Privacy Notice

This privacy notice explains how Omnitrex collects and processes your personal data when you visit our marketing website at omnitrex.eu.

This notice applies only to the omnitrex.eu marketing website. It does not cover the Omnitrex GRC platform at app.omnitrex.eu, which is subject to its own privacy policy.

We have written this notice in plain language so that you can understand exactly what data we collect, why we collect it, and what rights you have.

The data controller responsible for your personal data is:

For privacy-specific inquiries, please use our contact form and select "Privacy & Data Rights", or email info@omnitrex.eu.

A. Data you provide directly

• Contact form: name, email address, company (optional), area of interest, and your message
• Privacy consent: your acknowledgment that you have read this privacy notice

B. Data collected automatically

• Error reports via Sentry: IP address, browser and operating system information, page URL, and error stack traces — collected solely for debugging purposes
• Rate limiting: IP address used for contact form anti-abuse protection, retained in server memory only and not persisted to disk

C. Data we do NOT collect

• No analytics cookies — we do not use Google Analytics or similar tracking services
• No tracking cookies of any kind
• No advertising identifiers
• No social media pixels
• No fingerprinting

Legitimate interest balancing: For each purpose relying on Art. 6(1)(f), our interest is specified above. We have assessed that these interests are not overridden by your rights, given the limited nature of the data processed and the measures we take to minimize data collection.

We do not sell, rent, or trade your personal data to any third party.

All sub-processors are bound by Data Processing Agreements (Art. 28 GDPR).

Note: We are committed to reducing non-EU data exposure and are evaluating fully EU-hosted alternatives where transatlantic transfers currently occur.

• Primary data storage and processing takes place within the European Union
• Some sub-processors are US-headquartered with EU processing capabilities (see Section 5)
• Transfer safeguards: EU-US Data Privacy Framework (adequacy decision) and/or Standard Contractual Clauses (Art. 46(2)(c) GDPR)
• You may request a copy of the relevant safeguards by contacting us

• We do not use tracking cookies on this website
• We do not use Google Analytics or similar tracking services
• Essential functionality (e.g., form state) uses browser-native features, not persistent cookies
• If we introduce cookies in the future, we will update this notice and implement a consent mechanism
• No third-party advertising, remarketing, or social media tracking

• Encryption in transit: TLS 1.3
• Security headers: Content Security Policy, X-Frame-Options (DENY), strict referrer policy
• Disabled browser features: camera, microphone, geolocation (Permissions-Policy)
• Contact form anti-abuse: rate limiting (3 submissions per IP per hour), honeypot bot detection

See our Security page for full details.

• Access (Art. 15) — request a copy of your personal data
• Rectification (Art. 16) — correct inaccurate data
• Erasure (Art. 17) — request deletion ("right to be forgotten")
• Restriction (Art. 18) — limit processing
• Data portability (Art. 20) — receive data in machine-readable format
• Object (Art. 21) — object to processing based on legitimate interests. You have an absolute right to object to direct marketing at any time
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you (Art. 22 GDPR).

Providing your personal data via the contact form is not a statutory or contractual requirement. However, if you do not provide your name, email, and message, we will be unable to respond to your inquiry.

Our services are directed at business professionals and are not intended for individuals under the age of 16. We do not knowingly collect personal data from children.

• Material changes will be highlighted on this page with an updated effective date
• We will not introduce new processing purposes without updating this notice first
• For significant changes that affect your rights, we will make reasonable efforts to notify you directly if we have your contact details

You have the right to lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is:

We encourage you to contact us first so we can try to resolve your concern.

This privacy notice is governed by the laws of the Netherlands and the GDPR. Any disputes shall be subject to the exclusive jurisdiction of the competent courts in the Netherlands.