1. Who we are
The controller of the data described here is Doimih Design S.R.L., a company registered in Romania (company no. 27344782, trade register no. J40/8350/2010), with its registered office at Str. Drm. Gura Putnei nr. 137A, Sector 3, București, România ("OraSync", "we", "us").
For any question about your data, write to [email protected].
We are established in the European Union and offer our services to businesses in the United Kingdom. We are appointing a representative in the UK under Article 27 of the UK GDPR; their contact details will appear here. Until then, the address above reaches us directly.
2. When this notice applies
This notice covers the data we process on our own behalf:
- visitors to the OraSync website;
- people who ask us for a demo or send us a message through the contact form;
- users of business accounts (owners, managers, staff) and the contact people of our customers.
The data of a business's own clients (people who book at a salon, a clinic or a garage) is processed by that business, as controller. OraSync processes it only on the business's behalf, as processor, under the Data processing agreement. For that data, please contact the business you booked with directly.
3. What data we process and why
| Situation | Data | Purpose | Lawful basis (UK GDPR art. 6) |
|---|---|---|---|
| Demo request or contact message | Name, email, phone (optional), company, sector, number of locations, your message, the page you sent the form from | To reply, arrange the demo and send you a quote | Steps at your request before a contract (art. 6(1)(b)); our legitimate interest in answering messages (art. 6(1)(f)) |
| Activation and set-up appointment | Business name, the name and contact details from the Stripe payment, and the selected date and time for online set-up | To schedule the account set-up and confirm the appointment by email | Steps at your request before a contract and performance of a contract (art. 6(1)(b)) |
| Business account | Name, email, phone, team role, assigned locations, history of actions in the account (audit log), sign-in sessions | To provide the service, manage access and investigate incidents | Performance of a contract (art. 6(1)(b)); legitimate interest in security (art. 6(1)(f)) |
| Billing | Company details, contact person, payment history | Issuing invoices and keeping accounting records | Legal obligation (art. 6(1)(c)) |
| Browsing and security | IP address, browser type, date and time of requests | Running the website, limiting abuse, investigating errors | Legitimate interest in security (art. 6(1)(f)) |
| Visit statistics (the OraSync website and the business websites OraSync hosts) | The page visited (without the parameters in its address), the domain of the site you came from, the campaign source (utm_source), the type of device, the browser and operating system, the country, and an anonymous identifier that changes every day. The country is worked out from your IP address with a database kept on our own servers; the IP address is not stored and is not sent to anyone. No cookies are used for these statistics | To know how many visits pages get, where visitors come from and which devices they use, so we can improve the websites | Our legitimate interest in measuring and improving the websites (art. 6(1)(f)) |
| Support (WhatsApp or email conversations with the OraSync team) | The name of the person at the business, their phone number or email address, the content of the messages and their date | To answer questions and resolve support requests | Performance of the contract (art. 6(1)(b)) |
| Orders for additional services (for example a business website) | The business, the service chosen, the theme chosen, the Stripe payment details | To deliver the service ordered and issue the invoice | Performance of the contract (art. 6(1)(b)); legal obligation for invoicing (art. 6(1)(c)) |
| Cookies | See the Cookie policy | Running the website and, only with your consent, analytics and marketing | Strictly necessary: no consent needed (PECR, regulation 6(4)); others: consent (art. 6(1)(a)) |
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not build marketing profiles.
Details about cookies are in the Cookie policy.
4. Who we share data with
We do not sell or rent personal data. We share it only with providers the service cannot run without, under contract and with confidentiality obligations:
- Hetzner Online GmbH (Germany): hosting of the servers and backups, in data centres in the European Union;
- Stripe Payments Europe Ltd. (Ireland): collecting OraSync subscriptions and the activation fee, issuing invoices and processing deposits paid directly into businesses’ own Stripe accounts using API keys configured by the superadmin;
- The email service configured by OraSync: sending the appointment confirmation to you and the booking details to OraSync support;
- Meta Platforms Ireland Ltd.: delivering WhatsApp messages, for businesses that connect their own WhatsApp Business account, under the business's direct contract with Meta;
- Cloudflare, Inc.: protecting the public forms (Demo, Contact, sign-up, online booking, forgotten password) from spam (Cloudflare Turnstile), when it is switched on; the data may be processed outside the UK, under the UK–US data bridge and standard contractual clauses.
On the OraSync website, only if we switch them on and only after you consent to marketing cookies, advertising measurement tags from Google, Meta or LinkedIn are loaded; the details are in the Cookie policy. No such tags are loaded on business websites.
The country of visitors in the statistics comes from the DB-IP “IP to Country Lite” database (db-ip.com), licensed under CC BY 4.0. The database is downloaded to our own servers; DB-IP receives no data about you.
For technical monitoring we use aggregate metrics (for example response times and error counts) that contain no personal data.
We disclose data to public authorities only when the law requires us to.
5. How long we keep data
| Data | How long |
|---|---|
| Demo requests and contact messages | 24 months from sending, then deleted automatically |
| Set-up appointment after activation | 24 months from booking, then deleted automatically |
| The data of a business account | For the duration of the contract and 90 days after the account is closed, during which we can provide it on request; then deleted |
| Your user account | As long as you use it. An account with no sign-in and no business for 12 months is deleted automatically |
| A deleted account (by you or on request) | Name, email, password and sessions are deleted straight away; only an anonymous identifier remains, so the audit log stays consistent |
| The account audit log | 24 months. After 90 days only the network part of the IP address is kept (for example 81.196.12.x), and the browser is no longer kept |
| Expired sign-in sessions | 30 days after expiry |
| Visit statistics | 13 months after the visit, then deleted automatically |
| Support conversations | For as long as the business's account exists; deleted with the account's data |
| Billing documents | Issued and kept by Stripe, for the period required by accounting and tax law |
| Technical logs | Rotated automatically, kept for a short time |
| Backups | Encrypted; the oldest are kept for at most 12 months, then overwritten. If we restore a backup, deletions made after it are applied again |
6. Where the data is
The data, backups included, is hosted by Hetzner in the European Union. Transfers from the UK to the European Economic Area are permitted by the UK adequacy regulations, so no further safeguard is needed for them.
Payments (subscriptions, the activation fee, deposits) and invoices are processed by Stripe, which may transfer data to the United States under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") or the UK International Data Transfer Addendum. Stripe receives only the data needed for the payment: the company name, the billing email and the card details, which OraSync never sees.
WhatsApp messages may be an exception: Meta may process data outside the UK and the EEA, under the contract the business has with Meta and the safeguards required by the UK GDPR.
7. How we protect data
- Encrypted connections (HTTPS) for all traffic;
- Each business's data isolated at database level;
- Passwords stored only as hashes, with the account locked after repeated wrong attempts;
- Role-based access and an audit log that cannot be changed from the application;
- Encrypted backups, kept in a different location from the main server and tested regularly by restoring them.
8. Your rights
Under the UK GDPR you have the right of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent at any time, and the right to complain to the Information Commissioner’s Office (ICO).
If you have an account, you can download your data and delete your account yourself from the Account page of the app. For everything else, and how quickly we reply, see Your data protection rights.
9. Children
The website and business accounts are for adults acting for a business. We do not knowingly collect data from children through our forms.
10. Changes
When this notice changes, we update the date above. If the change is significant, we tell our customers by email before it takes effect.