Privacy policy

This is an English translation of the Romanian legal texts, provided for convenience. In case of any discrepancy, the Romanian version prevails.

This policy explains how Unikat Flow collects, uses and protects the personal data of visitors to the website https://unikatflow.com and of Subscribers of the Unikat mobile app, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.

1. Who we are (the data controller)

The controller of your personal data is:

Unikat Global SRL, the Unikat Flow brand
Tax ID RO51320921 · Trade Register J2025011790001
Registered office: Str. Miron Neagu nr. 25, Sighișoara, Mureș county
Correspondence address: Piața Hermann Oberth 36, Sighișoara, Mureș county
Data protection contact email: office@unikatflow.com

2. What data we collect

Identification and contact data: first name, last name, email address, phone number confirmed by SMS code.

Payment data: card processing takes place exclusively on the secure page of the processor EuPlătesc. We do not store and have no access to your card number; we receive only the payment confirmation, the amount and a transaction identifier (token).

Billing data: for invoicing to an individual or a company, including the data filled in automatically from the ANAF register on the basis of the tax ID, when you choose company invoicing.

Access code (QR code): the personal QR code generated in the app, used solely to authorise serving at the dispenser.

Access and consumption history: the date, time and dispenser at which you obtained access (that is, the unit's location, not your location), as well as the portions of water served, recorded for subscription administration and invoicing.

Hydration data, entered voluntarily: if you enable the hydration tracker, the weight you enter, the calculated daily goal and the consumption recorded manually or automatically at the dispensers.

Technical data: device type, operating system, app version, the device identifier used for push notifications, IP address, technical logs.

Notifications: your preferences regarding push notifications about the subscription, the personalised bottle and the Partner location's campaigns.

Biometric authentication: if you enable app lock by fingerprint or face recognition, verification takes place locally, on your device. Unikat Flow does not receive, see or store biometric data.

Connected devices: the app keeps a list of the devices on which your account is logged in, so that you can close any open session remotely, on request.

3. Purposes and legal basis for processing

Purpose	Legal basis (GDPR art. 6)
Creating the account and providing the Service (access to dispensers)	Performance of the contract: art. 6(1)(b)
Processing payments through EuPlătesc	Performance of the contract: art. 6(1)(b)
Issuing invoices and tax obligations (RO e-Factura, ANAF)	Legal obligation: art. 6(1)(c), kept for 10 years
Fraud prevention (sharing the access code, abnormal accesses)	Legitimate interest: art. 6(1)(f)
Hydration tracker (weight, goal, consumption)	Explicit consent: art. 6(1)(a)
Marketing notifications and Partner location campaigns	Consent: art. 6(1)(a)
Security of the app and of the website	Legitimate interest: art. 6(1)(f)

We do not take automated decisions with legal effects on you and we do not carry out profiling for marketing purposes.

4. Who we share data with

We may share data, strictly to the extent necessary, with processors acting under data processing agreements (DPAs):

• EuPlătesc: for card payment processing;
• the SMS service provider: for confirming the phone number;
• Firebase (Google): for sending push notifications;
• the hosting and IT infrastructure providers of the app and the website;
• the Partner location: only as regards the collection code for the personalised bottle and, where applicable, confirmation that you have an active subscription;
• ANAF: for invoicing and RO e-Factura submission, as required by law;
• other public authorities, only where the law requires us to.

The Partner location has no access to payment data, to your full consumption history or to the hydration data entered voluntarily. It receives only the information strictly necessary to validate the collection code for the personalised bottle and, where applicable, confirmation that you have an active subscription for access to the dispenser installed on its premises.

The processors above process the data exclusively on behalf of and on the instructions of Unikat Flow, under data processing agreements (DPAs), and may not use it for their own purposes.

We do not sell your personal data.

5. International data transfers

Data is processed, as a rule, within the European Union. The push notification service provider (Firebase, operated by Google) may also process data outside the European Economic Area; in such cases, the transfer is based on European Commission adequacy decisions or on Standard Contractual Clauses.

6. How long we keep data

• Access codes (QR) and SMS confirmation codes are deleted automatically after they expire.
• Expired sessions and old accesses are deleted automatically, in accordance with the technical retention policy.
• Account data and subscription history are kept for the life of the account and 3 years after it is closed.
• Tax documents (invoices) are kept for 10 years, as required by law.
• Hydration tracker data is kept until consent is withdrawn or the account is closed.
• Technical data and logs are kept for at most 12 months.

7. Your rights (GDPR)

You have the right to: access your data, rectification, erasure ("the right to be forgotten"), restriction of processing, data portability, objection to processing and withdrawal of consent at any time, without affecting processing carried out before the withdrawal.

A full export of your data and deletion of your account can be requested directly in the Unikat app, from the account settings, or by email at office@unikatflow.com. We reply within one month. When the account is deleted, invoices and payments are still kept, to the extent required by accounting obligations.

You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), anspdcp.ro.

8. Cookies and similar technologies

The website https://unikatflow.com uses cookies. Full details are in the Cookie policy. The Unikat mobile app does not use cookies, but technical device identifiers, described in section 2 of the Cookie policy.

9. Security

We apply reasonable technical and organisational measures to protect data against unauthorised access, loss or disclosure: encrypted connections, passwords stored encrypted, sensitive data encrypted with a dedicated key, role-based access restriction, access logging, backups. The QR access code is digitally signed and verified locally by the dispenser, and changing an account's password automatically closes the other open sessions. No transmission over the internet is completely free of risk; we recommend using a unique password and not sharing your account or your access code with other people.

10. Legal representatives and company contact persons

If you choose company invoicing, the data filled in automatically from the ANAF register (name, tax ID, registered office) is public data, available in the public registers kept by the tax authorities, processed by us for the purpose of issuing the invoice, on the same legal basis as in section 3.

11. Changes

We may update this policy from time to time. The version in force is always published on this page, with the date of the update. Important changes are communicated to you in the app or by email, with sufficient notice for you to take an informed decision about continuing to use the Service or exercising your rights described in section 7.

Contact for any question about this policy: office@unikatflow.com.

12. Minors

An account may be created by persons aged at least 18. Data of minors is processed only to the extent that the Service is used through the Account of a parent or guardian, under their supervision and responsibility. We do not knowingly request or process data of persons under 18 acting on their own behalf.