Privacy Policy

01Who we are

This policy explains what personal data this website handles when you claim an adapter, buy in the TRACE shop or join the waitlist, why, and what your rights are. It does not cover the TRACE app itself, which has its own privacy policy inside the app.

DLM INTERMED SRL (“we”, “us”) is the controller of the personal data described here under the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR).

02What we collect on this website

If you claim an adapter (with the one-time code from the app), you give us:

• your full name, phone number, email address and delivery address;
• the one-time code you entered, which links the order to your in-app purchase (the code is stored only in encrypted form until you order; that copy is then deleted and only a keyed hash of it is kept);
• the date and time you ticked “I agree to the Privacy Policy”, as a record that this policy was shown to you;
• the order number we generate.

Refund notices from the app stores. If you bought the Pro + OBD plan in the app, Apple or Google may send our server a notice that the purchase was refunded or revoked. The notice identifies the purchase, not you, and contains no personal data such as your name or email. We use it only to cancel the code or, if the adapter was already ordered, to contact you about the order.

If you buy in the shop, you enter your details on the Stripe Checkout page, not on our site. We receive from Stripe your name, email address, phone number and delivery address, what you ordered, the amount and currency, and confirmation that the payment succeeded. We also store the date and time of your order and of your acceptance of this policy. Your card details are entered only at Stripe and never reach us; we do not see or store your card number.

Technical data. Like any website, loading a page or sending a request to our ordering server involves your IP address and basic browser information, which Cloudflare (our host, see section 4) handles to deliver the site. Our ordering server uses your IP address only to limit abusive traffic: it turns the address into a keyed hash and stores only that hash with a request counter. The raw IP address is not stored in our database. A daily clean-up deletes these counters once they are older than two days, so they are kept for at most about three days.

If you do not provide the delivery details we cannot send you the product.

03Why we use it, and the legal basis

• To deliver your order: to prepare and ship it, to contact you about the delivery, and to make sure a code is used only once. Legal basis: performance of the contract you made with us (GDPR Article 6(1)(b)).
• To keep accounting records of the order (order number, items, amount). Legal basis: our legal obligations under tax and accounting law (Article 6(1)(c)).
• To keep the site and ordering server secure and prevent abuse, using the hashed IP counters described above. Legal basis: our legitimate interest in protecting the service (Article 6(1)(f)). You may object, see section 8.

We use your details only to deliver your order. We do not use them for advertising, we do not sell them, and we make no decisions about you by automated means. Ticking the box on the claim form confirms that you have read this policy.

04Who receives your data

We share data only with the providers below.

• Cloudflare, Inc.: hosts this website and our ordering server and database. Our processor.
• Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.): takes shop payments on its Checkout page and collects your card details, under its own terms and privacy policy.
• The carrier that delivers your parcel receives the name, address and phone number needed to deliver it.

We may also disclose data where a law or an authority requires it.

05International transfers

Cloudflare, Inc. and Stripe, Inc. are United States companies and operate globally, so your data may be processed outside the European Economic Area. Where that happens, it is done under the safeguards these providers offer in their data processing terms, such as the European Commission’s standard contractual clauses or an adequacy decision. You can ask us, at the address in section 9, for more information.

06How long we keep it

• Name, phone number, email address and delivery address are anonymized automatically 30 days after we mark your order as shipped or cancelled. Until then they are kept so we can deliver and support the order.
• Accounting records (order number, items, amount, currency, status, tracking number and timestamps) are kept for as long as the law requires.
• Code records (a keyed hash of the code, a keyed hash of the store’s purchase identifier, the last four characters of the code and the code’s status) contain no personal data. They are kept so that a used or cancelled code cannot be used again and a purchase cannot receive a second code.
• Hashed IP counters are kept for at most about three days (section 2).
• Stripe keeps the payment data it collects for as long as its own terms and legal obligations require.

07Cookies, analytics and third-party loading

This site sets no cookies and stores nothing in your browser. It has no analytics, no advertising and no tracking of any kind.

The typefaces are served from this site itself, so fetching them tells no one else about your visit. One page loads a resource from an outside provider. When your browser fetches it, the provider receives your IP address and browser details:

• Cloudflare cdnjs (cdnjs.cloudflare.com): the animation library used on the home page.

When you go to pay in the shop you leave this site for Stripe’s Checkout page, which Stripe operates under its own cookie and privacy terms.

08Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use it;
• object to processing based on our legitimate interests;
• receive the data you provided in a portable format, where the processing is based on a contract;
• complain to a supervisory authority.

To use these rights, contact us as set out in section 9. We reply within one month. Once your delivery details have been anonymized (section 6) we can no longer tell which order was yours, so we cannot look them up or change them.

You can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), at dataprotection.ro, or to the authority in your own EU country.

09Contact

For anything about your data, write to us by post at the registered office address in section 1: DLM INTERMED SRL, Str. Gheorghieni nr. 40, Sector 5, București, România. Please mention your order number.

10Waitlist

Until the TRACE app and products launch, the “Join the waitlist” form on this site puts you on an email waiting list. No payment is taken.

• What we collect: your email address, the product you chose (or “app”), and the time you ticked the consent box.
• Why: only to email you when TRACE launches. Nothing else: no newsletter, no advertising, no sharing.
• Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time by writing to us as set out in section 9; we then remove your address from the list. Withdrawing does not affect what we did before.
• How long: up to 18 months after you join, then the entry is deleted automatically, or earlier if you withdraw consent.
• Who handles it: Cloudflare, our host and processor (section 4). The address is stored encrypted.

11Changes to this policy

If we change how this website handles personal data, we will update this page and its date. Version 1.1, last updated 30 September 2026 (added the waitlist, section 10).