Privacy Policy
Last updated: 20 August 2026
1. Who is responsible for your data
The data controller for personal data processed through the ocrm.app website and, unless stated otherwise below, for account data of the oCRM platform is:
Addo Vision Solutions SRL
Registered office: Șos. Berceni nr. 39, Sector 4, Bucharest, Romania
Business address: Șos. Berceni nr. 96, Bloc A, Ap. A9.06, Floor 9, Sector 4, Bucharest, Romania
VAT number (CUI): RO32203240 · Trade Register: J40/10973/2013
Contact for privacy matters: contact@ocrm.app
Important distinction: for the personal data that our customers store inside their oCRM workspaces (their own clients, contacts, leads), the customer is the data controller and Addo Vision Solutions SRL acts as a processor, under our GDPR & Data Processing terms.
2. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account data: name, email, phone, company details, chosen subdomain | Creating and operating your account; support | (b) performance of a contract |
| Billing data: company identification, VAT number, invoices, payment status (card data is processed only by Stripe, never stored by us) | Subscription billing, accounting, tax obligations | (c) legal obligation; (b) contract |
| Usage and technical data: IP address, browser, log entries, security events | Security, abuse prevention, service improvement | (f) legitimate interest |
| Communications: support requests, emails | Responding to you, improving support | (b) contract; (f) legitimate interest |
| Marketing preferences (only if you opt in) | Product news and offers | (a) consent — withdrawable at any time |
3. Who receives your data
We share personal data only with service providers needed to run the Service, under data processing agreements:
- Hosting provider (EU) — infrastructure on which the platform and databases run; data is hosted in the European Union.
- Stripe — payment processing for subscriptions.
- Meta Platforms (WhatsApp Business) — only when you use WhatsApp features.
- OpenAI — only when you use AI-assisted features; content you submit to the AI assistant is sent for processing.
- Google (reCAPTCHA) — bot protection on authentication pages.
We do not sell personal data. Public authorities receive data only where the law requires it.
4. International transfers
Platform data is hosted in the EU. Where a provider processes data outside the European Economic Area (e.g. Stripe, OpenAI, Google, Meta), transfers rely on adequacy decisions or the European Commission's Standard Contractual Clauses, along with additional safeguards where appropriate.
5. How long we keep data
- Account and workspace data: for the duration of the contract, then deleted after a 30-day retention window following termination.
- Invoicing and accounting records: as required by Romanian fiscal law (currently up to 10 years).
- Technical logs: typically up to 12 months.
- Marketing consents: until withdrawn.
6. Your rights
Under the GDPR you have the right to access, rectify and erase your personal data, restrict or object to processing, data portability, and to withdraw consent at any time (without affecting prior processing). To exercise any right, write to contact@ocrm.app. We respond within one month.
You also have the right to lodge a complaint with a supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Bucharest — or with the authority of your own EU member state.
7. Security
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS/TLS), an isolated database per customer workspace, access control and role-based permissions, regular backups and security monitoring. Details are in the GDPR & Data Processing page.
8. Cookies
The website and platform use only cookies necessary for operation and security. Details, including how to control them, are in the Cookie Policy.
9. Changes
We may update this policy; the current version is always published on this page with its date. Material changes will be announced in the platform or by email.