Privacy policy

1. Controller

Business name

Ostara Software

Owner / Controller

Ezgi Oner Coskun

Address

Düsseldorf, Germany

Email

info@ostarasoftware.com

Website

www.ostarasoftware.com

2. Website delivery and hosting through Cloudflare

When you access the website, technically necessary connection and usage data is processed. This may include the IP address, date and time of access, requested URL or resource, referrer information (if transmitted), browser/user-agent information, operating-system and device information, response status, amount of data transferred, and routing or security metadata.

The purposes are to deliver the website, maintain stability and security, prevent abuse and attacks, and troubleshoot technical issues. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and reliable operation of our website.

We use Cloudflare for hosting, CDN, DNS and security functions. To the extent Cloudflare processes personal data on our behalf, Cloudflare acts as a processor: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare may use affiliated companies and subprocessors to provide the services.

We do not use Cloudflare Web Analytics / Real User Measurements (RUM). Technical traffic and security data is processed under the settings and contractual terms applicable to the relevant Cloudflare service only for as long as necessary to provide and secure the services or comply with legal obligations. The retention criteria include operational and security necessity and applicable legal requirements.

Further information: Cloudflare Privacy Policy | Cloudflare Data Processing Addendum

3. Cookies, browser storage, spam protection, analytics and fonts

In the current configuration, the website does not set its own cookies during normal operation and does not use Local Storage or Session Storage. We do not use analytics or marketing trackers. Cloudflare Web Analytics / RUM is disabled. The website font is self-hosted, so loading the font does not create a connection to an external font provider.

In individual security situations, Cloudflare may set technically necessary cookies or comparable identifiers, for example where a security check or challenge is triggered. These are used solely to protect and provide the website requested by the user. Where storage or access on the user’s device is strictly necessary for that purpose, consent is not required under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

On pages that contain the contact form, we use Cloudflare Turnstile to protect the form against spam and automated abuse. When such a page is loaded, the Turnstile script is loaded from challenges.cloudflare.com and Cloudflare processes technical signals, in particular the IP address, TLS fingerprint, user-agent information, and the site key and origin of the website. When you submit the form, we send the result of the check and your IP address to Cloudflare to verify it.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the contact form and our mailbox against spam and abuse. Where Turnstile accesses information on your device, this is strictly necessary for that protection, so consent is not required under Section 25(2) TDDDG. Cloudflare processes the data as our processor. To the extent Cloudflare uses the signals to improve its bot detection, Cloudflare acts as an independent controller.

Further information: Cloudflare Turnstile Privacy Addendum

If technologies requiring consent are introduced in the future, this Privacy Policy will be updated before they are used and, where required, an appropriate consent mechanism will be implemented.

4. Contact form and B2B inquiries

You can use the contact form to send business inquiries about our software and services. The required fields are name, email address and message; the company field is optional. File uploads are not available. The information is transmitted through the website infrastructure and Cloudflare to our email delivery provider Resend, which delivers it as an email to our Google Workspace mailbox at info@ostarasoftware.com.

We process the information to handle and respond to your inquiry and, where relevant, to conduct pre-contractual or business discussions. We do not use contact-form details for newsletters or promotional emails.

If the person making the inquiry is themselves a potential contracting party, processing is based on Article 6(1)(b) GDPR (steps taken before entering into a contract at the data subject’s request). If the person acts as a contact person for a company, processing is generally based on Article 6(1)(f) GDPR. Our legitimate interest is responding to business inquiries and establishing B2B business relationships.

Recipients/processors are Cloudflare for technical transmission and spam protection (Turnstile, see section 3), Resend for delivering the inquiry by email, and Google Workspace for receiving, storing and processing the inquiry.

Resend is operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, which acts as our processor. Resend stores the content and delivery logs of the emails it sends in the United States and retains them for 30 days.

Further information: Resend Privacy Policy | Resend Data Processing Addendum

If an inquiry does not lead to an ongoing business relationship, we generally delete the inquiry, related correspondence and related files one year after the last communication. Longer retention takes place only where statutory record-keeping obligations apply or the data remains necessary to establish, exercise or defend legal claims.

Providing your name, email address and message is not required by law. However, these fields are required to submit the contact form and allow us to handle the inquiry meaningfully.

5. B2B business relationships and Google Workspace

If an inquiry develops into a business relationship, we process the data required to establish, perform and document that relationship. This may include:

• the contact person’s name and business email address;
• company name and job title/function, if provided;
• business correspondence and communication content;
• proposals, project requirements, meeting notes and contract documents;
• calendar and meeting information;
• invoices, bookkeeping information and tax-relevant records.

For these purposes we use Google Workspace, in particular Gmail, Drive, Docs, Sheets, Calendar and Meet. For customers with a billing address in Germany, the current Google contracting entity for Google Workspace is generally Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google may use affiliated companies and subprocessors.

Processing is based, as applicable, on Article 6(1)(b) GDPR (pre-contractual steps or contract performance), Article 6(1)(f) GDPR (communications with employees or other contact persons of a business customer), and Article 6(1)(c) GDPR (statutory record-keeping and evidentiary obligations). Our legitimate interest under Article 6(1)(f) GDPR is the proper performance and documentation of the B2B business relationship.

Further information: Google Cloud Data Processing Addendum | Google privacy / data transfer frameworks

6. Retention and statutory record-keeping periods

Data relating to an active business relationship is generally processed for as long as necessary to establish and perform that relationship. Afterwards, data is deleted unless statutory retention periods, ongoing limitation periods or other legal reasons require continued retention.

For tax- and business-relevant records, statutory retention periods apply in particular under Section 147 of the German Fiscal Code (Abgabenordnung, AO) and Section 14b of the German VAT Act (Umsatzsteuergesetz, UStG). Depending on the document type, current periods include in particular:

• 6 years for received and sent commercial/business correspondence and other records listed in Section 147 AO where no longer period applies;
• 8 years for accounting vouchers and invoices;
• 10 years for books and records, inventories, annual financial statements and other records listed in Section 147 AO.

Records not subject to a statutory retention period are deleted once they are no longer necessary for the purposes described above, unless they are still required to establish, exercise or defend legal claims. The statutory rules governing the start and calculation of each retention period remain applicable.

7. Transfers outside the EEA

When Cloudflare, Resend and Google Workspace are used, processing of personal data outside the European Economic Area (EEA) cannot be completely excluded; Resend stores data in the United States. Where personal data is transferred to the United States or other third countries, the transfer is made using the legally applicable transfer mechanism.

For transfers to US organisations certified under the EU-U.S. Data Privacy Framework, the European Commission’s adequacy decision under Article 45 GDPR may be relied upon. Where no adequacy decision applies, the providers’ contractual arrangements provide in particular for the European Commission’s Standard Contractual Clauses and, where appropriate, supplementary safeguards.

8. Your rights

Subject to the statutory requirements, you have in particular the following rights:

• access to personal data processed about you (Article 15 GDPR);
• rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);
• erasure of personal data (Article 17 GDPR);
• restriction of processing (Article 18 GDPR);
• data portability where the requirements of Article 20 GDPR are met;
• objection under Article 21 GDPR to processing based on Article 6(1)(f) GDPR.

To exercise your rights, contact info@ostarasoftware.com.

9. Right to lodge a complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for the controller in North Rhine-Westphalia is, in particular:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Email: poststelle@ldi.nrw.de
www.ldi.nrw.de

10. Right to object under Article 21(1) GDPR

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing. We will then no longer process the personal data concerned unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.