Privacy policy

01 Who we are

SC OTTO SRL (hereinafter "OTTO" or "the Company"), with its registered office in Giarmata, Timiș County, registered with the Registrul Comerțului (Romanian Trade Register) under no. J35/2002/2006, tax ID (CUI) RO18784768, is the data controller for the information collected through this website.

02 What data we collect

2.1 Data you provide directly

• Identification data: first name, last name, company name
• Contact data: email address, phone number, delivery address
• Financial data: company CUI/CIF (tax ID), IBAN (only if you choose invoicing with bank transfer)
• Content of your communication: messages sent through the contact form, the cutting form or by email

2.2 Data collected automatically

• IP address, browser type and operating system
• Pages visited, visit duration and traffic source
• Essential technical cookies required for the website to function

03 Why we use it

• Processing quote requests and orders
• Communicating with you about our products and services
• Issuing invoices and fulfilling our tax obligations
• Improving the website experience (anonymised analytics)
• Complying with the Company's legal obligations

04 Legal basis for processing

We process your data on the basis of:

• Performance of a contract (Art. 6(1)(b) GDPR) — for orders and quotes
• Legal obligations (Art. 6(1)(c) GDPR) — for issuing invoices and accounting archiving
• Legitimate interest (Art. 6(1)(f) GDPR) — for IT security and anonymous analytics
• Consent (Art. 6(1)(a) GDPR) — for analytics cookies and the newsletter, if you subscribe

05 How long we keep your data

• Invoices and accounting documents: 10 years (as required by tax legislation)
• Customer account data: for the duration of the business relationship + 3 years
• Quote requests (not followed by an order): 6 months
• Server logs: 90 days

06 Who we share your data with

Your data may be shared with:

• Service providers: courier companies (Fan Courier, DPD, Cargus), payment processors
• IT providers: website hosting through Google Firebase Hosting, technical maintenance, under confidentiality agreements
• Web3Forms: the contact and quote request forms are submitted through the Web3Forms service, which delivers your message to our email addresses; the form content passes through this service's servers strictly for delivery
• AI assistant (Google): the messages you type into the search assistant are sent to Google (the Gemini service) in order to generate the answer — see section 07
• Public authorities: only upon an express legal request (ANAF (the Romanian tax authority), courts)

We do not sell or rent your data to third parties for marketing purposes.

07 International data transfers

Hosting the website and the analytics cookies (Google Analytics 4, provided by Google LLC) may involve transferring some data to servers located outside the European Economic Area, including in the United States.

These transfers are made only to providers that offer adequate safeguards under the GDPR — typically through the Standard Contractual Clauses approved by the European Commission or under the EU–US Data Privacy Framework. Analytics data is aggregated and anonymised and is collected only after you accept cookies.

The AI search assistant. The website offers an assistant that helps you find products. When you type it a message, your text is sent to Google (the Gemini service) to generate the answer; this may involve a transfer to servers outside the EEA, subject to the same safeguards described above. We use the assistant on the basis of our legitimate interest in offering you a better search experience. Please note: do not enter personal data into the assistant (name, address, phone number, card details) — for a specific request, use the quote form. We do not store conversations in an account and we do not use them for profiling; to limit abuse, we temporarily keep a technical counter based on an anonymised IP address (see section 05).

08 Your rights

Under the GDPR, you have the following rights:

• Right of access — to find out what data we store about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure ("the right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw your consent at any time
• Right to lodge a complaint with the supervisory authority

To exercise any of these rights, you can write to us at otto.financiar@gmail.com. We will reply within 30 days at the latest.

If you consider that the processing does not comply with the law, you can contact the ANSPDCP (the Romanian national supervisory authority for personal data processing):

09 Cookies

We use essential technical cookies for the website to function (session, display preferences). These do not require consent and cannot be disabled.

We also use Google Analytics 4 (provided by Google LLC), but only after you accept cookies in the consent banner. Google Analytics helps us understand traffic through anonymous, aggregated statistics (pages visited, visit duration, traffic source), without identifying you personally. If you decline in the banner, Google Analytics is not loaded and no analytics cookie is set. You can change your choice at any time by deleting the cookies and the preference saved in your browser.

We do not use advertising cookies and we do not share your data with advertising networks.

10 Data security

We apply appropriate technical and organisational measures to protect your data: secure HTTPS connections, encrypted passwords, restricted access to databases, regular backups and staff training on data protection.

11 Children's data

The website is aimed at professional customers (legal entities) and is not intended for minors. We do not knowingly collect data from persons under the age of 16. If you notice that a minor has sent us personal data, please let us know and we will delete it without delay.

12 Changes to this policy

This policy may be updated from time to time. The current version is always available on this page, with the date of the last update shown above.

13 Contact for GDPR questions