Privacy policy.

This notice covers the OFFCARR website, its forms and the linked web configurator and portal.

Controller

OFFCARR srl, Via dell'Artigianato II 29, 35010 Villa del Conte (PD), Italy; commerciale[at]offcarr.com.

Data, purposes, legal bases and retention

Browsing and security. IP address, requested URL, date and time, browser, request outcome and anti-bot signals (Cloudflare and Turnstile) are used to provide and protect the services: legitimate interest, Art. 6(1)(f) GDPR. Logs remain for as long as needed for security and diagnostics.

Statistics. Umami, hosted in the EU, records pages without URL queries or fragments, referrer, country, browser, device, events and sessions. It generates a session identifier from the IP address and user agent without storing the IP address in the statistics database. Cloudflare Web Analytics measures visits and performance without cookies or browser storage. Purpose: improving the services, Art. 6(1)(f). Umami keeps events and sessions while needed for analysis; Cloudflare states that unsampled data remain for 7 days and statistics are available for 6 months. The statistics are anonymous and aggregated, use no cookies or browser storage, serve OFFCARR alone and are never combined with other data or used for profiling, so they need no consent (Italian Data Protection Authority guidelines on cookies and other tracking tools, 10 June 2021).

Enquiries, device registration and applications. Name, contact details, messages, model, serial number and purchase details are used to reply and provide service: Art. 6(1)(b) if the requester is a party to the relationship, otherwise Art. 6(1)(f). Specific manufacturer safety duties: Art. 6(1)(c) and Regulation (EU) 2017/745. Contacts remain for up to 24 months from the last exchange, unless a contract follows; registrations for the period needed for service, safety and applicable duties; unsolicited job applications for 12 months. The Cloudflare KV queue holds forms until delivery, up to 30 days.

Portal and orders. OFFCARR processes name, company, e-mail, role, logins, configurations, notes, orders and scans. Account details may come from the person's company. Purposes: managing the business relationship, Art. 6(1)(f), or Art. 6(1)(b) if the person is a party to the contract; keeping required records, Art. 6(1)(c); securing the portal, Art. 6(1)(f). Accounts and configurations remain for the relationship; orders follow statutory periods; logins and scans remain while needed for security and review. Device storage is described in the cookie policy.

Health data. Configurations and forms, including those received from dealers, may contain measurements, weight and information about the user's disability or health for configuration, production, service and quality and safety duties. Scans may be sent to the automated-reading provider if the feature is active. This data is processed only as far as the wheelchair requires: to configure, build and service it, Art. 9(2)(h) GDPR, by staff bound to confidentiality (Art. 9(3)); for the quality, safety and vigilance duties of a medical device manufacturer, Art. 9(2)(i) GDPR and Regulation (EU) 2017/745; to establish, exercise or defend legal claims, Art. 9(2)(f). The dealer or orthopaedic shop that takes the measurements informs the user and points them to this notice; OFFCARR receives only the data the wheelchair needs. Only the staff working on configuration, production and service can access it, and it is kept for as long as the manufacturer's duties require.

Recipients and transfers

Data can be accessed by authorised staff and, depending on the service, Cloudflare, Hetzner, mail and IT support providers, the automated-reading provider if used, involved dealers and competent authorities. Cloudflare and some providers may process data outside the European Economic Area: an adequacy decision or standard contractual clauses apply; details can be requested from the controller.

Providing data and your rights

Without the required form fields we cannot respond or register the device. You may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interest and, where applicable, withdraw consent by writing to commerciale[at]offcarr.com. You may complain to the Italian Data Protection Authority.