Legal
Privacy policy
Version 2026-10-31 · updated 31 October 2026
Company details
- Name
- INOVA WORKS S.R.L.
- VAT ID
- RO53219185
- Trade register no.
- J2026000888008
- Registered office
- Str. Petru Maior nr. 26A, et. 2, ap. 12
- office@novaworks.ro
- Phone
- +40 756 109 881
- Phone
- +40 728 309 794
Who is responsible for your data
This is a translation for convenience; the Romanian version prevails.
The controller of your data is the company whose identification details are shown at the top of this page. For any question about your data, write to us at the email address shown there.
This policy explains what data we process when you use the NovaWorks site, why, how long we keep it, who we share it with and what rights you have under Regulation (EU) 2016/679 (GDPR).
What data we collect
We collect only what each step needs:
- When you visit the site: your IP address and the technical details of the request, in the server logs, and the strictly necessary cookies described on the Cookies page. We use no analytics and no advertising cookies.
- When you upload files: the CAD files, their names and sizes, the computed geometry (dimensions, volume) and the configurations you choose, tied to an anonymous session.
- When you place an order: your email address, name, phone, billing details (for private individuals the name and address, for companies the VAT/fiscal ID and the company details from the public ANAF registers), the delivery address or chosen locker, the payment method and the payment status. Card details go directly to Stripe; we do not see them.
- In your account: your email address, language, saved addresses, the companies you belong to, your parts, quotes, orders, invoices and your comments on quotes.
- When you write to us through the contact form: your name, email address, company (if you fill it in), the message and the attached files. For the form's limits we keep, as long as the files exist, a fingerprint of your IP address, from which the address cannot be read.
- For our team: email address, role and the actions taken in administration.
Why we use it and on what legal basis
The legal bases are those of GDPR art. 6(1):
| Purpose | Legal basis |
|---|---|
| Calculating the price, the quote, checking parts, production, delivery and order emails | Entering into and performing the contract (point b) |
| Invoices, accounting records and submission to e-Factura | Legal obligation (point c): Law no. 82/1991 and the Fiscal Code |
| Site security, preventing fraud and abuse, logs and error reports | Legitimate interest (point f): a safe, working site |
| Answering messages sent through the contact form | Legitimate interest (point f) or, if the message concerns an order, steps before the contract (point b) |
Who we share data with
The site runs at Vercel, in the Frankfurt data centre, and your files are prepared for the price calculation at Railway, in the Amsterdam data centre. We make the parts in the NovaWorks workshop in Timișoara, Romania.
We use the providers below, which process data only on our behalf and on our instructions, under a data processing agreement (DPA). The data is hosted in the European Union, with the exceptions shown in the table.
For companies, we take the company’s public details from ANAF (and, where relevant, from the European VIES system), based on the VAT/fiscal ID. The couriers that deliver the parcel (through EuroParcel) receive the name, phone and delivery address and process them as independent controllers. Stripe processes the data used for fraud prevention as an independent controller.
ANAF receives the invoices through e-Factura, including those issued to private individuals (legal obligation, point c).
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication and file storage | EU (Frankfurt, Germany) |
| Vercel | Hosting the site: it sees the IP address and every request to the site, and holds the encrypted connection | EU (Frankfurt, Germany); US company |
| Railway | Preparing files for the price calculation: it receives the uploaded file, only for as long as the calculation takes | EU (Amsterdam, the Netherlands); US company |
| Cloudflare | DNS and the anti-bot check (Turnstile) | EU and USA (global network) |
| Stripe | Card payments | EU and USA |
| Resend | Sending emails: sign-in codes, quote and order emails, invoices and the contact form messages with their attachments | EU (Ireland); a US company |
| Oblio | Issuing invoices and proformas | Romania |
| EuroParcel | Booking transport and the parcel label | Romania |
| SimplyPrint | Managing the workshop printers; receives the production files (the parts’ geometry, prepared for the printer) sent for printing, named with the order number and the part name, never your name or your company’s | EU |
| Sentry | Error reports, filtered of personal data | EU (Germany) |
| The backup provider (still to be set) | Keeps, outside the workshop, the backups of the database, the files and the server configuration; we encrypt them before they leave us, so the provider cannot read them | EU (still to be set) |
| The provider of the team’s mailbox | Messages received by email and through the contact form | To be completed |
Transfers outside the EU
Stripe, Vercel, Railway, Cloudflare and Resend are US companies and may transfer data there: Stripe for payments and fraud prevention, Vercel and Railway for hosting (the data stays in the EU, but the companies may access it from the USA), Cloudflare for DNS and the anti-bot check, Resend for sending emails (emails leave from Resend’s EU region, but the company may access or keep data in the USA). Supabase keeps the database and the files in the EU (Frankfurt) and Sentry keeps error reports in the EU too, but both are US companies.
These transfers rely on the EU-US Data Privacy Framework, for certified providers, and on the standard contractual clauses approved by the European Commission.
How long we keep data
| Data | How long we keep it |
|---|---|
| Anonymous drafts (files, configurations, quotes never ordered, date holds, comments) and anonymous sessions | 30 days after the last activity |
| Files of a user with an account | As long as the account exists |
| Orders, invoices and proformas | 10 years, under Law no. 82/1991 |
| Parcel labels (AWB) | 180 days |
| Production files (the plates prepared for the printers) | 90 days after the order was delivered or cancelled |
| Messages from the contact form | In the team’s mailbox, as long as needed to answer; the exact period is still to be set |
| Files sent through the contact form | 30 days from sending the message, then deleted automatically; if the message was never completed, after 6 hours. Copies downloaded for a quote or an order are kept as long as those need them |
| Logs of the site (Vercel) and of the file preparation (Railway) | Kept by the providers, for short periods; the exact period is still to be set |
| Error reports | At most 90 days |
| Backups | 35 days |
Deletion and backups
When we delete data, it disappears from the app at once. It leaves the backups within 35 days, as old backups are replaced. Until then the backups are encrypted and used only to restore after an incident.
CAD files
Your files are confidential. We use them only to calculate your price, check the parts and produce them. We do not use them to train artificial intelligence models, we do not use them in marketing and we do not show them to other customers.
Files are kept in private storage, in the EU. Only our team and our production systems have access to them, through private access; you open them through temporary links. Your colleagues in the same company can see and download the company’s parts.
In production, the files sent to the printers carry the order number and the part name, without your name or your company’s.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw any consent at any time.
In your account, under “My data”, you can download your data (a JSON file, with links to your files valid for 24 hours) and delete your account, confirming with a code sent by email. Deletion is not possible while an order is in progress.
On deletion we remove your drafts, files, addresses, company memberships and the account. We keep the orders, the invoices and the billing details on them for 10 years, because the law requires it. On those orders we replace your email address and delete the delivery contact person and phone; the billing details, the delivery address, the items and the amounts stay. Your comments on quotes are deleted. Parts created in a company stay with the company; if you are its last member, we also delete the company’s parts and files.
For any other request, email us. We answer within one month, as the GDPR requires.
Complaint to the ANSPDCP
If you believe we process your data unlawfully, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro. Please write to us first, so we can fix it quickly.
No automated decisions with legal effects
We take no decision based solely on automated processing that produces legal effects for you (GDPR art. 22). The instant price is a quote calculated from the file, the same for every customer, and the review of parts and the approval of payment on terms are done by a person on our team.
How we protect data
In short:
- The site, the file preparation, the database and the files are hosted in the EU; every connection is encrypted (HTTPS).
- Each customer sees only their own data and their company’s; the access rules are enforced in the database.
- Files are kept in private storage, opened only through temporary links.
- Card details reach only Stripe.
- The team has only the access it needs, and backups are encrypted.
- Error reports are filtered of personal data before they are sent.
Changes
We may update this policy. The version and the date of the last update are shown at the top of the page.