Privacy Notice

1. Who we are

The data controller for this Privacy Notice is OmniTeam, an EU-incorporated company. Registered details (company name, address, register number, VAT ID) are at /imprint. For data-protection-specific contact: privacy@omniteam.eu.

We have not appointed a Data Protection Officer because we do not meet the triggering criteria under Article 37 GDPR (small organization, no large-scale systematic monitoring of data subjects). We will appoint one if the criteria are met as we grow.

2. What this Notice covers

This Privacy Notice covers personal data we process in two capacities:

• As controller — when you visit this marketing site, sign up for our newsletter, request a lead-magnet PDF, or correspond with us by email.
• As processor — when our customers submit personal data to the Service for processing on their behalf. The customer is the controller in that case; we process under the Data Processing Agreement attached to their subscription.

The remainder of this document covers our role as controller. For processor-role processing, see the DPA.

3. Categories of data we process

3.1 Marketing-site analytics

We use Plausible (Plausible Insights OÜ, German company, EU-hosted) for no-cookie, no-cross-site-tracking analytics. Plausible processes: page URL visited, referrer URL, country/region (derived from IP, not stored), browser type, screen size, visit duration. No personally identifying information is collected. No cookies are set. No cross-site tracking occurs.

Lawful basis: legitimate interest (Article 6(1)(f) GDPR) — measuring marketing effectiveness without identifying individual visitors. We have completed the balancing test; given the no-cookie, no-PII design, the impact on data subjects is minimal.

3.2 Newsletter

If you subscribe to our newsletter, we process: your email address, the confirmation timestamp, and IP address at the moment of subscription (retained 30 days as evidence of consent). We use double-opt-in.

Lawful basis: consent (Article 6(1)(a) GDPR). You can unsubscribe at any time by clicking the link in any email.

3.3 Lead-magnet downloads

If you request a lead-magnet PDF (migration guide, business-case CSV, security questionnaire) we process: your email address, your role, and the magnet kind. We send you the PDF via email. Unless you also opt into the newsletter, we do not retain your contact details after delivery.

Lawful basis: legitimate interest (Article 6(1)(f) GDPR) — fulfilling a request you initiated.

3.4 Email correspondence

If you email us (sales, support, partnerships, press, legal, security), we process the contents of your email and your email address. Retention depends on the nature of the request — typically 12 months for general correspondence, longer for matters with legal-record value.

3.5 Sub-processor list

A complete, dated list of sub-processors we use as controller is at /trust/sub-processors. Every entry is EU-incorporated. We commit to 30-day notice for sub-processor changes.

4. Recipients of personal data

Personal data we process as controller is shared only with the sub-processors listed at /trust/sub-processors. We do not sell personal data. We do not share personal data with advertising partners. We do not transfer personal data outside the EU.

5. Retention

We retain personal data only as long as needed for the purpose for which it was collected, plus any retention period required by applicable law. Specific periods:

Data	Retention
Newsletter subscription	Until unsubscribe + 30 days
Lead-magnet form	30 days unless newsletter opt-in
Email correspondence (general)	12 months
Email correspondence (legal-record)	As long as legally required
Plausible analytics events	Aggregated only; no per-visitor retention
Server logs (web)	30 days, scrubbed of PII at write-time

6. Your rights

Under GDPR you have the right to:

• Access — request a copy of personal data we hold about you (Article 15).
• Rectification — correct inaccurate or incomplete data (Article 16).
• Erasure — request deletion (Article 17), subject to retention exceptions.
• Restriction — request limited processing while a dispute is resolved (Article 18).
• Portability — receive your data in a machine-readable format (Article 20).
• Object — to processing based on legitimate interest (Article 21).
• Withdraw consent — at any time, where consent is the lawful basis (Article 7(3)).

To exercise any of these rights, email privacy@omniteam.eu. We respond async within one calendar month, in line with Article 12(3) GDPR.

7. Right to complain

You have the right to lodge a complaint with the supervisory authority in the EU member state where you reside, work, or where the alleged infringement occurred (Article 77 GDPR). The supervisory authority of the EU member state where OmniTeam is incorporated is listed at /imprint. We would prefer the chance to resolve the issue directly first — but you do not need our permission to file a complaint.

8. Automated decision-making

We do not engage in automated decision-making producing legal effects about data subjects (Article 22 GDPR).

9. International transfers

All personal data we process as controller stays within the European Union. Our sub-processors are EU-incorporated. We do not engage US- or other non-EU jurisdiction processors. This is a structural commitment documented contractually in our EU Pledge.

10. Updates to this Notice

Material updates to this Notice are announced with 30-day advance notice by email to subscribers and on this page. Past versions are preserved in our changelog at /changelog.