Privacy Policy
Privacy Policy
This privacy policy (the "Policy") explains how "SPARK VISION IS" OOD processes personal data when managing the website https://sparkvision.tech (the "Site"), selling products, responding to enquiries and organising consultations. Where the seller is SPARK VISION IS ROMANIA SRL, the Policy also describes the processing carried out by that company in connection with the sale concerned.
Here you will find information about what data we use, why we need it, who we share it with and how long we keep it. We also explain what rights you have and how you can manage your choices about cookies and advertising tracking. Processing is carried out in accordance with Regulation (EU) 2016/679 (the "GDPR") and the applicable national legislation.
The Policy covers visits to the Site, contacts with us, consultations, orders, payments, deliveries, product returns, complaints and after-sales service. Processing during the actual use of the glasses, apps and other products, for example through the camera, microphone or recognition features, is described separately for the product concerned. Data needed to handle a complaint or repair remains within the scope of this Policy.
The Policy informs you about the processing and does not require a general consent for all the activities described. You can browse the Site, contact us and make a purchase without allowing optional analytics or advertising tracking.
Who is responsible for your personal data
For managing the Site, general enquiries and organising consultations, the controller is "SPARK VISION IS" OOD, UIC 206677712, address: 1 Krum Popov St., 1164 Sofia, Bulgaria. The controller is the person who determines why and how personal data is processed.
When you buy a product, the relevant seller is responsible for the processing in connection with the contract, invoicing and the legal obligations relating to the sale. Under the Terms and Conditions, the seller is determined by the country of delivery and is stated in the order confirmation:
| Delivery | Seller and controller for the sale |
|---|---|
| Bulgaria and other EU countries except Romania | "SPARK VISION IS" OOD, UIC 206677712; 1 Krum Popov St., 1164 Sofia, Bulgaria. |
| Romania | SPARK VISION IS ROMANIA SRL, CUI 54581719, registration no. J2026028294009; Str. Verzisori 6, Bl. D, Ap. B118, 040301, Sector 4, Bucharest, Romania. |
When we say "we" and "us", we mean the company responsible for the activity concerned. The two companies do not automatically have access to all your data. For an order with the Romanian seller, the necessary data is provided to that seller. To the extent that the Bulgarian company carries out technical and administrative operations solely on its behalf and on its instructions, it acts as a processor for those operations. This does not change its own responsibilities for managing the Site.
You can contact us at customer.support@sparkvision.tech, and for orders delivered to Romania also at support.romania@sparkvision.tech, or at the address of the relevant company. If your question concerns a purchase, please state the order number, if you have it, so that we can direct it to the relevant seller.
What personal data is
Personal data is any information relating to an identified natural person or a natural person who can be identified directly or indirectly. Different pieces of information which, taken together, make it possible to establish who the person is are also considered personal data. These may include a name, e-mail address, telephone number, delivery address, order details, IP address and online identifiers. Data does not stop being personal simply because a code or other identifier is used instead of a name.
Processing means any operation performed on personal data, including collection, storage, use, disclosure, restriction and erasure. Information about a legal entity is not in itself personal data, but the names and contact details of its representatives may be personal data.
What personal data we collect
Information you provide to us
We collect data depending on how you use the Site and what you ask of us. Not all the data listed below is needed for every interaction.
| When you provide data | What data we process |
|---|---|
| When making an enquiry | Name, e-mail address and message from our own contact form; telephone number, if you contact us by telephone or provide it for us to call you back; subsequent correspondence. |
| When ordering and taking delivery | Name of the buyer and recipient, e-mail address, telephone number, address or selected delivery office/locker, selected products, quantity, price, order number and status, and the necessary communication. |
| When invoicing and paying | Details of the invoice recipient and the required invoice particulars; chosen payment method, amount, payment status and identifier. For bank transfers or refunds, the account holder's name and bank account may be processed. For card payments — the transaction reference number, payment status and, if provided by the payment provider, the card type and masked card number; the data in the receipt for the registered sale. |
| When withdrawing, returning, complaining and receiving service | Contact, order and product details, serial number where necessary, description of the problem, proof of purchase, relevant photos, documents, service reports and refund details. |
| When requesting and organising a consultation | Contact details and other information entered in the consultation form, as well as subsequent correspondence and the arrangements for holding it. |
When you place an order, send an enquiry or request a consultation, we indicate which data you need to provide so that we can fulfil your request. For example, payment and delivery details are needed to process the purchase, and contact details allow us to answer your questions or to clarify and confirm the consultation. If you do not provide the necessary information, we may not be able to fulfil the request. All other data is provided at your discretion. You can make a purchase without creating a customer account.
The contact form and the consultation form are our own development. The information submitted through them is stored in the Site's database, hosted with Supabase. When an enquiry is sent, a notification goes to customer.support@sparkvision.tech, and when a consultation is requested, a message is posted in an internal Slack channel to organise handling of the request. Our business e-mail is provided through Titan. The information is accessible to authorised team members who need it.
If you want the order to be delivered to another person, we will need their name and contact and delivery details. Please provide only the information needed to receive the shipment and make the recipient aware of this Policy. We will also inform them about the processing of their data at our first contact with them and within the applicable legal time limits. Where the recipient is not a party to the purchase contract, we use their data on the basis of our legitimate interest in organising and carrying out the requested delivery. In the same way, we process the business contact details of representatives of our customers that are legal entities, in order to carry out the necessary communication relating to their orders and service.
Information on payment and instalment purchases
Orders can be paid by bank card (except for orders delivered to Romania), by bank transfer or by instalment purchase (Bulgaria only). We do not offer cash on delivery. For bank transfers: to establish payment and fulfil the order, we process the necessary data from the bank transaction, including the payer's name, bank account, amount, date, payment reference and transfer identifier. For refunds, we process the necessary details of the recipient and their bank account. We never ask you for online banking passwords or codes.
Card payments. Card payments are processed by myPOS Ltd (Ireland) — a licensed electronic money institution. You enter your card details directly on the secure myPOS payment page. We do not receive or store the full card number, the security code (CVV/CVC) or your payment authentication data. From myPOS we receive information about the outcome of the payment — amount, date and time, status, transaction reference number and, to the extent provided by the provider, the card type and masked number (for example the last four digits). For processing the payment, preventing fraud and its own legal obligations, myPOS acts as an independent controller and provides its own information on data processing. The contract with myPOS has been concluded by "SPARK VISION IS" OOD, which is why card payment is available only for orders delivered to Bulgaria.
Sales documents. For card payments, we issue and send you by e-mail a receipt for the registered sale with a QR code in accordance with Ordinance No. N-18 of the Bulgarian Minister of Finance. It contains the order number, the payment reference number, the goods purchased and the amount. For legal entities, and for natural persons who request it, we issue an invoice with the recipient details required by tax legislation. For orders paid by card, we submit monthly information on orders and payments to the Bulgarian National Revenue Agency to the extent required by Ordinance No. N-18. We process this data to fulfil our legal obligations. The QR-code receipt is generated and sent automatically to the e-mail address you provided immediately after successful payment.
Instalment purchases through First Investment Bank AD (Fibank) are offered only for Bulgaria. When you choose this option, before you apply we inform you what data is needed and whether you provide it directly to the bank or certain data is passed on through us. The bank processes the application and financing data as an independent controller in accordance with its own privacy information.
The relevant lender examines your application, assesses your creditworthiness and decides whether and on what terms to provide financing. It is solely responsible for these activities and provides its own information on the processing of your personal data. We do not assess your creditworthiness; we receive the necessary information on the approval, refusal or status of the financing so that we can process your order.
Information we receive from others
To fulfil your order and provide the related service, we sometimes receive information from the partners involved in these activities. For example, the bank or payment service provider may confirm a payment or refund to us, and the courier may tell us whether the shipment has been delivered or returned. We use this information to track the fulfilment of the specific order, to inform you of its status and to take the necessary service actions.
If another person places an order and names you as the recipient, we will receive from them your name and the contact and delivery details provided. We will use this data to organise the delivery and, where necessary, to contact you about receiving the shipment.
Partner discount codes
In the online shop we use Coupon Affiliates for WooCommerce to manage partner discount codes. When you use such a code, it is recorded against your order so that we can apply the discount and account for the use of the partner code concerned. For participating partners, we process the necessary identification and contact details, the codes issued to them and information on their use. Where partner relationships involve remuneration, we also process the data needed to calculate, account for and pay it.
Information when browsing the Site
When you visit the Site, your browser and the systems that make it work automatically provide certain technical information. This may include your IP address, the date and time of the visit, the address of the page opened and the type of browser and device used. Technical errors or requests that indicate a possible attempt at abuse may also be logged. We use this information to load the pages you request, to keep the Site running normally and to detect and fix technical problems and security threats.
If you consent to the relevant category of cookies and similar technologies, Google Analytics and Meta Pixel collect additional information only about visits to predefined permitted pages, subject to the restrictions described below. The use of these tools, the purposes of the processing and the ways to change your choice are described below. The information collected may constitute personal data even when it does not contain your name — for example if it includes an online identifier through which your browser or device can be recognised and your separate visits linked together.
For what purposes and on what legal bases we use the data
We use your personal data for specific purposes, relying for each on the applicable legal basis set out in the table below. For the use of optional analytics and advertising technologies, we ask for your prior consent. Whether or not you give it does not affect your ability to place an order or its fulfilment.
| Purpose | Legal basis |
|---|---|
| Answering a question about a purchase and organising a requested consultation. | Taking steps at your request before entering into a contract — Art. 6(1)(b) GDPR, where you will be a party to it. |
| Accepting and fulfilling an order, payment, delivery and contractual service. | Entering into and performing a contract with you — Art. 6(1)(b) GDPR. |
| Invoicing, accounting, tax obligations, issuing sales documents and submitting data to the National Revenue Agency, and exercising statutory consumer rights, including withdrawal and complaints. | Compliance with legal obligations — Art. 6(1)(c) GDPR; contractual basis for actions to perform the agreed service. |
| General enquiries, contacts with representatives of organisations and with recipients of shipments who are not buyers. | Legitimate interest — Art. 6(1)(f) GDPR: answering correspondence, business relations and carrying out the requested delivery. |
| Reliable operation of the Site, detection of technical problems, fraud and abuse. | Legitimate interest in security — Art. 6(1)(f) GDPR; legal obligation to apply appropriate personal data protection measures. |
| Analysis of usage through Google Analytics; measuring and personalising advertising through Meta Pixel. | Prior consent given for analytics and marketing technologies — Art. 6(1)(a) GDPR. |
| Handling requests to exercise rights and responding to mandatory requests from authorities. | Legal obligation — Art. 6(1)(c) GDPR. |
| Establishing, exercising and defending legal claims. | Legitimate interest in protecting rights — Art. 6(1)(f) GDPR, and legal obligation where applicable. |
| Applying a discount code entered on the order. | Performance of the contract with the buyer — Art. 6(1)(b) GDPR. |
| Managing relationships with partners and accounting for partner codes used. | Performance of a contract, where the partner is a natural person; legitimate interest in managing partner relationships and accounting for codes, including when dealing with representatives of legal entities; legal obligation for the applicable accounting and tax reporting. |
| Sending e-mails with discounts and product information to people who have subscribed. | Consent — Art. 6(1)(a) GDPR, given through a separate field when ordering, in accordance with the requirements for commercial communications by e-mail. |
When we process your personal data on the basis of legitimate interest, we first assess whether this is necessary for the purpose concerned and whether your rights and freedoms override that interest. In this assessment we also take into account what you can reasonably expect from us in view of our relationship and the way you provided your data. You have the right to object to such processing on grounds relating to your particular situation. More information about this right and how to exercise it can be found in the section "Your rights".
When you make a purchase or send us an enquiry, we do not automatically subscribe you to a newsletter and we do not use the data from the order or form to create and upload contact lists to advertising platforms. We send you marketing messages only if you have given separate consent for this, as described below. Regardless of your choice regarding marketing messages, we may send you the necessary information about your order, delivery or requested consultation, such as confirmations, clarifications and notifications of changes.
E-mails with discounts and product information. When ordering, you can optionally tick the box to receive e-mails with exclusive discounts and product information. The box is not pre-ticked and subscribing is not a condition of the order. If you tick it, we use your e-mail address and name, the Site language and the date and method of subscription to send you such messages on the basis of your consent. [We do not use information about the products you have purchased or viewed to determine the content of the messages.] We use Resend to send them. You can unsubscribe at any time via the link in every message or by writing to us at customer.support@sparkvision.tech. After you unsubscribe, we stop sending and delete the subscription data, keeping only the minimum information needed to prove the consent given and withdrawn.
Sensitive information
To answer your enquiry, organise a consultation or fulfil an order, we do not normally need to receive diagnoses, medical documents or detailed information about your health or disabilities. We therefore ask you not to include such information, personal identification numbers or unnecessary personal data about other people in free-text fields. If you submit a complaint, describe the problem with the product and attach only the documents and photos needed to handle it. When you make an enquiry on behalf of another person, use your own contact details and share only the information needed for the question concerned.
We recognise that information about interest in or the purchase of an assistive device, especially when combined with other data, may allow conclusions to be drawn about a person's health. We therefore do not use data from orders, consultations and complaints, or information about interest in products that may reveal a health condition, to create advertising audiences, and we do not share it with Meta or Google Analytics. This also applies to technical information, such as addresses and titles of pages visited or actions taken, where it may reveal such circumstances.
If we nevertheless receive sensitive information that is not needed for your request, we restrict access to it and delete it once we become aware of it. The mere provision of such information does not mean that you have given explicit consent for us to use it.
If, for specific assistance, it is genuinely necessary for us to process data about your health, before requesting it we will explain what information is needed, why it is needed, how long we will keep it and on what basis under Art. 9 GDPR we will process it. Where that basis is your explicit consent, we will ask for it separately. Consent to the use of cookies does not constitute consent to the processing of health data.
Cookies and your choices
When you visit the Site, small text files called "cookies" may be stored in your browser. They make it possible, for example, to remember the products you have put in your basket or your preferences and, with your consent, to analyse use of the Site and measure the effectiveness of advertising.
In addition to cookies, pixels and similar technologies may be used, which send information about your visits and actions on the Site without necessarily storing a file in the browser. The choice you make through the banner and "Cookie settings" therefore also applies to these technologies, not only to cookies.
| Category | What it is used for |
|---|---|
| Strictly necessary | For expressly requested functions, for example keeping the basket and session when ordering, security and remembering your cookie choice. Not used for advertising. They do not require consent only to the extent that they fall within the legal exemption. |
| Analytics | Google Analytics for analysing permitted visits and improving the Site. Off until you consent. |
| Marketing | Meta Pixel for measuring and personalising ads through permitted interactions. Off until you consent. |
Through the cookie banner you can decide whether to allow optional cookies and similar technologies. You can accept all, reject them or choose individually the categories you want to allow. Analytics and marketing technologies remain off until you consent to them. If you close the banner, scroll the page or continue browsing the Site, we will not treat this as consent.
You can change your preferences or withdraw your consent at any time via the "Cookie settings" link at the bottom of the Site. After withdrawal, we stop collecting data through the relevant technologies for the purposes you no longer allow. This does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal. If you want personal data already collected to be deleted, you can make a request as described in the section "Your rights", under the conditions laid down in the GDPR.
So that you do not have to set your preferences on every visit, we store your choice in the browser concerned for up to 6 months. You can change it before that period expires. If you delete cookies or use a different browser or device, you may need to make your choice again. We will also ask for a new choice if there is a significant change in the purposes of use or the providers of the technologies concerned.
In "Cookie settings" you will find detailed information about the cookies and similar technologies actually used, including their names, providers, purpose and duration. The period for which a cookie remains in your browser is not necessarily the same as the period for which the data collected through it is stored. Information on the storage of this data is provided in the relevant sections of the Policy.
Restrictions on analytics and advertising tracking
Google Analytics and Meta Pixel are used only after consent for the relevant category and only on predefined pages whose content and transmitted data have been checked for the risk of revealing sensitive information. All other pages are excluded from tracking through these tools.
We do not send to Google Analytics or Meta Pixel data from product pages, contact forms, consultation forms, the basket, checkout and order confirmation, payments, returns and complaints, including the related confirmation pages.
Automatic tracking of page changes and clicks, automatic collection of form data and automatic matching of contact details are switched off. Only explicitly configured data about permitted visits is transmitted. We do not send events for a requested consultation, order or complaint.
The restrictions also cover page addresses and titles, the address of the previous page and the parameters of the events sent, so that no personal or sensitive information from excluded pages is transmitted through them. Where consent is absent, refused or withdrawn, we do not send data through the tool concerned.
Google Analytics
If you allow analytics cookies and similar technologies, we use Google Analytics 4 for statistical analysis of visits to the predefined permitted pages. Data on the permitted visit, date and time, general information about the browser and device and online identifiers that can link separate visits are processed. Page addresses and information on the source of the visit are restricted in accordance with the measures described above. We do not use the service to track consultations, orders or complaints.
The provider of the service for the European Economic Area is Google Ireland Limited, and other Google group companies may be involved in providing it. According to Google's documentation, for visits from the European Union the IP address is used to determine approximate location and is then discarded before the data is recorded. However, this does not mean that the other information collected is anonymous, as online identifiers may allow a browser or device to be recognised.
We do not send to Google Analytics the content of completed forms, your name, e-mail address, telephone number or health information. We do not use the service to create advertising audiences or to link your visits to the contact details you have provided to us.
For individual user and event data we have chosen a retention period of 2 months. This setting does not determine the retention period of all aggregated statistical reports provided by the service. You can read more about how Google processes data in the information on how Google uses data from partner sites and apps and in the Google Privacy Policy.
Meta Pixel
If you allow marketing cookies and similar technologies, we use Meta Pixel on the predefined permitted pages to measure the effectiveness of our ads on Facebook and Instagram and to show ads to relevant audiences. For these purposes, only data on permitted visits is used, subject to the restrictions described above.
When the Pixel is active, online identifiers, IP address, browser information, the address of the page visited and the time of the visit may be sent to Meta Platforms Ireland Limited. If Meta recognises you, it may link the information received to your Facebook or Instagram account. The tool may also transmit information about visitors who do not have an account on these platforms.
We do not provide Meta with the content of forms, names, e-mail addresses, telephone numbers or information that reveals a health condition or disability. We do not use the Pixel in consultation forms and their confirmation pages, in the basket, at checkout and order confirmation, payment, returns or complaints. We also exclude from advertising tracking other pages or actions where information about them may reveal sensitive circumstances about the visitor.
For the collection and transmission of data through the Pixel, the purposes and means of which we determine jointly with Meta, "SPARK VISION IS" OOD and Meta act as joint controllers. Our responsibilities include choosing and configuring the tool on the Site, providing prior information and obtaining the necessary consent. The allocation of obligations is set out in the joint controller addendum with Meta. Regardless of this allocation, you can exercise your rights against each of the joint controllers.
For subsequent processing, for which Meta independently determines the purposes and means, its privacy policy applies. There you will also find information on data retention periods and criteria and on how to exercise your rights. Further details about the cookies used by Meta are available in its cookie policy.
You can withdraw your consent to marketing technologies at any time through "Cookie settings" on our Site. After that, Meta Pixel will not be used for further tracking through the Site in that browser.
Who we share personal data with
Your personal data is accessible only to those members of our team who need the information to perform their specific duties — for example to answer an enquiry, process an order or assist with a complaint.
For some of these activities we work with external providers and partners, to whom we provide only the data needed for the service concerned. Who your data is shared with depends on the specific order or request, including the chosen payment and delivery method and the after-sales service needed. The table below describes the categories of recipients and the purposes for which they need access.
| Recipient | Why access is needed |
|---|---|
| The relevant seller | For processing and fulfilling the order, invoicing, consumer rights and service. The allocation between the two companies is described above. |
| Couriers and logistics partners - Speedy for Bulgaria and DPD for Romania | For delivering and returning shipments. The necessary recipient, contact and delivery details and shipment information are provided. For Romania, delivery is made to a selected pick-up point. |
| Banks, payment providers (myPOS Ltd for card payments), First Investment Bank AD or another chosen lender | For payment, refunds and a requested instalment purchase through Fibank, for Bulgaria only. For their own banking activities and legal obligations, banks act as independent controllers. The same applies to myPOS when processing card payments. |
| Automattic / WordPress.com | For providing the online shop platform and infrastructure. |
| Railway | For hosting and technical operation of the Site; the region used is Amsterdam, the Netherlands. |
| Supabase | For hosting the Site's database, including data from the contact form and the consultation form; the region used is Ireland. |
| Titan — Flock FZ-LLC | For providing business e-mail and related correspondence. |
| Resend | For technical sending of e-mails from the Site and the online shop, for example order confirmations and notifications, as well as e-mails with discounts and product information to subscribers. It processes the recipient's address, the e-mail content and technical sending logs, which are stored in the USA for up to 30 days. |
| Slack | For internal notifications to the team when a consultation is requested. Messages are deleted automatically within the period stated in the retention section. |
| Accounting and other technical providers | For the necessary accounting services, security and technical support, with access only to the data needed for the service concerned. |
| Google and Meta | Where consent has been given and subject to the restrictions described in the cookies section. |
| Legal advisers and competent authorities | Where there is a specific obligation, proceedings or a need to protect rights. For example, we provide sales data to the National Revenue Agency in accordance with tax legislation and Ordinance No. N-18. |
Service is carried out by our team, with the allocation of responsibilities between the companies described in this Policy. For this purpose we use the necessary data on the order, the product, the problem reported and the service actions performed.
Our providers and partners may have different responsibilities for your personal data depending on the service they provide. Where they process data on our behalf and on our instructions, our relationship is governed by a contract setting out the processing conditions and their obligations to protect the information. Where they independently determine the purposes and means of processing, for example to comply with their own legal obligations, they act as separate controllers and provide their own information on the use of data. In both cases we remain responsible for the lawful collection and provision of data on our side.
Transfers of data outside the EEA
We use services of international providers, including Automattic/WordPress.com, Railway, Supabase, Titan, Slack, Resend, Google and Meta. In providing these services, personal data may be processed or accessed outside the European Economic Area, including through participating companies and subcontractors. The selected regions for hosting the Site with Railway and the database with Supabase are Amsterdam, the Netherlands, and Ireland respectively. Locating the main infrastructure in the EU does not in itself rule out access or other processing outside the EEA.
Resend, through which we send e-mails from the Site and the online shop, stores the content of e-mails sent and the related technical logs in the USA for up to 30 days. The transfer is based on the European Commission's adequacy decision under the EU–U.S. Data Privacy Framework, under which the provider is certified, and, as an additional safeguard, on the standard contractual clauses approved by the European Commission.
When we transfer personal data outside the EEA, we comply with the requirements of Chapter V of the GDPR. Depending on the country and the recipient, the transfer may be based on a European Commission decision recognising the level of protection as adequate, or on other appropriate safeguards. Such safeguards may be the standard contractual clauses approved by the European Commission, together with supplementary protection measures where necessary.
For transfers to the USA, we may rely on the EU–U.S. Data Privacy Framework only to the extent that the relevant adequacy decision is in force and the recipient holds a valid certification covering the specific transfer. If you would like more information about the recipients, countries or applicable safeguards, you can write to us at customer.support@sparkvision.tech. You can also request a copy of the relevant safeguards at the same address.
The provision of data between the Bulgarian and Romanian sellers takes place within the European Union and does not constitute a transfer outside the EEA.
How long we keep your personal data
We keep your personal data for the period necessary for the purpose for which it was collected, also taking into account the applicable legal obligations. Different data and documents relating to a single purchase may therefore have different retention periods. For example, the invoice must be kept for the period required by law even after delivery is complete, while working copies and other information that is no longer needed are deleted earlier. The table below sets out the periods for each category of data or the criteria by which we determine them.
| Data | Period or criterion |
|---|---|
| Enquiries and consultations without a subsequent purchase | Up to 12 months after the last substantive contact or the consultation held, whichever is later. An automatic reminder does not restart the period. |
| Orders and contractual service | For fulfilling the purchase and the applicable after-sales service. After that, only the documents needed for a legal obligation or the protection of specific rights are kept separately, as set out in the following rows. |
| Returns, complaints and warranty service | Until the case is closed and the resulting obligations are fulfilled. Evidence that remains necessary for legal claims is kept for the applicable limitation period, including where a longer warranty is in force. |
| Necessary evidence on contracts and claims | In accordance with the applicable limitation period; the general period is 5 years under Bulgarian law and 3 years under Romanian law, unless another period applies. The starting point depends on the specific claim. In the event of suspension, interruption or a pending dispute, only the relevant data is kept until the need ceases, including for enforcement of the judgment. |
| Accounting and tax documents of the Bulgarian seller | Accounting registers, financial statements and documents for tax audits — 10 years from 1 January of the following reporting period; for other accounting records — 3 years under Art. 12 of the Bulgarian Accountancy Act, unless another applicable rule requires longer retention. Invoices needed for tax audits fall into the first category. The same applies to receipts for registered sales under Ordinance No. N-18. |
| Accounting registers and supporting documents of the Romanian seller | Under the general rule of Art. 25 of the Romanian Accounting Law No. 82/1991 — 5 years from 1 July of the year following the financial year in which they were drawn up, unless a specific obligation applies. |
| Technical logs on operation and security | Up to 90 days. Relevant logs for a specific incident or dispute may be kept until the investigation and the necessary actions are completed. |
| Cookie choice and proof of consent | The choice in the browser — up to 6 months or until changed/deleted. Minimum proof of the choice, date and version — up to 12 months after the consent expires or is withdrawn. |
| Individual data in Google Analytics | 2 months, according to the user and event setting. Irreversibly anonymised summaries may be used after that. |
| Requests to exercise rights | Until the request is closed and up to 12 months after the final reply or the last actions, whichever is later; in the event of a dispute — only the evidence needed to resolve it. |
| Partner data and partner codes used | Data on partner relationships is kept for the duration of the relationship and thereafter only to the extent necessary for applicable legal obligations or legal claims. The code recorded against an order is kept in accordance with the period for the relevant order data. |
| Subscription to e-mails with discounts | Until you unsubscribe or withdraw consent. Minimum proof of consent given and withdrawn — up to 3 years after withdrawal, for defence against possible claims. |
Where Meta processes data for purposes it determines independently, the retention periods are determined in accordance with its Privacy Policy, linked above. On our side, we do not create or maintain contact lists from forms and orders to build advertising audiences.
When the relevant period expires, we delete the personal data or anonymise it irreversibly so that it can no longer be linked to you. This procedure also covers copies stored in our business e-mail or with providers processing data on our behalf.
For enquiries and consultations without a subsequent purchase, we apply automatic deletion in the database and deletion rules for the related correspondence in business e-mail. Internal notifications are deleted automatically no later than 12 months after they are sent. Only specific data subject to a separate applicable legal obligation or needed to establish, exercise or defend legal claims is kept longer, in accordance with the periods and criteria in the table.
Deleted data may remain for a limited period in backups until it is removed according to the established schedule. These copies are not used for ongoing communication or service. If the system has to be restored from a backup, we take the necessary steps to delete again any data whose retention period has already expired or which was deleted for another reason.
Your rights
In connection with the processing of your personal data, you have the rights described below. You can exercise them whether you have made a purchase, sent an enquiry or only visited the Site. You do not need a customer account to do so. Each right applies under the conditions laid down in the GDPR, and the purpose, legal basis and circumstances of the specific processing are relevant.
Access to and rectification of data
You have the right to obtain confirmation as to whether we process personal data about you and, if so, to request access to it and a copy. You can also obtain information about the purposes of the processing, the recipients of the data, the retention periods and the other matters provided for in the GDPR.
If you find that the data we hold is inaccurate or incomplete, you can ask us to correct or complete it.
Erasure of data
You can ask us to delete your personal data where there are grounds for doing so — for example if it is no longer needed for the purposes for which it was collected, if it has been processed unlawfully or if you have withdrawn your consent and there is no other legal basis for continuing the processing.
The right to erasure does not apply unconditionally. In certain cases we need to keep some of the data to comply with a legal obligation or to establish, exercise or defend legal claims. For example, a request for erasure does not override our obligation to keep accounting documents for the period required by law. If we cannot comply with your request in whole or in part, we will explain the reasons.
Restriction of processing
In certain cases you can ask us to temporarily restrict the use of your data. This is possible when you contest its accuracy and we need time to verify it, or when the processing is unlawful but you prefer the data to be kept with restricted use rather than deleted.
You can also request restriction when we no longer need the data but you need it to establish, exercise or defend legal claims. You also have this right when you have objected to the processing, pending verification of whether our legitimate grounds override yours.
Where processing is restricted, we continue to store the data but use it for other operations only in the cases permitted by the GDPR. We will inform you before the restriction is lifted.
Data portability
When we process data by automated means on the basis of your consent or a contract with you, you can request to receive the personal data you have provided in a structured, commonly used and machine-readable format. This allows you to provide it to another controller. Where technically feasible, you can ask us to transmit it directly to a controller you designate.
Objection to processing
When processing is based on our legitimate interest, you have the right to object on grounds relating to your particular situation. On receiving the objection, we will stop the processing concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or that the data is needed to establish, exercise or defend legal claims.
If you object to the use of your data for direct marketing, we will stop processing it for that purpose, including the related profiling, without you needing to give reasons.
Withdrawal of consent
When processing is based on your consent, you can withdraw it at any time. For analytics and marketing cookies and similar technologies, you can do this through "Cookie settings" on the Site. You can also contact us at the e-mail address below.
Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.
How to exercise your rights
You can make a request to customer.support@sparkvision.tech or to the address of the relevant controller stated in this Policy. Describe what you want us to do and provide enough information for us to identify which data your request concerns.
We will reply without undue delay and at the latest within one month of receiving the request. If its complexity or the number of requests received requires more time, the period may be extended by up to two further months. In that case we will inform you within the first month and explain the reasons for the extension.
If we have reasonable doubts about the identity of the requester, we may ask for additional information needed to confirm it. We do not automatically require a copy of an identity document for every request.
Exercising your rights is, as a rule, free of charge. If a request is manifestly unfounded or excessive, the GDPR allows us to charge a reasonable fee based on the administrative costs or to refuse to act. In such a case we will justify our decision and inform you of the available remedies.
Complaint to a supervisory authority
If you believe that we are processing your personal data in breach of the applicable rules, you have the right to lodge a complaint with a competent supervisory authority. You do not need to contact us first to exercise this right.
In Bulgaria you can contact the Commission for Personal Data Protection, address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, website: https://cpdp.bg, e-mail: kzld@cpdp.bg.
In connection with processing by the Romanian seller, you can also contact the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), website: https://www.dataprotection.ro, e-mail: anspdcp@dataprotection.ro.
You can also lodge a complaint with the competent supervisory authority in the EU country where you habitually reside, work or where the alleged infringement took place. Regardless of the right to complain to a supervisory authority, you also have the right to an effective judicial remedy.
Automated decisions and profiling
We do not take decisions based solely on automated processing of your personal data that produce legal effects concerning you or similarly significantly affect you.
If you allow marketing cookies and similar technologies, the advertising tracking described in the Meta section may involve profiling. This means that information about visits to the predefined permitted pages may be used to assess your presumed interests and to show more relevant ads. You can withdraw your consent at any time through "Cookie settings".
If you apply for an instalment purchase, the assessment of your creditworthiness and the decision on whether you receive financing are made by the relevant lender. We do not carry out this assessment and do not set the approval criteria. The lender provides separate information on how it processes your data, including whether it uses automated decisions or profiling, what the consequences are for you and how you can exercise your rights in relation to them.
How we protect data
We apply technical and organisational measures to protect your personal data against loss, misuse, alteration and unauthorised access or disclosure. We adapt these measures to the nature of the data, the purposes of the processing and the possible risks to your rights and freedoms. They include limiting access to the people who need the information to perform their duties, managing the access rights granted, protecting data in transit and incident response procedures.
To contact us or exercise your rights, you do not, as a rule, need to send a copy of an identity document. If there is a reasonable doubt about your identity, we will ask only for the additional information needed to confirm it.
When you send a device for repair, please do not provide passwords or personal files that are not needed to identify and fix the problem. If the diagnostics require access to specific data on the device, we will agree with you in advance what information is needed, what it will be used for and how access will be provided. Submitting a complaint or handing over the device for repair does not in itself constitute permission for unrestricted access to its content.
Links to other services
The Site may contain links to services provided by other organisations, for example banks, payment service providers or manufacturers. When you move to such a service, the organisation concerned may collect and use personal data for its own purposes and obligations. We therefore recommend that you read its privacy policy before providing information or using the service.
References to the policies of other organisations help you understand how they process your data. They do not relieve us of responsibility for the personal data we collect, use or share, or for the processing for which we act as joint controllers under the conditions described in this Policy.
Changes to the Policy
We may update this Policy when there are changes to the Site's features, the way we process personal data or the applicable legal requirements. The current version will be available on this page, with the date of its last update.
If the changes significantly affect the way we use your personal data, we will inform you appropriately before they apply, for example through a visible message on the Site. Where new consent is needed for the intended processing, we will ask for it separately. The mere publication of the updated Policy or continued use of the Site does not constitute such consent. Changes do not apply retroactively and cannot make lawful any processing that did not have the necessary legal basis at the time it was carried out.
Last updated: 10 November 2026