Website & free waitlist
OCTO and the GDPR
Download this review version (HTML) Permanent version link Previous version — 6 October 2026 (1.4.2)
This overview summarises the Privacy Policy; it is not a certification of compliance. The GDPR protects personal data and provides individual rights, not only for EU citizens.
Who is responsible?
Axel Van Mechelen and Robbe Heynderickx operate OCTO personally as joint controllers. Axel coordinates privacy requests; Robbe coordinates suppliers, deletion and backup expiry. You can exercise your rights against either founder at admin@octo-tool.com or Isabellakaai 60, 9000 Ghent, Belgium.
What data and choices are involved?
The website processes necessary request/security data and your cookie choice. GA4 loads only after statistics consent. When registration reopens, the free waitlist will use email, language, participation status and times, age/guardian declarations and versioned consent/Terms evidence. Education and referral answers are optional; we do not ask for a name or date of birth. Newsletter consent and confirmation are separate.
The 16+ rule and guardian permission for ages 16–17 are OCTO's participation requirements, not the general GDPR consent age. Product accounts, uploads, AI and payments need separate information before introduction.
Which cookies and storage?
CookieConsent remembers your choice for one calendar month. Cookiebot's separate published End User Data retention is 12 months. With statistics consent, _ga and _ga_CCXN1DEMRF have lifetimes up to 180 days; activity can renew the session cookie. GA4 user/event data have a separate two-month retention setting, without renewal on activity. Aggregated reports are outside that setting.
octo-language local storage remembers your explicitly chosen language until cleared. Use Cookie settings to remove it or change analytics choices. Rejecting analytics does not restrict website access. Withdrawal stops new measurement and removes the GA cookies we control; it does not automatically erase historical measurements. Security storage in the paused signup flow still needs a complete inventory.
Who supplies the service?
Cloudflare provides hosting/security and encrypted R2 backup storage; Supabase provides the database/server functions; Brevo handles requested emails and optional newsletters; Neo hosts contact mailboxes; Cookiebot/Usercentrics manages consent; Google supplies optional analytics. The Privacy Policy describes known locations and links to provider terms. EU hosting alone does not establish that every operation stays in the EEA.
Account-specific processing agreements, locations, subprocessors and international-transfer safeguards still need complete verification. Joining the waitlist does not make OCTO your processor or require you to enter a data processing agreement with OCTO.
What remains paused or under review?
New signups and subscriber emails remain paused. We retain Brevo, which says it cannot fully disable tracking in our existing automations. Delivered tests showed individual open/click records despite tracking refusal. Our waitlist system does not import those engagement events, but that does not prevent Brevo from processing them. Newsletter or website analytics consent is not being treated as permission for individual email tracking; the purposes, retention and applicable consent or exemption requirements remain under review. The documented retention limits require manual work: permanent automated cleanup is not enabled, and actual provider, mailbox and backup expiry checks remain outstanding. The Privacy Policy distinguishes those gaps from verified browser behavior.
Preference changes are saved in OCTO first; updates to Brevo are queued and may take time. A message already accepted by the email provider for delivery may still arrive. We check current permission before further sending and investigate failed synchronization; a delay does not restore consent.
How do I exercise my rights?
Cookie withdrawal, newsletter unsubscribe, leaving the waitlist and removing optional answers are separate choices. Email preferences does not itself erase every provider, mailbox or backup record. Contact us for full erasure, access, correction, restriction, portability or an objection, subject to GDPR conditions.
We respond without undue delay and within one month; a permitted extension of up to two further months must be explained within the first month. Consent withdrawal does not make earlier lawful processing unlawful. You may complain directly to the Belgian Data Protection Authority or another competent authority, or seek a judicial remedy. This legal release is available in English and Dutch.