Privacy policy

Who processes your data

The controller of your personal data is ZIEGERT SRL, the seller of the OVIO products on this site:

• VAT number RO35793880, Trade Register J40/3733/2016
• Registered office: Str. Sfântul Petru Tei nr. 59, Sector 2, 020358 Bucharest, Romania
• Email: office@ovio-vision.com
• Phone and WhatsApp: +40 722 468 176

For any question about your data, email us at the address above. We process data in accordance with Regulation (EU) 2016/679 on data protection (GDPR), Romanian Law no. 190/2018 and, for cookies, Romanian Law no. 506/2004.

What data we collect

• Identification and contact details: first and last name, phone number and email address.
• Delivery details: the address we send the parcel to and the person receiving it; before you pay, the delivery country, postcode and city you enter in the cart so that DHL can calculate the delivery cost.
• Billing details: those needed to issue the invoice — the billing name and address and, if you order for a company, the company name and its tax or VAT number.
• Customer profile and VAT number: the profile you choose in the cart — private person or company — and, if you buy as a company with a VAT number from another EU member state, the VAT number you enter and the company name returned by VIES, the European Commission's VAT register.
• Order contents: the products, quantities, amounts, order date and order status.
• Payment details: you enter your card details directly on Stripe's secure payment page and we never see them. We only receive confirmation of the payment, the amount, the date and limited card information, such as the card type and the last digits.
• Messages you send us by email, on WhatsApp, by phone or through the online withdrawal statement.
• Minimal technical data: IP address, browser and device type, date and time of access, recorded automatically by the server hosting the site, for operation and security.
• Data saved in your browser: your cart, your customer profile (including the delivery country, postcode and city you entered for the DHL rate) and your cookie choice, kept locally on your device. The details are in our cookie policy.

Why we use it and on what legal basis

Your contact, delivery and billing details are needed so we can deliver your order and issue the invoice; without them, the order cannot be placed. You can object at any time to processing based on our legitimate interest — see your rights.

Who we share it with

We share data only as far as is necessary for the purposes above, with:

• DHL Express, which delivers your parcel: your name, delivery address and phone number. Before you pay, to calculate the delivery cost, DHL receives through our server only the delivery country, postcode and city you enter in the cart and the size and weight of the parcel. A rate is kept in a cache on our server for 30 minutes, so the same address is not sent again for the same parcel.
• Stripe, the card payment processor, for the payment itself. For fraud prevention and its own legal obligations, Stripe also processes some data as an independent controller, under its privacy policy.
• VIES, the European Commission's VAT information exchange system: if you buy as a company with a VAT number from another EU member state, the VAT number you enter is sent to VIES through our server so that we can check it. A valid result is kept in a cache for 24 hours.
• The hosting provider of the site, which manages the server and the technical logs.
• Our accountants, for the records of invoices and payments, and, through the RO e-Factura system, the Romanian tax authority (ANAF), where the law requires the invoice to be transmitted.
• WhatsApp, only if you choose to contact us there; the messages pass through the WhatsApp service, under its own policy.
• Public authorities, such as ANAF, ANPC or the courts, only at their request and where the law requires us to.

Providers that process data on our behalf do so under a contract and only for the purposes above. We do not sell, rent or give your data to other companies for marketing. The fonts on this site are hosted on our own server, so loading a page does not send your data to a font provider.

Transfers outside the European Economic Area

As a rule, your data stays within the European Economic Area (EEA). Some providers, such as Stripe, may also process data outside the EEA, including in the United States. Such transfers take place only with the safeguards provided for by the GDPR — the standard contractual clauses approved by the European Commission or, where applicable, an adequacy decision of the Commission. Stripe uses the standard contractual clauses, as stated in its privacy policy.

How long we keep it

Your rights

Under the GDPR, you have the right:

• of access — to find out whether and what data we process about you and to receive a copy (Art. 15);
• to rectification — to have inaccurate or incomplete data corrected (Art. 16);
• to erasure — to have data deleted when it is no longer needed or when the law allows it (Art. 17); data we are required by law to keep, such as invoices, cannot be deleted before the end of the retention period;
• to restriction — to have processing temporarily limited, for example while we look into a complaint from you (Art. 18);
• to data portability — to receive the data you gave us in a structured, commonly used format, or to have it sent to another controller where technically possible (Art. 20);
• to object — to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21);
• to withdraw your consent — at any time, as easily as you gave it, without affecting processing carried out before the withdrawal (Art. 7(3)).

To exercise any of these rights, email office@ovio-vision.com. We reply without undue delay and within one month at the latest; for complex requests this may be extended by two further months, in which case we let you know (Art. 12 GDPR). Exercising your rights is free of charge.

If you believe your data is not being processed correctly, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

• address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania;
• email: anspdcp@dataprotection.ro;
• website: www.dataprotection.ro.

You may also complain to the data protection authority of the EU member state where you live or work, or go to the competent court.

Data security

The site uses an encrypted connection (HTTPS). Card details are processed only by Stripe, a PCI DSS certified provider, and never reach our servers. Only the people who handle orders, deliveries and invoicing have access to order data, and our providers are contractually required to protect it.

Cookies

What the site saves in your browser, for what purpose and for how long is set out in our cookie policy. You can change your choice at any time:

Cookie settings

Changes

When we change the way we use data, we update this page and the date of the last update appears at the top. If a change requires your consent, we ask for it again.