Privacy policy

01 Who we are

SC OTTO SRL (hereinafter "OTTO" or "the Company"), with its registered office in Giarmata, Timiș County, registered with the Registrul Comerțului (Romanian Trade Register) under no. J35/2002/2006, tax ID (CUI) RO18784768, is the data controller for the information collected through this website.

02 What data we collect

2.1 Data you provide directly

• Identification data: first name, last name, company name
• Contact data: email address, phone number, delivery address
• Financial data: company CUI/CIF (tax ID), IBAN (only if you choose invoicing with bank transfer)
• Content of your communication: messages sent through the contact form, the cutting form or by email

2.2 Data collected automatically

• IP address, browser type and operating system
• Pages visited, visit duration and traffic source
• Essential technical cookies required for the website to function

2.3 The OTTO mobile app

If you use the OTTO app on your phone and choose to turn on notifications, your device receives a notification identifier (token) from Google's Firebase Cloud Messaging service. We use it only to deliver the notification and we do not link it to your name or contact details. If you do not turn on notifications, this identifier is never created. You can turn notifications off at any time from your phone settings, and the identifier stops being used.

Everything else in the app — saved favourites, the quote request basket and the details you fill into the form — stays on your phone only. It reaches us only when you tap to send the request, exactly as on the website.

03 Why we use it

• Processing quote requests and orders
• Communicating with you about our products and services
• Issuing invoices and fulfilling our tax obligations
• Improving the website experience (anonymised analytics)
• Complying with the Company's legal obligations

04 Legal basis for processing

We process your data on the basis of:

• Performance of a contract (Art. 6(1)(b) GDPR) — for orders and quotes
• Legal obligations (Art. 6(1)(c) GDPR) — for issuing invoices and accounting archiving
• Legitimate interest (Art. 6(1)(f) GDPR) — for IT security and anonymous analytics
• Consent (Art. 6(1)(a) GDPR) — for analytics cookies and the newsletter, if you subscribe

05 How long we keep your data

• Invoices and accounting documents: 10 years (as required by tax legislation)
• Customer account data: for the duration of the business relationship + 3 years; you can delete your account at any time from My account
• Quote requests (not followed by an order): 6 months — the copy in our internal system is deleted automatically after this period, and the emails we received are cleaned up periodically
• Cutting orders and their sheets: for the duration of the business relationship + 3 years, so that we can redo or check an order
• Server logs: 90 days

06 Who we share your data with

Your data may be shared with:

• Service providers: courier companies (Fan Courier, DPD, Cargus), payment processors
• Google Firebase (Google Ireland Ltd. / Google LLC): website hosting (Firebase Hosting), customer accounts (Firebase Authentication) and the database that stores quote requests and the request and order history in your account (Cloud Firestore)
• Firebase Cloud Messaging (Google): if you turn on notifications in the mobile app, your device's notification identifier is handled by this Google service, strictly so that we can deliver the notification — see section 2.3
• Web3Forms: the contact form and the quote request form are submitted through the Web3Forms service, which delivers your message to our email addresses; the form content passes through this service's servers strictly for delivery
• FormSubmit (formsubmit.co): the cutting order forms (cutting sheets) and the “Report a problem” form are submitted through the FormSubmit service, which delivers your contact details, the order content and the attached files (Excel sheets, drawings, photos) to our email; the content passes through this service's servers, located in the United States, strictly for delivery — see section 07
• hCaptcha (Intuition Machines, Inc.): the contact form and the quote request form use the hCaptcha anti-bot check, which processes your IP address and technical browser data to tell people apart from automated programs
• Google reCAPTCHA / Firebase App Check (Google): on the account pages, on the quote request and when orders are saved to your account, an invisible anti-abuse check (reCAPTCHA Enterprise) processes your IP address and technical data about your browser and interaction, to confirm that requests to our database come from our website and not from automated programs
• YouTube (Google): presentation videos load from youtube-nocookie.com only after you click them; from that moment Google receives your IP address and technical browser data
• Product suppliers (Häfele, Decomob): some product images are displayed directly from the supplier's servers, so your browser sends them your IP address and standard technical data, as with any image on the internet; we do not send them any other data about you
• Public authorities: only upon an express legal request (ANAF (the Romanian tax authority), courts)

We do not sell or rent your data to third parties for marketing purposes.

07 International data transfers

Some of the providers above may process data on servers located outside the European Economic Area, including in the United States: Google (hosting, the Firestore database, the reCAPTCHA / App Check anti-abuse check, Google Analytics 4, YouTube), FormSubmit (cutting sheets and problem reports, with the attached files), Web3Forms and hCaptcha.

These transfers are made only to providers that offer adequate safeguards under the GDPR — typically through the Standard Contractual Clauses approved by the European Commission or under the EU–US Data Privacy Framework. For services that do not offer such safeguards, the transfer takes place because it is necessary to deliver the request or order you send us (Art. 49(1)(b) GDPR). Analytics data is aggregated and is collected only after you accept cookies.

08 Your rights

Under the GDPR, you have the following rights:

• Right of access — to find out what data we store about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure ("the right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw your consent at any time
• Right to lodge a complaint with the supervisory authority

To exercise any of these rights, you can write to us at otto.financiar@gmail.com. We will reply within 30 days at the latest.

If you consider that the processing does not comply with the law, you can contact the ANSPDCP (the Romanian national supervisory authority for personal data processing):

09 Cookies

We use essential technical cookies for the website to function (session, display preferences). These do not require consent and cannot be disabled.

We also use Google Analytics 4 (provided by Google LLC), but only after you accept cookies in the consent banner. Google Analytics helps us understand traffic through anonymous, aggregated statistics (pages visited, visit duration, traffic source), without identifying you personally. If you decline in the banner, Google Analytics is not loaded and no analytics cookie is set. You can change your choice at any time from the “Cookie settings” link in the footer of any page.

We do not use advertising cookies and we do not share your data with advertising networks.

Besides cookies, the website keeps some information only in your browser (localStorage / sessionStorage), so that you do not lose it on your next visit. It is not sent anywhere until you choose to submit a request or an order, and you can delete it at any time from your browser settings (clearing the site data for otto.info.ro).

10 Data security

We apply appropriate technical and organisational measures to protect your data: secure HTTPS connections, encrypted passwords, restricted access to databases, regular backups and staff training on data protection.

11 Children's data

The website is aimed at professional customers (legal entities) and is not intended for minors. We do not knowingly collect data from persons under the age of 16. If you notice that a minor has sent us personal data, please let us know and we will delete it without delay.

12 Changes to this policy

This policy may be updated from time to time. The current version is always available on this page, with the date of the last update shown above.

13 The OTTO account (optional)

The account is optional — the whole site works without one. If you create an account, we keep in it: your name, email and phone, and, if you fill them in yourself, your company name, VAT number and town. We use them to fill in your quote request for you and to know who to call.

Your favourites are synced then — and only then — when you are signed in: the list saved on one device also reaches the others you sign in on. If you have no account, or you are signed out, your favourites stay on your device alone, exactly as before.

We also keep the quote requests you send while signed in, so you can look them up in your account: the date, the products requested and how you chose to receive the goods.

You can delete your account yourself, any time, from the account page. Your sign-in account and your profile are deleted. The requests you have already sent us stay with us like any work order; if you want those deleted too, write to us at otto.comenzi@gmail.com.

The steps, with everything that is deleted and everything that stays, are written on the Account deletion page — it opens without an account and without the app installed.

14 Contact for GDPR questions