Privacy policy

Controller	OPENDOME, S.L.
Tax ID (NIF)	B88696745
Address	Carrer del Sol 62, 08201 Sabadell (Barcelona), Spain
Companies Register	Barcelona, sheet B-656608, folio 1, entry 1 · EUID ES08005.000748074
Privacy contact	privacy@opendome.eu

Data Protection Officer

Opendome has assessed the obligation to appoint a DPO under article 37 GDPR and concluded that the triggering conditions are not met: our activities do not constitute regular and systematic monitoring of data subjects on a large scale, nor large-scale processing of special categories of data, neither as controller nor as processor. This assessment is reviewed at least annually and whenever there is a relevant change in the nature or scale of processing.

Data protection enquiries are handled by the Information Security Coordinator at privacy@opendome.eu.

This distinction determines which obligations we assume and towards whom.

Sphere	Our role	What it means
Our own data visitors, contacts, staff, suppliers	Controller	We determine the purposes and means, document the legal basis, inform data subjects and handle their rights. This policy covers this sphere.
Customer data hosted in their dome	Processor	We process that data solely in accordance with the customer’s documented instructions; the customer is the controller. We do not decide purposes and do not use it for our own ends.

If you are an Opendome customer, the processing of the data you host in your dome is governed by the service agreement and by the data processing agreement (DPA) signed under article 28 GDPR, not by this policy.

If your data is hosted in a customer’s dome and you wish to exercise your rights, contact the controller — the organisation that collected your data. If you write to us, we will pass your request on without delay and assist the customer in handling it, but we cannot resolve it on our own unless expressly instructed to.

Provision of data. Unless otherwise indicated, the data we request in our forms is necessary to handle your request; without it we will not be able to do so. We do not collect special-category data (art. 9 GDPR) through this site; please do not include it in free-text fields.

To deliver our services we rely on providers that may access personal data as processors or sub-processors. All of them are subject to a prior assessment proportionate to their risk and to a data processing agreement under article 28 GDPR.

Provider	Service	Location
Hetzner Online GmbH	Website and CMS hosting, compute, storage and DNS	EU · Germany/Finland
Plausible Insights OÜ	Cookie-free web analytics	EU · Estonia
Infomaniak Network SA	Corporate email, documents, video conferencing and calendar	Switzerland · adequacy
Lettermint B.V.	Outbound transactional email	EU · Netherlands
Netim SARL	Domain registration	EU · France
1Password (AgileBits, Inc., Canada)	Staff password manager (BYOPM); organisation secrets reside in self-hosted OpenBao in the EU	Canada · EU data residency configured
HostKey B.V.	Inference backends for the optional AI module. Only involved if the customer contracts that module; until then no customer data flows through it	EU/EEA · contracted locations: Netherlands and Iceland

The complete, up-to-date list of providers and subprocessors, with their criticality, data categories and contractual status, is published and maintained at trust.opendome.eu.

Other recipients. We may disclose data to public authorities, supervisory authorities and courts where there is a legal obligation, as well as to professional advisers bound by a duty of confidentiality. We do not sell or share personal data for advertising purposes.

Customer data. Our customers’ production data resides and is processed in the European Union or the European Economic Area and is not transferred outside it. Every provider that processes customer data is based in the EU/EEA. This is an obligation of our information security management system and a pillar of the product, not a statement of intent.

Our own corporate data. As a general rule it is processed in the EU/EEA. There are two documented cases outside that framework, neither of which involves customer data:

• Switzerland, for the workplace suite and corporate email, covered by the European Commission’s adequacy decision.

• The United States, for two development tools with access to code and internal technical context — but not to customer data — which process incidental personal data of the team. These transfers rely on the EU-US Data Privacy Framework and/or standard contractual clauses (art. 46 GDPR), are recorded as an inventoried exception, have been formally accepted by our Security Council with annual review, and have migration to European alternatives as their stated goal.

You can request information about the safeguards applied by writing to privacy@opendome.eu.

We retain data only for as long as there is a business, contractual or legal purpose justifying it, in accordance with the periods set out in section 3. Once those periods have elapsed, the data is effectively erased or blocked, available solely to public authorities and courts, for the limitation period of any actions that might arise.

Our erasure is effective: it reaches the data and its derived copies, and in the case of credentials it includes revocation as well as deletion.

You may exercise at any time the rights granted to you by articles 15 to 22 GDPR:

Right	What it allows you to do
Access	Find out what data of yours we process and obtain a copy.
Rectification	Correct inaccurate data or complete it.
Erasure	Request its deletion when it is no longer necessary or you withdraw your consent.
Restriction	Ask us to suspend processing while a challenge is verified.
Portability	Receive your data in a structured, commonly used format, or have us transmit it to another controller.
Objection	Object to processing based on legitimate interest, including direct marketing.
Automated decisions	Not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you.
Withdraw consent	At any time, without affecting the lawfulness of processing carried out beforehand.

How to exercise them

Write to privacy@opendome.eu or to OPENDOME, S.L., Carrer del Sol 62, 08201 Sabadell (Barcelona), stating the right you are exercising. We will verify your identity before replying and will resolve the matter within one month of receipt, extendable by a further two months where the complexity or number of requests justifies it, in which case we will tell you why within the first month (art. 12 GDPR).

Complaints

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) — C/ Jorge Juan 6, 28001 Madrid — www.aepd.es. We would be grateful if you gave us the chance to resolve it first.

Opendome operates an Information Security Management System aligned with ISO/IEC 27001:2022 and with SOC 2 criteria, with policies approved and reviewed by its Security Council. The technical and organisational measures applied under article 32 GDPR include, among others:

• Encryption in transit (TLS) and at rest, and disk encryption on every workstation.

• Identity and access: single sign-on with mandatory multi-factor authentication and the principles of least privilege and need to know.

• Tenant isolation: each customer’s data resides in an isolated dome, with no mixing and no cross access.

• Governed data consumption: every read passes through a single semantic layer with a fail-closed policy enforcement point — deny by default; no data backend or model is exposed directly.

• Traceability: every access is written to an audit log.

• Secure development: mandatory peer review, vulnerability and dependency scanning, SBOM and artefact signing.

• Synthetic data in development: using real customer data in development, testing or demonstration environments is prohibited.

• Risk, third-party and incident management documented, with periodic review.

Certification status. The ISMS operates normally and is on track for ISO/IEC 27001:2022 certification (audit in November 2026) and SOC 2 attestation (Type I in autumn 2026); we do not present them as obtained until they are issued. The scope, timeline and progress are published on the trust portal.

Security and compliance documentation — policies, controls and evidence — is published at trust.opendome.eu.

In the event of a personal data breach:

• As controller, we will notify the AEPD without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. Where the risk is high, we will also communicate it to the affected data subjects.

• As processor, we will notify the controlling customer without undue delay and provide the information they need to meet their own notification obligations.

Every breach is documented — facts, effects and measures taken — regardless of whether it is notifiable.

We make no automated decisions producing legal or similarly significant effects on visitors to this site, and we do not carry out profiling for that purpose.

Within our product, the use of artificial intelligence is governed by a responsible AI policy aligned with Regulation (EU) 2024/1689 (EU AI Act), whose principles are: transparency and traceability of every inference over customer data; human oversight of any relevant decision about a person’s security, access or rights; no automatic determination of whether a datum is personal — it is declared, not inferred; and consumption of data exclusively through the governed layer. The AI systems we develop or operate have a documented risk classification under the Regulation.

This site is aimed at professionals and organisations. It is not intended for minors and we do not knowingly collect data from them. If you become aware that a minor has provided us with data, write to privacy@opendome.eu so we can delete it.

We may update this policy to reflect regulatory, technical or business changes. We will always publish the date of last update and the version number. Where a change is substantial and affects processing based on your consent, we will inform you and, where appropriate, obtain fresh consent.