Privacy Policy

Protecting your personal data is important to us. Below we provide comprehensive information about which data we collect in connection with the use of our website and our products, how we process that data, and what rights you have as a data subject.

1. Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

If you have questions about the collection, processing, or use of your personal data, or wish to request information, rectification, blocking, or deletion of data, or to revoke a consent you have given, please contact us using the details above or directly at datasecurity@omnora.com.

2. General information about data collection

When you visit our website, our system automatically collects information that your browser transmits to our server. This includes, in particular, the browser type and version used, the operating system employed, the page accessed, the previously visited page (referrer URL), the date and time of access, and the IP address of the accessing system.

This data is collected solely for the purpose of ensuring the technical provision and functionality of our website, ensuring server stability, and continuously optimizing our offering. This data is not combined with other data sources. The legal basis for collecting this data is our legitimate interest in the secure and trouble-free operation of our website pursuant to Art. 6 (1)(f) GDPR.

3. Legal bases for processing

We process personal data exclusively on the basis of the statutory provisions of the GDPR. Depending on the purpose of processing, the following legal bases apply:

• Consent (Art. 6 (1)(a) GDPR): Where you have given us your consent to process specific personal data, for example for the use of optional cookies or to receive marketing communications.
• Performance of a contract (Art. 6 (1)(b) GDPR): Where processing is necessary to perform a contract with you or to take pre-contractual steps, for example in connection with providing our software products.
• Legal obligation (Art. 6 (1)(c) GDPR): Where processing is necessary to comply with a legal obligation to which we are subject, such as commercial and tax retention requirements.
• Legitimate interest (Art. 6 (1)(f) GDPR): Where processing is necessary to safeguard the legitimate interests of us or a third party, provided these do not override your interests or fundamental rights, for example in connection with traffic measurement or IT security.

4. Processors and third parties

To provide our services, we sometimes engage external service providers who process personal data on our behalf (processors). We have entered into data processing agreements pursuant to Art. 28 GDPR with all processors, ensuring that they process your data solely on our instructions and in compliance with applicable data protection law.

Your personal data is only disclosed to other third parties where a legal permission exists, you have given your consent, or this is necessary to perform a contract.

5. International data transfers

Some of the service providers we use process data outside the European Union or the European Economic Area, in particular in the United States. In such cases, we ensure an adequate level of data protection through appropriate safeguards, in particular by entering into the European Commission's Standard Contractual Clauses (SCCs) with the respective providers, supplemented where necessary by additional technical and organizational measures.

6. Cookies, consent management and local storage

Our website uses cookies and similar technologies (e.g. your browser's local storage). Cookies are small text files stored on your device. We distinguish between technically necessary cookies, which are essential for operating the website, and optional cookies in the categories "Preferences", "Statistics" and "Marketing".

We manage your consent with our own consent banner, served entirely from our server; no data is passed to third parties in the process. On your first visit, the banner asks for your consent. Optional services are only loaded after you have consented to the respective category; before that, no connection to these providers is made. We store your choice, together with the time of your decision, only in your browser in the technically necessary cookie "omn_consent" (12 months). The legal basis for necessary cookies is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR; for optional cookies it is your consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. An overview of all cookies with provider, purpose and storage period is available in the cookie settings, where you can change or withdraw your consent at any time with future effect: Cookie settings.

We use Google Consent Mode (v2). Until you consent, all Google storage purposes are set to "denied".

Attributing your enquiry to campaigns. If you reach our website via a link with campaign parameters (e.g. "utm_source"), we store these parameters, the domain of the referring website and the landing page in your browser's session storage, together with the use case of the product page you last visited. This information contains no identifiers, does not leave your browser by itself and is deleted when you close the browser window. It is only transmitted to us when you submit a form or register via a link to our application, so that we can attribute your enquiry to the right campaign. The legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. Ad click identifiers (e.g. "gclid", "li_fat_id") and the first campaign source beyond the session (local storage, 90 days) are only stored with your consent in the "Marketing" category.

7. SSL encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL encryption. You can recognize an encrypted connection by the fact that the address bar of your browser changes from "http://" to "https://" and by the padlock symbol in your browser bar. When SSL encryption is active, the data you transmit to us cannot be read by third parties.

8. Data deletion

We process and store your personal data only for as long as necessary to achieve the respective processing purpose or as required by the statutory retention periods to which we are subject. Once the purpose no longer applies or a mandatory retention period expires, the relevant data is routinely blocked or deleted in accordance with statutory requirements.

9. Services used on our website

We use the following services on our website. Services that require consent are only loaded after you have consented to the stated category in the cookie banner. Fonts are delivered from our own server; no data is transmitted to third parties for this.

9.1 Google Tag Manager

We use Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It manages and delivers scripts (e.g. for Google Analytics or marketing tools), does not perform any analysis itself and does not set its own cookies. Tag Manager is not loaded from Google's servers but via our own server-side tagging server (sst.omnora.com, Google Cloud Run, Frankfurt region), and only after you have consented to the "Statistics" and "Marketing" categories (Art. 6(1)(a) GDPR).

9.2 Google Analytics 4

With Google Analytics 4 by Google we analyse how our website is used (e.g. pages viewed, browser and device information, approximate location) in order to improve our content. The data is not sent to Google directly but is first processed on our server-side tagging server in Frankfurt, where in particular the IP address is anonymised or pseudonymised before it is forwarded to Google. We use Google Signals for cross-device reports that are aggregated only. Data is retained for 14 months. The legal basis is your consent ("Statistics" category, Art. 6(1)(a) GDPR). We have concluded a data processing agreement with Google. For transfers to the USA, Google LLC is certified under the EU-US Data Privacy Framework; the European Commission's standard contractual clauses apply in addition. More information: https://policies.google.com/privacy

9.3 Google Ads: conversion tracking, remarketing and Customer Match

Google Ads conversion tracking lets us measure whether a click on one of our ads leads to an enquiry; a cookie with a maximum lifetime of 90 days is set for this. Remarketing allows us to show visitors of our website ads in the Google advertising network about content they viewed with us. As part of "Customer Match" we transmit data you have given us (e.g. your email address) to Google as a SHA-256 hash in order to target ads and attribute conversions; Google deletes the hashes after matching. The legal basis is your consent ("Marketing" category, Art. 6(1)(a) GDPR). You can also deactivate personalised advertising at https://adssettings.google.com.

9.4 LinkedIn Insight Tag and Conversion API

We use the LinkedIn Insight Tag by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, to measure the performance of our ads on LinkedIn and to address visitors of our website there as an audience. Data processed includes the URL visited, referrer, IP address (shortened), device and browser properties and LinkedIn cookie information; LinkedIn may link this data to your LinkedIn account. In addition, we transmit events via the LinkedIn Conversion API from our server-side tagging server in Frankfurt, with email addresses only as SHA-256 hashes. The legal basis is your consent ("Marketing" category, Art. 6(1)(a) GDPR). LinkedIn Corporation (USA) is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. More information: https://www.linkedin.com/legal/privacy-policy

9.5 Meta Pixel

Google Tag Manager may load the Meta Pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, to measure campaign performance. This only happens with your consent ("Marketing" category, Art. 6(1)(a) GDPR). For transfers to the USA, Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

9.6 HubSpot

We use HubSpot by HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany, for three purposes:

• Website analytics and chat: with your consent ("Statistics" and "Marketing" categories, Art. 6(1)(a) GDPR), HubSpot uses cookies to record how our website is used (e.g. IP address, approximate location, browser, visit duration, pages viewed) and provides the chat window.
• Forms and enquiries: the data you enter in our forms is sent directly to HubSpot (data centre in the EU) and processed there in a contact record, together with the page from which you sent the enquiry and, where applicable, the campaign attribution (section 6). If you have consented to HubSpot analytics, the enquiry is also linked to your previous visits. The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at concluding a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
• Emails: we send marketing emails and requested content (e.g. white papers, webinar access) via HubSpot on the basis of your consent (Art. 6(1)(a) GDPR), which we confirm via double opt-in. We evaluate opens and clicks to improve our emails. You can unsubscribe at any time via the link in every email.

We have concluded a data processing agreement with HubSpot; the data is stored on servers in the EU. Access by HubSpot, Inc. (USA) in the course of support services is safeguarded by its certification under the EU-US Data Privacy Framework and the standard contractual clauses. More information: https://legal.hubspot.com/privacy-policy

9.7 PostHog

For statistical analysis of how our website is used we use PostHog by PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. The data is processed in PostHog's EU cloud (Frankfurt). Page views, clicks and page exits are recorded with a pseudonymous identifier, together with device and browser data; session recording is disabled and no person profiles are created. The legal basis is your consent ("Statistics" category, Art. 6(1)(a) GDPR). Any access from the USA is safeguarded by the EU-US Data Privacy Framework and the standard contractual clauses.

9.8 Videos and embedded content

Videos (e.g. from YouTube, a service of Google Ireland Limited) and the AI interview of our application (im.omnora.com) are only loaded when you click "Play" or "Start". Only then is a connection to the respective server established; YouTube may set cookies and transfer data to the USA (EU-US Data Privacy Framework). The legal basis is your consent given by actively starting the content (Art. 6(1)(a) GDPR).

10. Use of our application

If you register for our application (app.omnora.com), we collect the data required for registration, including confirmation of your email address. To analyse and improve the application, for in-app communication and product feedback, we process data on the basis of Art. 6(1)(f) GDPR; our legitimate interest lies in the further development and stability of the application and in supporting its users. Within the application we only use cookies and similar technologies with your consent, which you give in the application's cookie banner and can withdraw at any time. We use the following services:

• Intercom (Intercom, Inc., 55 2nd Street, San Francisco, CA 94105, USA): usage analysis, in-app messages and emails with guidance. We provide Intercom with a limited amount of your data (e.g. sign-up date, email address).
• Productboard (Productboard, Inc., 612 Howard Street, San Francisco, CA 94105, USA): collecting product ideas and votes; your email address, for example, is transmitted when you vote for a feature or submit an idea.
• PostHog (PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA): usage analysis with a pseudonymous user identifier, usage events and device and browser data.

Transfers to the USA are safeguarded in each case by the provider's certification under the EU-US Data Privacy Framework and the standard contractual clauses. You can object to the processing at any time (section 12).

11. Applicant data

To process applicant data and manage open positions, we use the applicant management system of Personio SE & Co. KG. CVs, documents and correspondence are stored on Personio servers within the EU; a data processing agreement is in place with Personio. The legal basis is Section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. In addition, we may take into account publicly available information from professional networks (e.g. LinkedIn, XING); the legal basis for this is Art. 6(1)(f) GDPR. After the application process has been completed, your data is retained for twelve months in order to respond to any queries or legal claims and is then deleted, unless you have agreed to longer retention, for example as part of a talent pool.

12. Your rights as a data subject

With regard to the processing of your personal data, you have the following rights:

• the right of access to the personal data we process about you (Art. 15 GDPR),
• the right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR),
• the right to erasure of data stored by us (Art. 17 GDPR),
• the right to restriction of the processing of your data (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to the processing of your data (Art. 21 GDPR),
• the right to withdraw any consent given, with future effect (Art. 7 (3) GDPR),
• the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR).

To exercise these rights, an informal message to the contact details given in the imprint is sufficient.

13. Changes to this privacy policy

We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements, or to reflect changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.

14. Contact for privacy inquiries

If you have questions about data protection or wish to exercise your rights as a data subject, please contact:datasecurity@omnora.com.