Legal
Privacy Policy
1. Controller
BPLP Consulting, Barbara Plahuta s.p., Breg pri Borovnici 4A, 1353 Borovnica, Slovenia, Tax no. 58148698, not liable for VAT (Art. 94 ZDDV-1) ("we"). Osturu and CastCalc are its brands. Privacy questions and requests: sales@osturu.com.
2. This website
www.osturu.com sets no cookies and uses no analytics or tracking. Fonts and images are served from our own server. The web server keeps technical access logs (IP address, time, page, browser) for security for 30 days.
If you ask to be notified about the next webinar, the form sends your name, company and e-mail to Formspree, which forwards them to us. We use them only to send you the webinar date and a reminder (Art. 6(1)(b) GDPR, your request) and delete them 12 months after the last webinar we invited you to, or earlier if you ask. Booking a demo opens Lemcal, our scheduling provider, under its own privacy policy; we receive your name, e-mail and the time you chose.
3. CastCalc: what we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: name, business e-mail, company, password (stored only as a hash), plan, login times | Provide the account, sign-in, one trial per company, security | Art. 6(1)(b) contract; 6(1)(f) security |
| Your work in CastCalc: calculations, saved parts, supplier quotes and names, price challenges, notes | Provide the service and show your history | Art. 6(1)(b) contract |
| Team: names and e-mails of invited colleagues | Invitations and team management | Art. 6(1)(b) contract with the Customer; the Customer informs its users |
| Billing: company, address, VAT ID, contact person; payment status from Stripe (no card data) | Invoices, subscriptions, accounting | Art. 6(1)(b) contract; 6(1)(c) legal obligation (accounting) |
| Messages to support and the contact form; e-mails we send (confirmation, invitations, invoices) | Answer requests, operate the account | Art. 6(1)(b) and (f) |
| Technical logs (IP address, time, errors) | Security, abuse prevention, troubleshooting | Art. 6(1)(f) legitimate interest |
We do not sell personal data, do not use it for advertising and never share your CastCalc data with foundries.
4. Cookies in CastCalc
CastCalc uses only cookies that are strictly necessary for the sign-in session and protection against cross-site request forgery. Stripe sets its own cookies on its checkout and billing pages to prevent fraud.
5. Processors
We use these service providers, bound by data processing agreements:
| Provider | Service | Location |
|---|---|---|
| Supabase Inc. | Database for accounts and CastCalc data | EU region |
| Hostinger International Ltd. | Servers for the website and the app | EU |
| Zoho Corporation B.V. | E-mail (sign-up confirmation, invitations, support) | EU data centre |
| Stripe Payments Europe Ltd. | Card payments, subscriptions, invoices | Ireland (EU); transfers to Stripe Inc. (USA) under the EU-US Data Privacy Framework and standard contractual clauses |
| Formspree, Inc. | Webinar notification form on www.osturu.com | USA; standard contractual clauses |
6. Transfers outside the EU
CastCalc data is stored in the EU. Where a provider may process data outside the EU/EEA (Stripe, Formspree), the transfer is protected by the EU-US Data Privacy Framework and/or the EU standard contractual clauses.
7. How long we keep data
- Account and CastCalc data: as long as the account is active, and 12 months after the account is closed or was last used (so a returning customer finds their parts); then deleted. You can ask for earlier deletion at any time.
- Invoices and billing records: 10 years, as required by Slovenian tax law.
- Webinar notification data: see section 2.
- Technical logs: up to 30 days.
8. Security
Encrypted connections (HTTPS), hashed passwords, e-mail confirmation of new accounts, rate limits on sign-in, access to your data only through your login (and your team for shared parts), and database backups by our provider.
9. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection. Write to sales@osturu.com; we answer within one month. You may complain to the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si), or to the authority in your country.
10. Changes
We update this policy when our processing changes and show the date of the current version at the top.