Draft — not yet in force
The company details below are correct, but the text itself is a working draft and has not been reviewed by counsel. Do not rely on it as a binding agreement.
This notice explains how NUMODEV, računalniško programiranje, d.o.o. handles personal data in connection with the omwio platform and this website.
Our role differs depending on the data. For our own customers, prospects and website visitors we act as controller. For personal data inside a partner’s tenant — their merchants, their merchants’ staff and their payers — we act as processor on that partner’s instructions, and the partner is the controller.
1. Data we process as controller
- Contact and account data: name, business e-mail, company, role, and the credentials used to access our systems.
- Commercial data: order forms, billing plans, invoices and payment records.
- Correspondence: e-mail, support tickets and meeting notes.
- Technical data from this website: IP address, device and browser information, pages viewed and cookie identifiers.
2. Data we process as processor
When a partner operates a tenant on the Platform, personal data flows through it that belongs to that partner’s controllership. This typically includes merchant business and contact details, merchant panel user accounts, and payer data attached to transactions and invoices — name, e-mail, phone, payment identifiers and transaction metadata.
We process that data only to provide the Platform, on the partner’s documented instructions, and under the data processing terms agreed with them.
3. Why we process it, and on what basis
- To perform our contract with you — providing the Platform, support, billing and account administration.
- For our legitimate interests — securing our systems, preventing fraud and abuse, improving the product, and business development with corporate contacts, balanced against your interests.
- To comply with legal obligations — accounting, tax, anti-money-laundering and sanctions requirements, and responses to lawful requests.
- With consent — for non-essential cookies and optional marketing, which you may withdraw at any time.
5. International transfers
Where personal data is transferred outside Slovenia, we rely on an adequacy decision where one exists, or on standard contractual clauses together with a transfer risk assessment and any supplementary measures the assessment identifies.
6. How long we keep it
Account and contract data is kept for the life of the relationship and then for the period required by limitation and accounting rules. Transaction and compliance records are kept for the period mandated by applicable financial crime legislation. Website analytics data is kept for a short, defined window.
Data processed inside a tenant is retained according to the partner’s instructions and the retention schedule in their agreement, and deleted after the export window on termination.
7. How we protect it
- Tenant data is isolated by domain and scoped at request resolution, not by application-level convention.
- Customer personal data in the Platform is stored encrypted, with blind-index fields used for lookup so search does not require exposing plaintext.
- Access is governed by role-based permissions granted per action, with two-factor authentication available on every panel login.
- Card data is captured on the hosted checkout surface and passed to providers through secure paths rather than being persisted in panel domains.
- Administrative activity is recorded, and access is reviewed periodically.
8. Your rights
Subject to the conditions in applicable data protection law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it without affecting prior processing.
To exercise a right, write to privacy@omwio.com. We respond within the statutory period. If your data sits inside a partner’s tenant, we will direct your request to that partner as controller. You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec).
10. Changes and contact
We update this notice as our processing changes; the date above reflects the current version. Data protection enquiries: privacy@omwio.com. Postal: NUMODEV, računalniško programiranje, d.o.o., Barjanska cesta 70, 1000 Ljubljana, Slovenia.