Privacy Policy

1. Data Controller

The data controller for the OrganicOS website and early access programme is infotropic.tech. For all data protection enquiries, please contact us at organicos@infotropic.tech.

2. What Data We Collect

We collect only the data you voluntarily provide. Current collection points on this site include the demo request form and the get-started assessment form, which ask for:

• Full name — to address you personally
• Work email address — to schedule and confirm your demo
• Organisation name — to understand your context and tailor the session
• Role and onboarding profile answers — to provide recommendations matched to your IT setup and priorities
• Onboarding report request — to email your tailored onboarding summary and recommended next steps

We also collect standard server log data (IP address, browser type, pages visited, timestamps) for security and operational purposes. This data is not linked to your identity and is not used for profiling.

3. Purpose and Legal Basis

4. Retention

Demo request data is retained for 24 months from the date of submission, after which it is permanently deleted. If we enter into a service agreement with you, data may be retained for the duration of that agreement plus any applicable statutory period.

Server log data is retained for up to 90 days and then automatically purged.

5. Data Sharing

We do not sell, rent, or trade your personal data, and we do not rely on third-party data sub-processors. This service is fully self-hosted: the database, transactional email, and server infrastructure are all operated by OrganicOS on our own EU-based infrastructure. Your data never leaves infrastructure we control.

6. International Transfers

Your data is processed and stored exclusively within the European Economic Area (EEA). No transfers to third countries are made.

7. Cookies

This website uses essential cookies only. These are strictly necessary for the site to function and cannot be disabled. We do not use analytics, advertising, or tracking cookies.

When you interact with the cookie banner, we store your preference in your browser’s local storage (not a cookie) to avoid showing the banner again. This data never leaves your device.

8. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Access — obtain a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request that we limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing

To exercise any right, email us at organicos@infotropic.tech with the subject line Data Subject Request. We will respond within 30 days. We may request proof of identity before processing your request.

You also have the right to lodge a complaint with your national data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.

9. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, or destruction. All data in transit is encrypted via TLS. Data at rest is encrypted using AES-256 on the underlying infrastructure.

10. Changes to This Policy

We may update this policy periodically. The effective date at the top of this page will always reflect the most recent revision. Material changes will be communicated to you by email if you have an active engagement with us.

11. Contact

For any privacy-related questions or to exercise your rights: