In brief
- We set no cookies, build no profiles and show no advertising.
- Cloudflare delivers the pages. To do so, and to fend off attacks, it processes your IP address.
- Visit statistics are collected without cookies and only in aggregate (Cloudflare Web Analytics).
- What you send through the assessment form reaches us as an email and is used only to answer your enquiry.
- You can ask what we hold about you, have it corrected or deleted, and object at any time.
Controller
You can reach the controller responsible for processing personal data on this website (Art. 4(7) GDPR) at:
- info@omesos.com
Please send any data protection question to the email address above.
What this policy covers
This policy covers the website omesos.com and contact with us through it.
It does not cover the AI systems we set up and operate in our customers’ own AWS accounts. There, the customer is the controller and we act as its processor under a processing agreement (Art. 28 GDPR). That agreement, not this page, governs that data.
Hosting and delivery by Cloudflare
This website consists of static pages, served by Cloudflare Workers (static assets) from Cloudflare’s global network. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which acts as our processor under its data processing addendum (Art. 28 GDPR).
Whenever you open a page, your browser necessarily sends technical data. Cloudflare processes it to deliver the page and to protect the site against attacks and misuse:
- your IP address
- date and time of the request
- the page or file requested, and the status of the response
- the page you came from (referrer), if your browser sends it
- browser type and version, operating system and language setting (user agent)
- the country derived from your IP address
Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the website reliably and securely; without this data, no page can be delivered.
We do not combine this data with other sources and do not use it to identify visitors. Request and security logs that contain IP addresses are available to us in our Cloudflare account for at most 31 days, Worker logs for at most 7 days. We look at them only to investigate faults or attacks. How Cloudflare itself handles data is described in Cloudflare’s privacy policy.
Visit statistics (Cloudflare Web Analytics)
A small script from Cloudflare, loaded from static.cloudflareinsights.com, counts page views and measures how fast pages load. It reports the page address, the referrer, browser, operating system, device type and load times to Cloudflare. Cloudflare derives your country from your IP address.
Cloudflare Web Analytics uses no cookies and no local storage in your browser and, according to Cloudflare, does not fingerprint visitors by IP address, user agent or any other data. We see only aggregated figures, such as visits per page; we cannot recognise or follow individual visitors.
Cloudflare keeps the individual measurements for 7 days and after that only aggregated samples. We can view figures for the past six months.
Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to learn which pages are useful, without tracking anyone. You can object at any time (see “Your right to object”). If you block scripts from cloudflareinsights.com in your browser, nothing is measured.
Assessment form and email
When you send the assessment form, we process what you enter: name, email address, company, whether you use AWS, AWS regions, number of users and your description of the use case, plus the language of the page you used. We need at least your name and email address to reply.
Purpose: to answer your enquiry, prepare the assessment call and, if you wish, prepare an offer.
Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a possible contract with us; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries addressed to us.
Transmission: the form is sent over an encrypted connection (TLS) to a Cloudflare Worker on this domain. The Worker does not store your details. It passes them on as an email, through Cloudflare’s email service (Email Routing), to our mailbox, which is hosted by Google (Gmail). A hidden field keeps out automated spam; we use no CAPTCHA and no third-party form service.
Emails you send directly to info@omesos.com are forwarded to the same mailbox by Cloudflare Email Routing and handled the same way: we use them only to reply and to deal with your request.
Retention: we keep your enquiry for as long as we are dealing with it, then for up to 6 months in case of follow-up questions, and then delete it. If a contract follows, we keep the correspondence for as long as the contract requires and then for the retention periods set by commercial and tax law.
Cookies, local storage and third-party content
This website sets no cookies and stores nothing in your browser’s local storage. Only if Cloudflare’s attack protection shows your browser a security check, for example during an attack on the site, does Cloudflare set a cookie (cf_clearance) that records that the check was passed. That cookie is strictly necessary to protect the site (§ 25(2) no. 2 TDDDG).
Fonts are served from our own domain. There are no social media plug-ins, no embedded videos or maps, no advertising, no tracking pixels and no content loaded from other providers’ servers.
The one exception is the Cloudflare statistics script described above.
Recipients and transfers outside the EU
We do not sell personal data and do not pass it on for advertising. The following service providers process data for us:
| Provider | Purpose | Location and safeguard |
|---|---|---|
| Cloudflare, Inc., USA | Delivering and protecting the website; forwarding form submissions by email | Global network. Transfers to the USA based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, as a fallback, the EU standard contractual clauses (Art. 46(2)(c) GDPR) in Cloudflare’s data processing addendum |
| Cloudflare, Inc., USA | Visit statistics (Cloudflare Web Analytics) | As above |
| Google Ireland Limited, Ireland (Gmail) | Receiving and storing email: form submissions and mail to info@omesos.com | Google’s data centres, including in the USA. Transfers to Google LLC in the USA based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) |
Cloudflare answers each request from a data centre in its global network, usually one near you, so processing outside the EU, including in the USA, cannot be ruled out. Cloudflare and Google’s US parent company can be subject to data requests from US authorities. Their certifications can be checked in the Data Privacy Framework list.
We disclose data to authorities only where the law obliges us to.
Your rights
You have the following rights regarding your personal data. To exercise them, an email to info@omesos.com is enough.
- Access (Art. 15 GDPR): to learn whether and which data we process about you, and to receive a copy.
- Rectification (Art. 16 GDPR): to have incorrect data corrected and incomplete data completed.
- Erasure (Art. 17 GDPR): to have your data deleted, unless we are legally required to keep it.
- Restriction (Art. 18 GDPR): to have processing limited, for example while the accuracy of data is being checked.
- Notification (Art. 19 GDPR): we inform recipients of any rectification, erasure or restriction, and tell you who they are if you ask.
- Portability (Art. 20 GDPR): to receive data you gave us under a contract in a structured, machine-readable format, or to have it sent to someone else.
- Objection (Art. 21 GDPR): see the next section.
We answer within one month (Art. 12(3) GDPR).
Your right to object
Right to object under Art. 21 GDPR
Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
An informal email to info@omesos.com is enough.
Right to lodge a complaint
You have the right to complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where the alleged infringement took place. The authority responsible for us is the Berlin data protection authority:
- Authority
- Berliner Beauftragte für Datenschutz und Informationsfreiheit
- Address
- Alt-Moabit 59–6110555 Berlin, Germany
Other information
Providing data: you are not legally or contractually obliged to give us any data. Without your name and email address, however, we cannot answer an enquiry.
Automated decisions: we do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
Security: pages and form submissions are transmitted over an encrypted connection (TLS).
Changes to this policy
We update this policy when the website, the services we use or the law change. The version published here applies; the date at the top shows when it last changed.