Privacy Policy

Who we are

Ovnit is operated by Ovnit LTD. Company number: 17495977. Registered office: 128 City Road, London, EC1V 2NX, England. Questions about this policy or your data: privacy@ovnit.co. All our privacy documents are in the Privacy Centre.

Which part of this applies to you

• You scanned a QR code on a product. The brand that made the product controls your data and decides what it is used for. We run the page and store the data on the brand’s instructions, as its processor. See If you scanned a code.
• You work at a brand that uses Ovnit, or you are signing up. We are the controller of your account data. See If you have an Ovnit account.
• You are visiting ovnit.co or writing to us. See If you visit our site or contact us.

If you scanned a code

The brand decides what its page asks for. The page can collect:

• What you type in when you register a product, report a problem, make a warranty claim, start a return or leave feedback: for example your email address, name, the country you live in, the retailer you bought from, a serial or order number, and what you write.
• Your marketing choice: whether you agreed to hear from the brand, with the exact wording you were shown and when. Registering never requires agreeing to marketing. The rules that apply depend on the country you give: in Germany and Austria — and where we do not know the country — you confirm by following a link in an email first, and nothing is sent until you do.
• How the page was used: that a scan happened, which printed code it came from, and which options were opened. This is linked to a random identifier for your device rather than your name — until you register, when the brand can connect it to your registration.
• On your device: if you choose “Allow” on the page’s storage notice, the page remembers your device so the brand can recognise a return visit. If the brand has added Meta or Google advertising tags, they load only after an “Allow” given when the notice asked about them; an answer from before the tags were added does not count, and you are asked again. “Storage choices” at the bottom of the page lets you change your answer. Details are in the cookie policy.
• Emails from the brand: whether you opened them or clicked a link in them — except emails about your data rights and the email confirming your marketing choice, which are never tracked.

We do not receive anything from Amazon or any other retailer about you: not your account, your order history or your payment details. Your network address is not stored with anything you submit when you register a product, report a problem, make a claim or give feedback. To stop a form being flooded, a one-way code made from your network address is kept for up to 24 hours, only to count how often the form is sent, and then deleted. The one time a network is recorded is when you turn the brand’s marketing back on from its preferences page or your data-request page: we keep the first three parts of your IP address (never the whole one), so the brand can show the request was genuinely made.

What it is used for

For what the brand set the page up to do: registering your product, handling a warranty claim or a problem, sending you a safety or recall notice, and showing the brand how its packaging is used. The brand emails you marketing only if you agreed, and stops as soon as you unsubscribe. The brand is responsible for having a lawful basis for each of these, and its own privacy policy explains them; it is linked from its page where the brand has published one.

Customer groups. Ovnit sorts a brand’s customers into groups from their registrations and how they used the page — for example new, active or not seen for a while — and estimates when a consumable product may need reordering. The brand uses these groups to decide which of the people who agreed to marketing receive which email. They are never used to decide a price, a warranty, a claim or anything else with a legal or similarly significant effect on you.

Who receives it

• The brand, and the people at the brand it gives access to.
• The companies that run Ovnit for us, listed on the sub-processors page — for example, our email provider delivers the brand’s emails to you.
• Anyone the brand chooses to send it to: a brand can connect its own systems, which then receive new registrations; add Meta or Google tags to its page (only after an “Allow”); or download the email addresses of customers who agreed to its marketing, to upload to Meta or Google advertising itself.

How long it is kept

Unless the brand changes them, these are the periods after which Ovnit deletes data automatically. A registration still under warranty, or linked to an open safety investigation, and an open warranty claim are never deleted by this process.

When a brand closes its Ovnit account, everything it held about its customers is deleted 30 days after it asks, and in any event within 90 days. Our backups are kept for 14 days, so a copy can survive in a backup for up to 14 days after it is deleted, and is then gone.

Your choices and rights

Use the “Your data” link at the foot of the brand’s page. With no account, you can download a copy of your data, have it deleted, or ask for it to be corrected or for its use to be restricted; objecting to marketing takes effect straight away. Every marketing email has a one-click unsubscribe link. Three kinds of message are not marketing and continue after you unsubscribe: safety and recall notices about a product you registered, the confirmation you get when you register, and replies about a warranty claim you opened.

What survives a deletion request

A deletion removes your registrations, customer record, feedback, reported problems, claims and the emails sent to you. Some things deliberately survive it, and the deletion page lists them before you confirm:

• an open warranty claim, and a registration still under warranty or linked to a safety investigation, which the brand has a duty to keep;
• one line recording that you consented to marketing on a date, under a particular version of the wording, and when it ended — kept so the brand can show its emails to you were lawful;
• the record of who at the brand looked at your data;
• a code made from your email address that stops the brand marketing to you again.

The last three are stored against a code made from your address rather than the address itself.

If you have an Ovnit account

• Account details: your name, work email and a password, which we store only in hashed form. If you switch on two-step sign-in, we store the secret your authenticator app uses.
• Your team and settings: who you invite and the settings you choose.
• Billing: if you take a paid plan, the plan and our payment provider’s reference for you; your account email is used for billing. Card details go to the payment provider, never to us.
• Records of activity: when someone at your brand views or exports customers’ personal data, or a scheduled report sends it by email, we record who (or which schedule) and when, so you can show who had access.

We use it to provide the account and the service (our contract with your business), to keep it secure and investigate misuse (our legitimate interest in running a safe service), and to keep billing records the law requires. We send you account emails — sign-in, security, reports and alerts you set up — but no marketing unless you ask for it.

We keep account data while the account is open. When a brand closes it, the account and everyone’s logins are deleted with it, after the 30-day grace period. Two things are kept: a record that the closure happened (with the workspace name and email stored only as a one-way code), and payment references for invoices already issued, for at least 6 years, because company accounting records must be kept.

If you visit our site or contact us

Our public pages use no analytics, advertising or tracking tools, and load nothing from other companies’ servers. The sign-in pages set one cookie, needed to sign in and to protect forms. The cookie policy lists everything, and the cookie settings link in the footer of our public pages, or the button on the cookie policy, shows and changes your choice. Our servers keep technical logs — for example, which address was requested and when — to run the service and investigate problems; our main application server removes email addresses from the logs it writes.

If you email us, we use your message and address to reply and keep them for as long as the conversation needs, and longer only where we must keep a record (for example, of a privacy complaint).

Where data is stored, and transfers abroad

Ovnit’s database is stored in London. Some of the companies that run parts of the service are in the United States; each, and the safeguard it relies on (or that one is still under review), is listed on the sub-processors page.

Security

Connections are encrypted, passwords are stored hashed, and access to customer data inside a brand’s account is recorded. The security page says what we do and do not do, and how to report a problem.

Your rights, and complaints

Under UK data protection law you can ask for a copy of your data, ask for it to be corrected or deleted, ask for its use to be restricted, object to its use, take it elsewhere, and withdraw consent at any time. For data a brand controls, use the “Your data” link on its page; for anything else, write to privacy@ovnit.co.

If you are unhappy with how your data has been handled, write to privacy@ovnit.co with “Complaint” in the subject. We acknowledge a complaint within 30 days, look into it, and tell you what we found and what we have done. You can also complain to the Information Commissioner’s Office at any time: ico.org.uk.

Changes

When this policy changes in substance we update the date at the top of this page.