Privacy Policy
This policy describes how personal data is processed in the Omevo app and website, in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Romanian law.
1. The controller
The data controller is Async Software Method SRL, tax ID (CUI) 46446886, trade register no. J2022013144407, with its registered office at Str. Fragmentului nr. 11, Sector 5, Bucharest 052583, Romania. For any request concerning your data, write to [email protected].
2. What we process, why, and on what basis
We process only the data needed to provide the service:
- account data — to create, manage and secure your account (contract, Art. 6(1)(b));
- feature-usage data — your preferences and the content you save, to provide the features you choose to use (contract, Art. 6(1)(b));
- vehicle data — if you choose to save one or more vehicles: the registration plate, the vehicle identification number (VIN, if you add it), the make, model and year, and the expiry dates of the road vignette (rovinietă), RCA, CASCO and ITP. The registration plate and the VIN can be personal data; we process them to provide the feature (contract, Art. 6(1)(b)) and to send you reminders (legitimate interest, Art. 6(1)(f));
- location data — only if you grant permission, to show information relevant to your area and to calculate routes (consent, Art. 6(1)(a));
- technical data — session data and identifiers needed for the service to work and to deliver the notifications you enable, as well as technical diagnostic information generated when the app encounters an error, for the security, stability and proper operation of the service (legitimate interest, Art. 6(1)(f); for notifications, consent, Art. 6(1)(a));
- payment and subscription data — if you purchase a subscription, for payment processing, invoicing and accounting and tax records (contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)).
Providing account data is necessary to enter into and perform the contract — without it an account cannot be created. All other categories are optional and depend on the features you choose to use.
Consent (for example for location or notifications) can be withdrawn at any time from the app or device settings, without affecting the lawfulness of processing before the withdrawal. The app keeps working without these permissions.
We use only cookies and local-storage mechanisms strictly necessary for the service to work (for example for signing in) — no analytics or advertising cookies.
Vehicle data
For vehicles saved together with their VIN, the road vignette's validity is checked automatically in the public verification service of the official road-vignette administrator; without a VIN, you enter the expiry dates yourself. From that check we keep only the current expiry date and the vehicle category. The make, model and year may be decoded automatically from the VIN using a public vehicle database operated by a public authority outside the EEA; we keep no other information from that source.
Reminders about expiring documents are delivered as push notifications, which you can turn off at any time from the app or device settings.
What we don't do
We do not sell or rent personal data. We do not use the service for behavioural advertising and do not integrate advertising trackers. We make no decisions based solely on automated processing that produce legal effects on you (Art. 22 GDPR).
3. Data from public registers (notice under Art. 14 GDPR)
The service displays company information taken from public registers and sources (such as ANAF, ONRC or the courts' portal), directly or through intermediaries. Where the source publishes them, these may include data about natural persons — for example the name and role of a person in relation to a company (an administrator, a representative, or a party to a public proceeding). The processing basis is legitimate interest (Art. 6(1)(f)) — informing users about the entities they interact with commercially. This data is kept temporarily and removed automatically when no longer needed. Data subjects have the rights described in section 6, including the right to object; corrections to the public register itself must be requested from the institution that maintains it.
4. Recipients
We use a limited number of service providers that process data on our behalf as processors, under agreements compliant with Art. 28 GDPR — for example hosting and backup services, email delivery, notification delivery, payment processing, and error and stability monitoring of the service. Each receives only the data strictly necessary for the service it provides. The app stores, the sign-in providers (Apple, Google) and location-based service providers, when you choose to use them, act as independent controllers under their own policies. The informational content displayed (for example the news) is taken from public sources without sending them any data about users. The list of providers in use at any given time is available on request.
The official verification and purchase pages the app may send you to — for example for RCA, ITP or buying the road vignette — belong to third parties and are operated by them as independent controllers under their own policies. We do not control those services and are not responsible for them.
Transfers outside the European Economic Area
Some providers may also process data outside the EEA. Such transfers take place only under the conditions of Chapter V GDPR — on the basis of an adequacy decision, standard contractual clauses adopted by the European Commission or, in limited cases, the derogations in Art. 49. For example, if you choose to add a vehicle's identification number (VIN), it (with no name or contact details) is sent to a public vehicle identification service in the United States to decode the make, model and year; this happens only at your request and is necessary to provide that function (Art. 49(1)(b) GDPR).
5. How long we keep data
Retention is determined by the following criteria:
- account data and content you save — for as long as the account exists;
- vehicle data, including document expiry dates — for as long as the vehicle exists in your account; it is deleted with the vehicle or, for all vehicles, with the account;
- technical and location data — for limited periods, for as long as needed for the purpose it was collected for;
- documents we are legally required to keep (for example tax documents related to payments) — for the period required by applicable law, including after account deletion.
When you delete your account, your data is promptly removed from active systems, and from backups through their automatic rotation, within a limited period.
6. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, portability, objection, and the right to withdraw consent. You can exercise them directly in the app — Settings → Legal → Download my data for a copy of your data (including your vehicle data), and Settings → Account → Delete account in the phone app or Settings → Delete account on the website (omevo.app) for erasure — or by writing to [email protected]. The steps for deleting your account are also described at omevo.app/en/delete-account. We respond within the legal deadline.
If you are not satisfied with our response, you can contact the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or the courts.
7. Security
We apply appropriate technical and organisational measures to protect data (Art. 32 GDPR), including encrypted communications and access controls.
8. Minimum age
The service is intended for people aged 16 or over. We do not knowingly collect data from anyone under this age; if we learn that we have, we delete the account.
9. Changes
We may update this policy; the date of the last update appears at the top of the page. For significant changes we notify you in the app before they take effect.