Who is responsible for the data
Only Original is the controller of the data described in this policy. For privacy questions, contact hello@onlyoriginal.com.
Data we collect
Forms
When you submit a contact, pilot, pricing or calculator request, we receive your name, email address, company, notes, form type and language, source page and submission time. Calculator submissions also include the business inputs and calculated result.
Product scans
When a QR link opens a product page in scan mode, we record the product and its ID, date and time, language, a random session ID, approximate country and city derived by the hosting network, and a short salted hash derived from the IP address. Only Original does not store the raw IP address in the scan table, although the hosting provider may temporarily process it in standard technical logs.
In the demonstration scan-history area, the product, approximate location and time may be shown publicly without a name, email address, session ID or IP hash.
Analytics
Vercel Web Analytics provides aggregated traffic statistics without cookies. Google Analytics runs only after you consent. Their data categories and technologies are described in our Cookie Policy.
Why we use data and our legal bases
- To answer enquiries and prepare a pilot or proposal — taking steps at your request before a contract and our legitimate interest in communicating with prospective customers.
- To verify a product, create scan history, show activity and prevent abuse — providing the requested feature and our legitimate interest in product security and traceability.
- To measure aggregated site use and performance through Vercel Web Analytics — our legitimate interest in improving the site; the service works without cookies or persistent visitor profiles.
- To measure website use through Google Analytics — only on the basis of consent, which can be withdrawn.
Who receives data
Authorised Only Original team members and providers needed to operate the service receive data: Vercel for hosting and aggregated web analytics, Supabase for database storage, and Google Analytics after consent. For a client product, relevant scan data may be available to that brand or manufacturer under its agreement with Only Original.
Some providers may process data outside your country. Where required, appropriate contractual and legal transfer safeguards are used.
Retention
Form data is kept while an enquiry is handled and for up to 24 months after the last contact, unless an active relationship or legal obligation requires longer retention. Scan events are kept while the relevant product passport or service agreement is active, then deleted or anonymised under the agreed data lifecycle. Technical logs follow shorter provider retention periods.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction or portability, or object to processing. You may withdraw analytics consent at any time. You can also complain to the data-protection authority where you live or work.
To make a request, email hello@onlyoriginal.com. We may need to verify your identity before acting on it.
Policy updates
We update this page when the data, purposes or providers change. The current version date appears above.