Effective date: 14 November 2026
This Privacy Policy explains how PIXOBIT SOLUTIONS SRL ("OmniCart", "we", "us") collects and uses personal data when you visit omnicartshop.com, create an OmniCart account, buy a membership or run a store on OmniCart. It also explains our role when you shop at a store built on OmniCart. Words such as "Service", "Store" and "Membership" have the meaning given in our Terms & Conditions.
1. Who is responsible for your data
The controller of the personal data described in this policy is PIXOBIT SOLUTIONS SRL, a limited liability company registered in Romania, with its registered office at Berghia nr. 31, Pănet commune, Mureș County, 547451, Romania, trade register number J26/1232/2017 and tax identification number (CUI) 37854649.
For any question about your data, or to exercise your rights, write to contact@omnicartshop.com or use our contact page.
2. Our two roles
We are the controller for the data we need to run the platform itself: your OmniCart account, your Membership and billing, our website, our newsletter, and the security of the Service. Your OmniCart account is one login across the whole platform, so the account itself is ours to look after, whichever store you use it on.
We are a processor for the data that shoppers give to a Store, such as orders, delivery addresses and messages to the merchant. Each Store is run by an independent merchant, who decides how that data is used and is its controller. We host and process it on the merchant's behalf, under our Data Processing Terms. For how a Store uses your data, read that Store's own privacy policy and contact the merchant.
3. What data we collect
- Account data: your name, username, email address, password (stored in hashed form, never in plain text), and anything else you choose to add, such as a phone number, company name, profile picture or addresses.
- Membership and billing data: the plan you buy, your orders and invoices, payment status and history, and the IP address used when paying. Card and other payment details are handled by our payment providers.
- Store data: if you are a merchant, the content of your Store, including the data of your shoppers that we process on your behalf (see section 2).
- Communications: messages you send us through the contact form (including the IP address it was sent from), messages exchanged through the Service and their attachments, your emails to us, and copies of the emails the Service sends you.
- Security and log data: the IP address and browser details of sign-ins, records of actions taken in a store's admin, and technical error logs.
- Usage data: the pages you visit on the Service, the page that referred you, the time of your visit, your IP address and the approximate city derived from it, collected by our own built-in analytics.
- Affiliate data: if you join our affiliate program, who you referred, your earnings and the payout details you give us; if you arrive through an affiliate's link, the affiliate who referred you.
- Newsletter data: your email address, if you subscribe.
- AI features: the text you enter into AI features and their answers.
4. Why we use your data, and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, providing your Membership and your Store, and processing payments | Performance of our contract with you (art. 6(1)(b)) |
| Invoicing, accounting and tax records | Legal obligation (art. 6(1)(c)) |
| Answering your messages and providing support | Performance of our contract, or our legitimate interest in answering you (art. 6(1)(b) and (f)) |
| Keeping the Service secure, preventing fraud and abuse, and investigating breaches of our Terms | Our legitimate interests in a safe and reliable Service (art. 6(1)(f)) |
| Understanding how the Service is used, so that we can improve it | Our legitimate interests (art. 6(1)(f)) |
| Running the affiliate program | Performance of our contract with the affiliate (art. 6(1)(b)) |
| Sending our newsletter | Your consent, which you can withdraw at any time (art. 6(1)(a)) |
| Complying with the law, and establishing or defending legal claims | Legal obligation, or our legitimate interests (art. 6(1)(c) and (f)) |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see section 9). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
5. Who we share your data with
We do not sell your personal data. We share it only as needed to provide the Service, with:
- providers that host and run the Service for us, such as hosting and email delivery providers;
- payment providers, to process payments;
- AI providers, when you use an AI feature;
- the providers of integrations a merchant turns on for their Store, such as payment, shipping or Google services, under that merchant's control;
- a Store's merchant, when you shop at that Store, for the data they need to handle your order;
- our professional advisers, such as accountants and lawyers, under a duty of confidentiality;
- public authorities and courts, where the law requires it;
- a buyer or successor, if our business or the Service is transferred.
Our providers may only use your data on our instructions and must keep it secure.
6. Transfers outside the European Economic Area
Some of our providers may process data outside the European Economic Area. When they do, we make sure the transfer is protected, for example by a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework) or by the Standard Contractual Clauses approved by the European Commission. You can ask us for more information about these safeguards.
7. How long we keep your data
- Account data: for as long as your account exists. After you ask us to delete it, we delete or anonymise it within a reasonable time, except for data we must keep by law or need for a legal claim.
- Billing and accounting records: for the period required by Romanian accounting law, currently 5 years from 1 July of the year after the end of the financial year in which they were drawn up (Law no. 82/1991, art. 25).
- Store data: while the Store exists. A suspended Store's data is kept so that it can be reopened, as described in our Terms, unless the merchant asks us to delete it.
- Security and log data, and usage data: for a limited period, as long as needed for the purposes above.
- Newsletter data: until you unsubscribe.
- Backups: data deleted from the Service may remain in backups for a limited time, until they are replaced in the normal course.
8. Cookies and similar technologies
Cookies are small files that a website stores in your browser. We use the following:
| Cookie | What it does | How long it lasts |
|---|---|---|
| Session (ci_session) | Keeps the site working and you signed in during your visit, and protects forms against misuse. | Up to 3 days |
| Remember me (remember) | Keeps you signed in, only if you choose this when signing in. | 30 days |
| Cookie choice (cookies_warning) | Remembers the choice you made in our cookie notice. | 10 days |
| Affiliate referral (referrer) | Records which affiliate referred you, when you arrive through an affiliate link. | 6 months |
| Site selection (multi_site_instance_id) | Used only by our administrators, to choose which site they are managing. | 1 year |
We also store a small value in your browser's local storage so that it loads the latest version of our scripts.
Our built-in analytics does not set cookies of its own: it relies on the session described above. If we use third-party analytics or marketing tools on our website, we will list them here and load them only according to the choice you make in our cookie notice.
You can delete cookies or block them in your browser settings at any time. If you block the session cookie, signing in and parts of the Service will not work.
9. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected;
- have your data deleted, where there is no reason for us to keep it;
- restrict how we use your data in certain cases;
- receive the data you gave us in a portable format;
- object to our use of your data based on legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time, without affecting what we did before you withdrew it.
To exercise your rights, write to contact@omnicartshop.com. We may ask you to confirm your identity. We reply within one month, which can be extended by two further months for complex requests, in which case we will tell you.
For data a Store holds about you, contact the Store's merchant, who is responsible for it. If you send that request to us, we will pass it on to the merchant.
You also have the right to complain to the Romanian data protection authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at www.dataprotection.ro, or to the authority in the EU country where you live. We would appreciate the chance to resolve your concern first.
10. Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections, hashed passwords, access restricted to authorised staff, and two-factor authentication that you can turn on for your account. No system is completely secure, so please keep your password safe and tell us straight away if you think your account has been misused.
11. Children
The Service is not intended for children under 16, and you must be at least 18 to create an account under our Terms. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. If we make significant changes, we will tell you by email or in the Service. The effective date at the top of this page shows when it last changed.
13. Contact
PIXOBIT SOLUTIONS SRL
Berghia nr. 31, Pănet commune, Mureș County, 547451, Romania
Email: contact@omnicartshop.com
Or write to us through our contact page.