Website & free waitlist
OCTO and the GDPR
Download PDF Download this review version (HTML) Permanent version link Previous version — 1.4.3
This overview summarises the Privacy Policy; it is not a certification of compliance. The GDPR protects personal data and provides individual rights, not only for EU citizens.
Who is responsible?
Axel Van Mechelen and Robbe Heynderickx operate OCTO personally as joint controllers. Axel coordinates privacy requests; Robbe coordinates suppliers, deletion and backup expiry. You can exercise your rights against either founder at admin@octo-tool.com or Isabellakaai 60, 9000 Ghent, Belgium.
What data and choices are involved?
The website processes necessary request/security data and your cookie choice. GA4 loads only after statistics consent. When registration reopens, the free waitlist will use email, language, participation status and times, age/guardian declarations and versioned consent/Terms evidence. Education and referral answers are optional; we do not ask for a name or date of birth. Newsletter consent and confirmation are separate.
The 16+ rule and guardian permission for ages 16–17 are OCTO's participation requirements, not the general GDPR consent age. Product accounts, uploads, AI and payments need separate information before introduction.
Which cookies and storage?
CookieConsent remembers your choice for one calendar month. Cookiebot's separate published End User Data retention is 12 months. With statistics consent, _ga and _ga_CCXN1DEMRF have lifetimes up to 180 days; activity can renew the session cookie. GA4 user/event data have a separate two-month retention setting, without renewal on activity. Aggregated reports are outside that setting.
octo-language local storage remembers your explicitly chosen language until cleared. Use Cookie settings to remove it or change analytics choices. Rejecting analytics does not restrict website access. Withdrawal stops new measurement and removes the GA cookies we control; it does not automatically erase historical measurements. Security storage in the paused signup flow still needs a complete inventory.
Who supplies the service?
Cloudflare provides hosting/security and encrypted R2 backup storage; Supabase provides the database/server functions; Brevo handles requested emails and optional newsletters; Neo hosts contact mailboxes; Cookiebot/Usercentrics manages consent; Google supplies optional analytics. The Privacy Policy describes known locations and links to provider terms. EU hosting alone does not establish that every operation stays in the EEA.
Account-specific processing agreements, locations, subprocessors and international-transfer safeguards still need complete verification. Joining the waitlist does not make OCTO your processor or require you to enter a data processing agreement with OCTO.
What remains paused or under review?
New signups and subscriber emails remain paused. OCTO retains Brevo and intends to use email technical records only for necessary delivery and security, not engagement analytics or marketing profiles. Both anonymous-tracking settings and the per-contact refusal setting are used, but Brevo still inserts pixels/rewritten links and controlled checks found individual open/click details. These controls are therefore not a promise of tracking-free delivery.
Before restarting, we must substantiate any strictly necessary exemption for the actual processing, including minimum data, purpose, retention and provider responsibilities. A general security explanation, legitimate interests, Terms acceptance, newsletter permission or website-analytics consent does not automatically authorise every email-tracking operation. Processing outside a valid exemption needs an effective consent route or must be disabled. Privacy Policy section 4.2 explains objections, old messages and the limits of preference controls.
The documented retention limits require manual work: automatic permanent cleanup is not enabled, and full provider, mailbox and backup expiry still requires verification. Supabase's account documents confirm that its DPA is incorporated into its Terms; this does not complete the checks for every supplier, processing location or international transfer.
Preference changes are saved in OCTO first; updates to Brevo are queued and may take time. A message already accepted by the email provider for delivery may still arrive. We check current permission before further sending and investigate failed synchronization; a delay does not restore consent.
How do I exercise my rights?
Cookie withdrawal, newsletter unsubscribe, leaving the waitlist and removing optional answers are separate choices. Email preferences does not itself erase every provider, mailbox or backup record. Contact us for full erasure, access, correction, restriction, portability or an objection, subject to GDPR conditions.
We respond without undue delay and within one month; a permitted extension of up to two further months must be explained within the first month. Consent withdrawal does not make earlier lawful processing unlawful. You may complain directly to the Belgian Data Protection Authority or another competent authority, or seek a judicial remedy. This legal release is available in English and Dutch.