Privacy Policy
1. Controller
The controller for data processing on this website is Open Source Certification GmbH, represented by its Managing Director Reiner Brandt, Karthäuserstraße 8, 34117 Kassel, Germany, phone +49 561 80700-50, email info@oscert.eu.
No data protection officer has been appointed. Please send any questions about data protection to the address above. The German version of this privacy policy is authoritative.
2. Hosting and email
The website runs on servers of Open Source Certification GmbH in the data center of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Emails (the info@oscert.eu mailbox and emails sent by the website) are transmitted and stored by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Both providers process data only on our behalf (Art. 28 GDPR) and in Germany.
3. Visiting the website and server logs
When you visit the website, our servers automatically process data transmitted by your browser: IP address, date and time, requested address, previously visited page (referrer), browser type and operating system. This is necessary to deliver the website, keep it secure and find errors.
The legal basis is our legitimate interest in secure and error-free operation (Art. 6 (1) (f) GDPR). Logs of the upstream server are deleted after 14 days; logs of the web server are continuously overwritten. The data is not combined with other data.
The connection is encrypted with TLS (shown by “https://” in the address bar).
4. Cookies
We only use one technically necessary cookie (“october_session”). It keeps the session, protects forms against misuse and keeps you signed in to the partner portal. It expires after 120 minutes of inactivity. We do not use analytics, advertising or marketing cookies.
The legal basis is Section 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (f) GDPR.
5. Contact form and email
If you write to us using the contact form or by email, we process your details (topic, name, email address, optionally organization and phone number, message) to answer your request. The form sends your details by email to info@oscert.eu; they are not stored on the website.
The legal basis is Art. 6 (1) (b) GDPR where your request aims at a contract, otherwise our legitimate interest in answering it (Art. 6 (1) (f) GDPR). We delete the data once the request has been dealt with, unless statutory retention periods apply.
6. Training requests
You can request a training using the form on a course or date. We process your details (name, email address, optionally phone number, organization and number of participants, selected course and date, message). The form sends them to us by email; they are not stored on the website.
Where necessary for your request, we pass the details on to the training partner who runs the course. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures). We delete the data once the request has been dealt with, unless statutory retention periods apply.
7. Registration as an Academic Partner
When you register an institution as an Academic Partner, we store the details from the form (institution, address, contact person with name, email address and phone number) and the uploaded agreement and send them to us by email. The name, country and website of the institution appear in the list of Academic Partners after approval; details of the contact person do not.
The legal basis is Art. 6 (1) (b) GDPR. We store the data for the duration of the partnership and beyond that where statutory retention periods apply.
8. Partner portal
Training partners maintain their courses and dates in the partner portal. For this purpose, we process the name, email address and role of invited persons and whether they are the main contact. Sign-in works without a password via a link sent by email (valid for 15 minutes, invitations for 7 days). We store when a person accepted the terms of use and log every change with person and time, so that changes can be traced and undone. We delete uploaded files after 30 days. The portal sends emails about sign-in, invitations, uploads and the regular review of the information.
The legal basis is the contract with the training partner (Art. 6 (1) (b) GDPR) and our legitimate interest in secure, traceable operation (Art. 6 (1) (f) GDPR). We store the data as long as the person has access for the partner and delete it afterwards, unless retention periods apply.
9. Event registration
You register for events such as the partner conference by email. We use your details only to organize the event (Art. 6 (1) (b) GDPR) and delete them afterwards, unless retention periods apply.
10. Fonts, analytics and external content
We load fonts and all other parts of the website from our own server; no data is transferred to third parties. We do not use analytics, advertising or social media services and do not embed external content such as maps or videos. Links to other websites only take you there when you click them.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7 (3)).
Right to object: Where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
To exercise these rights, contact info@oscert.eu. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.
12. Advertising using the contact details in the legal notice
We object to the use of the contact details published in the legal notice for sending unsolicited advertising and information material.