All scenarios

The service, appliedWe have not yet delivered exactly this combination. What you read above is the mechanism of our service, verifiable on its page, set alongside the rules that govern online commerce — each with the article it comes from. What we have actually built sits on the service page and in the portfolio.

Sources 9 sources · verified on 2026-09-07

What would you want to work better?

Tell us about your process. Together we decide what is worth building, what we can connect, and how we check the result.

Let's talk