Privacy policy
In short: no cookies, no tracking, no analytics, no fonts or scripts from third-party servers.
Convenience translation. The German version is legally binding.
1. Controller
The controller under the GDPR is TODO: first and last name, DataDrivenConstruction, TODO: street, postcode, city, Germany. Email: info@datadrivenconstruction.io. See also the imprint. We have not appointed a data protection officer because none is legally required.
2. Hosting and server logs
The website runs on a virtual server (VPS) from Hostinger (contracting party under Hostinger’s terms: Hostinger International Ltd., Cyprus; the network range is registered to Hostinger at RIPE). A data processing agreement under Art. 28 GDPR is in place with the host. When you open a page, the server processes your IP address and request data as technically necessary to deliver the page and set up the TLS connection.TODO: confirm the contracting entity and server location in the Hostinger account and confirm the DPA
The web server (Caddy) writes no access logs for this domain and keeps no visitor lists. Only operational messages from the web server (for example certificate or connection errors, which in individual cases may contain an IP address) are written to the server’s container log. It is rotated automatically (at most 3 files of 10 MB, older data is overwritten; in practice a few days to weeks). The host may keep its own technical logs at network level.
Legal basis is Art. 6(1)(f) GDPR: our legitimate interest in running the website securely and reliably.
Third countries: the host is a company established in the EU. We do not transfer data to third countries ourselves; where the host uses sub-processors outside the EU/EEA, this happens only under suitable safeguards (e.g. EU standard contractual clauses or an adequacy decision).
3. SSL/TLS encryption
The website is served only over encrypted HTTPS.
4. Cookies, local storage, analytics
The website sets no cookies and uses no analytics or tracking services. All fonts, scripts and images load from this domain; nothing is fetched from content delivery networks or other servers. If you switch the colour scheme, your choice is stored only in your browser (localStorage) and never sent to us; it is strictly necessary within the meaning of § 25(2) TDDDG.
5. External links
The website links to GitHub (GitHub, Inc., USA) and to datadrivenconstruction.io. Merely opening this website transfers no data to them. Only when you follow a link does the respective operator process data under its own privacy policy.
6. Contact by email
If you write to info@datadrivenconstruction.io, we process your email address and the content of your message to handle your request (Art. 6(1)(b) or (f) GDPR). We delete the data once the matter is closed and no retention duty applies.
7. No automated decision-making
There is no automated decision-making, including profiling, under Art. 22 GDPR.
8. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), notification (Art. 19), data portability (Art. 20) and objection (Art. 21). To exercise them, email info@datadrivenconstruction.io.
Right to object under Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
9. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for us is TODO: state data protection authority of the German Land where the controller is based, with name and address. A list of authorities is kept by the BfDI.
10. Live demo
The live demo (demo.openbusinesserp.com) is a separate service. The following applies to it instead of sections 2 and 4; the statements on access logs and cookies in those sections concern this website only.
Which data: first name, last name, email address, company, role, language, the time of sign-up and of confirmation, and a random confirmation token. The IP address is held in memory only, for rate limiting (at most 24 hours), and is not stored. After confirmation the demo sets one cookie (obe_demo, 30 days) that only records that the tour is unlocked. The tour itself shows screenshots with sample data; nothing you do there is stored. No tracking, no ads.
Purpose: sending the confirmation email and unlocking the tour, abuse prevention (rate limiting), and an internal notification to us about confirmed sign-ups so that we can answer questions about the demo.
Legal basis: Art. 6(1)(a) GDPR (your consent in the form) for sending the confirmation email, Art. 6(1)(f) GDPR for abuse prevention and the internal notification. You can withdraw your consent at any time with effect for the future.
Retention: unconfirmed sign-ups are deleted after 7 days, confirmation tokens after 48 hours, confirmed sign-ups after 12 months.
Deletion: automatically when the period ends, or at any time on request by email to info@datadrivenconstruction.io.
Recipients: no disclosure to third parties. The host named in section 2 runs the server and the email delivery solely as a processor. We do not transfer data to third countries ourselves; for the host’s sub-processors the statement in section 2 applies.
Your rights under section 8 apply here as well.
11. The software itself
This policy covers the website and the live demo. When you run OpenBusinessERP yourself, you are responsible for the data in your installation. See PRIVACY.md in the repository.
Last updated: November 2026