Legal

Privacy policy

Draft. The parts in [brackets] are to be completed, and the whole text is to be checked by a lawyer before the site goes live.

Last updated: [date]. This policy is written to the standard of the EU General Data Protection Regulation (GDPR) and applies to everyone who uses Octa Models, wherever they are.

1. Who is responsible

The controller is [legal name, address, email] (see the Imprint). [Data protection officer, if appointed: name and email]

2. What we process, why, and on what basis

Visiting the site. Our server records technical data every web server receives: IP address, date and time, the page requested, browser type. We use it to deliver the site and keep it secure (Art. 6(1)(f) GDPR, legitimate interest) and delete it after [7] days.

Your account. When you sign in we store your email address, the time you signed in and a session identifier in a cookie. The cookie is strictly necessary for the account to work; it is not used for tracking (Art. 6(1)(b) GDPR, contract).

Quotes and requests. The octagons you save or request (centre, size, chosen models, price) and their status. We need them to prepare your offer, invoice and model (Art. 6(1)(b) GDPR). Invoices are kept for the period tax law requires (in Germany up to 10 years, Art. 6(1)(c) GDPR).

Contact messages. Your name, email, organisation and message, used only to answer you (Art. 6(1)(b) or (f) GDPR). Deleted [12] months after the conversation ends unless a contract follows.

Your own data. Files or readings you share for your model. We use them to present your model and, as agreed in the terms, to improve our models. We never sell them as raw data. If they contain personal data about other people, you must be entitled to share it; tell us, and we will agree how it is handled.

3. Services that receive data from your browser

Most of the site is served from our own server. The maps load from these providers, which receive your IP address when your browser fetches their tiles:

  • OpenFreeMap (map tiles, fonts for the map) — openfreemap.org
  • Amazon Web Services, Open Data (elevation tiles, inside the models) — [confirm, or self-host the tiles]

We do not use analytics, advertising or social-media plugins, and we set no cookies other than the sign-in cookie.

4. Email

Sign-in links and status updates are sent through [email provider].

5. Transfers outside the EU

[Describe any transfer, e.g. where the server is hosted, and the safeguard used — or state that all data stays in the EU.]

6. Your rights

You can ask for access to your data, its correction or deletion, restriction of processing, data portability, and you can object to processing based on legitimate interest (Art. 15–21 GDPR). Write to [email]. You also have the right to complain to a data protection supervisory authority, for example [the authority of the state where the business is registered].

7. How long we keep data

As long as your account exists, and after that only as long as the law requires (for example invoices).