Klarmi Privacy Policy

Last updated: October 15, 2026

1. Identity of the controller

The www.klarmi.com website and the Klarmi platform are operated by:

VELUNO SRL
Registered office: Str. Comana nr. 4, etaj 1, Sector 1, 011274 Bucuresti, Romania
CUI: 43159167
VAT registration code: RO43159167
Trade Register no.: J2020013111409
Email: contact@klarmi.com
Phone: +40 726 252 583

In this Policy, VELUNO SRL may be referred to as “VELUNO”, “Klarmi” or “we”.

For any question or request about data protection, you can contact us at contact@klarmi.com.

VELUNO has not appointed a data protection officer within the meaning of Articles 37-39 of Regulation (EU) 2016/679. For data protection matters, the point of contact is the address mentioned above.

2. Purpose and scope

This Policy explains how we process personal data when:

• you visit the www.klarmi.com website;
• you contact us;
• you represent a legal entity interested in Klarmi;
• you create or use a Klarmi account;
• you are a representative, employee or collaborator of a Klarmi Client;
• you interact with our communications;
• your data is included in the sources connected by a Klarmi Client;
• your data appears in a public comment processed through the Social Media module.

Klarmi is intended exclusively for legal entities and professional use. The service is not intended for consumers or minors.

This Policy is supplemented, as applicable, by the Klarmi Terms and Conditions, the Cookie Policy and the Data Processing Agreement concluded with Clients.

3. What Klarmi is

Klarmi is a Business Intelligence platform for online stores.

The Platform brings together in one place the data coming from the sources connected by the Client and turns it into dashboards, indicators, summaries and reports.

Klarmi:

• does not modify the data in the connected sources;
• does not manage advertising campaigns;
• does not modify budgets, ads, products, stock, orders or external accounts;
• does not make commercial decisions on behalf of the Client;
• does not sell Client Data;
• does not use Client Data for its own advertising;
• does not use the data of the stores' customers to contact them or to send them commercial communications;
• does not pass Client Data on to other Clients.

As of the date of the last update, Klarmi's reporting functions use formulas, calculation rules and data aggregation. Klarmi does not currently use a conversational AI module or an AI module for recommendations based on Client Data.

If we introduce AI functions, we will update this Policy before they are activated and will inform Clients about the provider, the categories of data used, the purpose, the retention period, the protection measures and any international transfers.

4. Klarmi's roles under the GDPR

4.1. VELUNO as controller

VELUNO acts as controller for the data needed for:

• administering the website;
• handling requests and commercial discussions;
• creating and administering accounts;
• authentication and security;
• contracting, invoicing and administering subscriptions;
• communicating with the Client's representatives and Users;
• sending operational and commercial communications;
• complying with legal obligations;
• establishing, exercising or defending a right.

In these situations, VELUNO determines the purposes and means of the processing.

4.2. VELUNO as processor

For the data imported from the Client's sources solely for the purpose of providing Klarmi's functions, the Client is the controller and VELUNO acts as processor.

In this role:

• the Client determines the purpose and the legal basis of the processing;
• Klarmi processes the data only on the Client's documented instructions;
• Klarmi uses the data only to provide, secure and maintain the service;
• Klarmi does not use the data for incompatible purposes of its own;
• Klarmi does not sell the data;
• Klarmi applies logical separation of data between Clients;
• Klarmi assists the Client within the limits set by the GDPR and by the Data Processing Agreement.

If you are the end customer of a store that uses Klarmi, that store is the controller of your data and remains the main point of contact for exercising rights. VELUNO will support the store in resolving requests, in line with its instructions and the Data Processing Agreement.

5. Categories of data processed

5.1. Data about website visitors

We may process technical data needed for the operation and security of the website, such as:

• the IP address;
• the date and time of access;
• the page requested;
• technical information normally transmitted through the web connection;
• data about errors and technical incidents;
• preferences regarding cookies and consent (the choice made in the cookie banner, the time and a random code, without the IP address).

We do not intentionally collect an extended digital fingerprint of the device.

5.2. Data sent through the contact form or by email

We may process:

• the name;
• the email address;
• the phone number, if requested or provided;
• the company name;
• the store's website, if provided;
• the content of the message;
• other information provided voluntarily.

Please do not send personal data that is not needed for the request.

5.3. Data about the Client's representatives and Users

For account creation, contracting, administration and support, we may process:

• the last name and first name;
• the email address;
• the phone number;
• the company name;
• the CUI;
• the Trade Register registration number, if needed;
• the company address and billing details;
• the role and permissions in the account;
• the date and time the account was created;
• the date and time of logins;
• the IP address;
• the relevant actions in the audit log;
• the history of the subscription, approvals and changes;
• invoices and payment status;
• communications with support.

Data such as the company address and the phone number refers to the Client, its representatives or the billing details. This data is not imported about the store's end customers.

5.4. Data imported about store customers

For certain reports, Klarmi imports only the following personal data about the store's customers:

• the name;
• the email address.

Klarmi does not intentionally import the following about the store's customers:

• the postal address;
• the phone number;
• the date of birth;
• payment data;
• passwords;
• health data;
• biometric or genetic data;
• data about criminal convictions;
• other special categories of data.

The rest of the information imported for reports consists mainly of commercial and operational values, such as sales, orders, products, stock, costs, campaigns, traffic, invoicing and aggregated indicators.

5.5. Data from public Social Media comments

If a Client activates the Social Media module, Klarmi may process:

• the public name or username;
• the text of the public comment left on a post;
• the technical identifier of the comment and of the post;
• the date and time of the comment;
• the reply drafted, approved or published by the User;
• the relevant history of approval and publication.

Klarmi does not import private messages through this module.

If automatic generation of a proposed reply is activated in the future, the reply will be subject to approval or editing by an authorized User before publication. The Policy will be updated before such an AI function is activated.

6. Sources of data

Data may come:

• directly from you;
• from the Client's representative or administrator;
• from the accounts and sources connected by the Client;
• from the technical systems of the website and the Platform;
• from correspondence and requests sent;
• from public comments available through the Social Media integrations;
• from payment providers, after online payment is activated;
• from public registers, when verifying the company is necessary.

Connected sources may include:

• Shopify;
• Google Ads;
• Google Analytics 4;
• Google Search Console;
• Google Merchant Center;
• Meta;
• TikTok;
• Facturis;
• custom ecommerce platforms;
• other sources requested by the Client and technically compatible.

The Client decides which sources to connect and is responsible for having the right to give Klarmi access to the data.

7. Purposes and legal bases of processing

7.1. Operating and securing the website

We process technical data for:

• delivering content;
• operating the website;
• preventing abuse;
• detecting errors and incidents;
• protecting the infrastructure.

The legal basis is VELUNO's legitimate interest in providing and securing the services, under Art. 6(1)(f) GDPR.

7.2. Handling requests and commercial discussions

We process the data received through the form, by email or by phone in order to:

• respond to requests;
• provide information about Klarmi;
• arrange a demonstration;
• prepare an offer;
• continue the commercial discussion requested.

The legal basis is the legitimate interest of VELUNO and of the company represented by the person contacting us in managing a B2B commercial relationship, under Art. 6(1)(f) GDPR.

7.3. Creating and administering the account

We process the data of representatives and Users for:

• creating the account;
• authentication;
• administering access and permissions;
• providing the Platform;
• support;
• administering the contractual relationship with the Client.

The legal basis is the legitimate interest of VELUNO and of the Client in performing and administering the B2B relationship, under Art. 6(1)(f) GDPR.

7.4. Contracting, invoicing and financial records

We process data for:

• identifying the Client;
• concluding and performing the contract;
• issuing invoices;
• sending invoices through RO e-Factura, when mandatory;
• keeping records of payments and overdue amounts;
• complying with tax and accounting obligations.

The legal bases are:

• the legitimate interest in administering and performing the B2B contract, under Art. 6(1)(f) GDPR;
• compliance with legal obligations, under Art. 6(1)(c) GDPR.

As of the date of the last update, Stripe is not implemented. Before payments through Stripe are activated, this Policy will be reviewed and updated with the relevant information about payment processing.

7.5. Authentication, audit log and incident prevention

We process the IP address, login times and important actions for:

• access control;
• protecting accounts;
• detecting unauthorized access;
• preventing fraud and abuse;
• investigating incidents;
• being able to demonstrate administrative actions.

The legal basis is the legitimate interest of VELUNO and of Clients in security, under Art. 6(1)(f) GDPR.

7.6. Operational communications

We may send messages about:

• the account and authentication;
• security;
• invoices and payments;
• maintenance;
• service availability;
• contractual changes;
• changes or functions that affect the service used.

The legal basis is the legitimate interest in administering the service and the B2B contractual relationship, as well as compliance with legal obligations, as applicable.

These messages are not promotional commercial communications and cannot be turned off if they are necessary for providing or securing the service.

7.7. Commercial communications

We may send offers, promotions or commercial information:

• based on consent, when consent is required;
• to existing customers, for similar services of our own, only if all legal conditions are met;
• with a clear and free option to object or unsubscribe in every message.

The legal basis is consent, under Art. 6(1)(a) GDPR, or the exception allowed by electronic communications law for the relationship with an existing customer.

Withdrawing consent or unsubscribing does not affect strictly operational communications.

7.8. Analytics and advertising cookies

On the Site we use, through Google Tag Manager, Google Analytics 4 (provided by Google Ireland Limited) and the Meta pixel (provided by Meta Platforms Ireland Limited). Their cookies are set only after consent is given in the cookie banner, separately by category: Analytics (Google Analytics) and Marketing (the Meta pixel). Without consent, the Meta pixel does not start, and Google Analytics receives only cookieless signals (the page viewed, the time, the browser type, the consent status), which Google uses for statistical estimates of visits.

Consent can be withdrawn at any time from the “Cookie settings” link in the footer of every page. The list of cookies, their purposes and durations are in the Cookie Policy.

Consent can later be withdrawn as easily as it was given.

7.9. Complying with the law and defending rights

We may process data for:

• resolving complaints;
• preventing and investigating abuse;
• establishing, exercising or defending a right;
• responding to mandatory requests from authorities;
• complying with legal obligations.

The legal basis is a legal obligation, under Art. 6(1)(c) GDPR, or the legitimate interest in defending rights, under Art. 6(1)(f) GDPR.

8. Need to provide data

Data marked as mandatory is needed to create the account, identify the Client, provide the service, issue invoices or respond to the request.

If mandatory data is not provided, we may not be able to:

• create or administer the account;
• conclude or perform the contract;
• issue the invoice;
• provide access to the Platform;
• respond fully to the request.

Optional data is provided voluntarily and can be left out if it is not needed for the purpose pursued.

9. Processing on behalf of Clients

For Client Data imported into Klarmi, VELUNO processes data only for:

• connecting and authenticating sources;
• synchronizing data;
• aggregation and structuring;
• applying formulas;
• calculating indicators;
• generating reports;
• displaying dashboards;
• PDF and CSV export;
• technical support;
• security;
• backup and recovery;
• the Social Media module described in this Policy.

VELUNO does not decide the Client's commercial purposes and does not determine the legal basis for the data coming from the store.

The Client is responsible for:

• the lawfulness of the data in the connected sources;
• informing data subjects;
• the existence of a legal basis;
• complying with the minimization principle;
• configuring User access;
• resolving requests from data subjects;
• the instructions given to Klarmi.

The obligations of the parties are detailed in the Data Processing Agreement, under Art. 28 GDPR.

10. Data minimization and data protection by design and by default

Klarmi is built to process only the data needed for the functions it offers.

For store customers, Klarmi imports only the name and email address, when these are needed for a report. Klarmi does not import the postal address, the phone number or other personal data that is not needed.

Protection measures by design and by default include, as applicable:

• separation of data between Clients;
• access based on roles and permissions;
• access granted only to authorized persons;
• collection of the minimum necessary;
• logging of important actions;
• predefined retention periods;
• deletion of data after the service ends;
• backups with restricted access;
• limiting incompatible uses;
• default settings geared toward data protection.

11. Data is not sold and is not used for other purposes

VELUNO does not sell, rent or trade Client Data or the data of store customers.

VELUNO does not use this data for:

• marketing to store customers;
• its own advertising aimed at them;
• building independent commercial profiles;
• passing it on to another Client;
• training general AI models;
• reselling databases.

We may use aggregated or anonymized data for internal statistics, security and the technical improvement of the Platform only if individuals and Clients cannot be identified and reasonable re-identification is not possible.

12. Providers and recipients

Data may be accessed, strictly to the extent necessary, by:

• VELUNO's authorized staff and collaborators;
• professional consultants bound by confidentiality;
• hosting, infrastructure, database and authentication providers;
• email providers;
• security, maintenance and support providers;
• payment providers, after the payment service is activated;
• authorities, courts or institutions, if disclosure is mandatory;
• potential legal successors, in the event of a reorganization, merger or assignment, in compliance with the law.

The main providers currently used are:

12.1. Hetzner

Hetzner hosts:

• the www.klarmi.com website;
• the app.klarmi.com application;
• the Klarmi servers;
• the backups managed by VELUNO;
• the infrastructure used to send the contact form messages.

The infrastructure used by Klarmi is located in Germany.

12.2. Supabase

Supabase is used for authentication and the database.

The Klarmi project is configured in the Germany region.

12.3. Sources connected by the Client

When the Client connects Shopify, Google, Meta, TikTok, Facturis or another platform, data is exchanged only for:

• authenticating the connection;
• reading the data authorized by the Client;
• synchronizing the data needed for reports;
• publishing a reply approved by the User, if the Social Media function is used.

These providers may act independently of VELUNO for their own processing, under their contracts and policies applicable to the Client.

VELUNO imposes on providers acting as processors or sub-processors contractual obligations regarding confidentiality, security and data protection, within the limits of their role and of the applicable law.

13. Place of processing and international transfers

Klarmi's main infrastructure, including the servers, the database configured for the project and the backups managed by VELUNO, is located in Germany.

VELUNO does not intentionally transfer Client Data outside the European Economic Area for its own purposes.

Some providers may use affiliated companies, support staff or sub-processors outside the European Economic Area. If such access or transfer takes place, it will be carried out only on the basis of a legal mechanism provided for in Chapter V GDPR, such as:

• an adequacy decision;
• the standard contractual clauses approved by the European Commission;
• other safeguards allowed by the applicable law.

The Client's connection of external platforms may involve processing and transfers carried out independently by those providers, under their contracts and policies.

Before activating Stripe or an AI provider, we will review the applicable transfers and update this Policy.

14. Retention periods

We keep data only as long as necessary for the purposes described, for compliance with legal obligations and for the defense of rights.

14.1. Requests without a contract

Data from requests and commercial discussions that do not lead to a contract is kept for a maximum of 12 months from the last relevant interaction.

14.2. Unconverted trial accounts

The data of a trial account that is not converted into a paid subscription is deleted within a maximum of 30 days from the end of the trial period, except for data needed for security, abuse prevention or the defense of a right.

14.3. Client Data after the subscription ends

After the subscription ends:

• Client Data is kept for up to 30 days for viewing or export;
• after this period, it is deleted from active systems within a maximum of 30 days;
• the data may remain in backups for up to a maximum of 90 days, until the backup cycle is overwritten or expires.

The same period applies to the name and email address of the store's customers and to the public comments processed through the Social Media module.

The Client may request earlier deletion, if there is no legal obligation or legitimate reason for retention.

14.4. Authentication, audit and security logs

Logs of logins, IP addresses, administrative actions and incidents are kept for a maximum of 12 months, except where they are needed for longer to investigate an incident, defend a right or comply with a legal obligation.

14.5. Accounts and the contractual relationship

Users' data is kept for as long as the account and the relationship with the Client exist. After termination, the data may be kept for the periods needed to comply with legal obligations and defend rights.

14.6. Tax, accounting and contractual documents

Invoices, accounting documents, contracts and mandatory records are kept for the periods set by the applicable tax, accounting and civil law.

14.7. Commercial communications

Data used for marketing is kept until consent is withdrawn, until objection or until unsubscribing and, in any case, only as long as there is a justified and lawful commercial purpose.

Proof of consent, of unsubscribing or of objection may be kept afterward for the period needed to demonstrate compliance and defend rights.

14.8. Data needed to defend a right

Certain information may be kept until the statutory limitation periods expire or until a dispute, complaint or investigation is finally resolved.

15. Data security

We apply technical and organizational measures appropriate to the risks, including, as applicable:

• encrypted connections;
• access control;
• authentication and permission management;
• separation of data between Clients;
• logging of important actions;
• updates and security measures;
• backups;
• limited access for staff and collaborators;
• confidentiality obligations;
• incident investigation and response procedures.

No IT system can completely eliminate all risks. The Client is responsible for the security of its own devices, email addresses, credentials and authorized Users.

In the event of an incident involving personal data:

• if VELUNO acts as controller, we will assess the risk and notify the authority and the data subjects when the GDPR requires it;
• if VELUNO acts as processor, we will inform the Client without undue delay and support it in line with the Data Processing Agreement.

16. Automated decisions and profiling

Klarmi does not make solely automated decisions that produce legal effects on a person or similarly and significantly affect a person.

Klarmi does not automatically change campaigns, budgets, ads, orders, products or external accounts.

Klarmi's indicators, reports and formulas are for information purposes. Commercial decisions belong to the Client and its Users.

As of the date of the last update, Klarmi does not carry out profiling of natural persons for advertising, credit, recruitment or individual assessment purposes.

17. Rights of data subjects

Under the conditions set by the GDPR, you have the following rights:

• the right to be informed;
• the right of access to data;
• the right to rectification of inaccurate data;
• the right to erasure, when the legal conditions are met;
• the right to restriction of processing;
• the right to portability, when the processing is based on consent or on a contract with the data subject and is carried out by automated means;
• the right to object to processing based on legitimate interest;
• the right to object at any time to direct marketing;
• the right to withdraw consent;
• the right not to be subject to a solely automated decision, under the conditions of Art. 22 GDPR;
• the right to lodge a complaint with the supervisory authority;
• the right to go to the competent courts.

Withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal.

These rights are not absolute. A request may be limited or refused if the law allows or requires it, for example to protect the rights of other people, to comply with a legal obligation or to defend a right.

18. How to exercise your rights

You can send your request to:

Email: contact@klarmi.com
Address: VELUNO SRL, Str. Comana nr. 4, etaj 1, Sector 1, 011274 Bucuresti, Romania

The request must allow the person and the processing concerned to be identified.

We may ask for additional information strictly necessary to verify identity and to prevent disclosure of data to an unauthorized person.

We will usually respond within one month at most from receiving the request. This period may be extended by up to two months if the request is complex or there is a large number of requests. In that case, we will inform you about the extension and the reasons.

Exercising your rights is free of charge. For manifestly unfounded or excessive requests, in particular repetitive ones, we may charge a reasonable fee or refuse the request, under the conditions of the GDPR.

If the request concerns data imported by a Client store, we may forward it to the Client acting as controller or tell you to contact the store directly. VELUNO will assist the Client in accordance with Art. 28 GDPR.

19. The right to lodge a complaint

You have the right to lodge a complaint with:

National Supervisory Authority for Personal Data Processing - ANSPDCP

Information and the procedure for lodging complaints are available on the authority's official website: www.dataprotection.ro.

We encourage you to contact us first at contact@klarmi.com so we can try to resolve the issue quickly, without this limiting your right to lodge a complaint.

20. Cookies and similar technologies

The Site and the Platform may use strictly necessary technologies for:

• making the pages work;
• keeping the session;
• security;
• authentication;
• remembering consent preferences.

Consent is not requested for strictly necessary cookies when they are essential to the service requested by the user.

Analytics or advertising cookies and technologies are activated only after the user's valid consent, given in the cookie banner.

To be able to prove consent, we keep the choice made in the banner, the time and a random code, without the IP address, for at most seven months.

Detailed information about cookies, providers, purposes and durations is in the Cookie Policy and in the cookie banner (the “Cookie settings” link).

21. External links and services

The Site and the Platform may contain links or connections to services operated by third parties.

VELUNO does not control how these third parties process data for their own purposes. We recommend that you read their privacy policies.

Connecting an external account to Klarmi constitutes the Client's instruction to allow the technical data exchange needed for the integration.

22. Changes to the Policy

We may update this Policy for:

• legislative changes;
• changes to data flows;
• the introduction of new providers;
• the activation of Stripe;
• changes to analytics or advertising cookies;
• the introduction of AI functions;
• changes to the infrastructure;
• improving the clarity of the document.

The updated version will be published on this page, together with the date of the last update.

If the changes are material, we will inform Clients by email, in the Platform or through another appropriate channel before the changes take effect, when the law requires it or the nature of the change justifies it.

23. Applicable legal framework

Data processing is carried out in accordance with:

• Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
• Law no. 190/2018 on measures implementing Regulation (EU) 2016/679;
• Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector;
• the other legal acts applicable to the processing described in this Policy.

24. Contact

For any question about this Policy or the processing of data:

VELUNO SRL
Email: contact@klarmi.com
Phone: +40 726 252 583
Address: Str. Comana nr. 4, etaj 1, Sector 1, 011274 Bucuresti, Romania

This Policy takes effect on July 21, 2026.