Privacy Policy

1. Controller Details

This Privacy Policy applies to the data processing on this website. The data controller is OHMIRIS, Berlin, Germany.

2. Website Hosting

The website may be hosted by a third-party hosting provider. The final provider details, processing locations, and contractual safeguards (such as a Data Processing Agreement under Art. 28 GDPR) will be added before production launch.

3. Server Logs

When you visit our website, our hosting provider may automatically collect and store information in so-called server log files, which your browser automatically transmits to us. This may include IP address, browser type/version, operating system, referrer URL, and time of the server request. This data is not merged with other data sources.

4. Cookies & Browser Storage

Based on our technical audit, this website currently does not deploy any non-essential cookies, localStorage, or sessionStorage objects for tracking purposes. If essential technical cookies or storage mechanisms are introduced to ensure core website functionality, this section will be updated accordingly.

5. Analytics

We do not currently employ any third-party analytics tools (e.g., Google Analytics, Vercel Analytics) to track your behavior on this website. Should we implement analytics in the future, we will update this policy and request your explicit consent where required by law.

6. Contact & Enquiry Data

If you send us enquiries via contact forms or email, your details from the enquiry form, including the contact details you provided there, will be stored for the purpose of processing the enquiry and in case of follow-up questions. We do not share this data without your consent.

7. Future Career Applications

If you submit an application to us in the future, we will process the data you provide to assess your suitability for the position and to carry out the application process. Details regarding retention of application data will be published when a formal career portal is launched.

8. Third-Party Services

This website currently limits the use of external third-party scripts. Any integrations requiring data transmission (such as external fonts or maps) will be implemented with privacy-preserving configurations or require your prior consent.

9. Legal Bases for Processing

We process personal data based on one or more of the following legal bases under the GDPR:

• Consent (Art. 6(1)(a) GDPR): When you have explicitly agreed to the processing.
• Contract (Art. 6(1)(b) GDPR): To fulfill our contractual obligations or take pre-contractual steps at your request.
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with legal requirements.
• Legitimate Interests (Art. 6(1)(f) GDPR): To protect our legitimate interests (e.g., ensuring IT security and website stability), provided your fundamental rights do not override these interests.

10. Data Recipients

Your data is primarily processed internally. We may share data with strictly vetted service providers (e.g., hosting providers) acting on our behalf under Data Processing Agreements. We do not sell your data to third parties.

11. International Transfers

As a Berlin-based entity, data processing takes place primarily within the European Economic Area (EEA). If data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses or an adequacy decision by the European Commission.

12. Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with legal retention obligations (e.g., commercial or tax laws). Once the purpose or legal basis no longer applies, the data will be securely deleted.

13. Security

We implement state-of-the-art technical and organizational measures to protect your data against unauthorized access, loss, or manipulation. This website uses SSL/TLS encryption for secure data transmission.

14. Data-Subject Rights

Under the GDPR, you have the right to:

• Request access to your processed personal data (Art. 15).
• Request the rectification of inaccurate data (Art. 16).
• Request the erasure of your data (Art. 17).
• Request the restriction of processing (Art. 18).
• Object to the processing (Art. 21).
• Data portability (Art. 20).
• Withdraw your consent at any time (Art. 7(3)).

15. Supervisory Authority

You have the right to lodge a complaint with a competent data protection supervisory authority. The final supervisory authority details will be added before production launch.

16. Privacy Contact

For privacy-related enquiries or to exercise your rights, please contact us. You can reach our privacy team at: goktug.dere@ohmiris.com.