Legal
Privacy statement
What we collect, why, who else touches it, and how to make us stop.
Controller
OPA Software, Ltd. is the Controller for the personal data described here. Write to inquiry@opaseltd.com, or to either office listed in the imprint.
What we process, and why
Enquiries you send us
If you use the enquiry form or email us, we process the name, email address, company and message you provide, in order to read and answer you. The lawful basis is our legitimate interest in responding to people who contact us, and in taking steps toward a contract where you are asking us to quote for work.
Delivery and security
This website is delivered through a content-delivery network, which necessarily processes your IP address and request in order to return the page and to block attacks. The lawful basis is our legitimate interest in keeping the site available and secure.
We do not keep a per-visitor access log on our own server for this website. Our systems record diagnostic errors, and the enquiry endpoint keeps a short-lived record of the sending IP address so that a single source cannot flood the form. That record is used for nothing else.
Statistics
With your consent we use Google Analytics to count visits and see which articles are read. IP addresses are truncated before storage, advertising features are switched off, and no consent means no analytics cookie is set and no data is sent. The lawful basis is your consent, which you may withdraw at any time — see the cookie policy.
Who processes data for us
We keep this list short on purpose. Each of these is a Processor acting on our instructions:
- netcup GmbH (Karlsruhe, Germany) — the dedicated server this site and our applications run on.
- Cloudflare, Inc. — DNS, content delivery and protection in front of that server, and encrypted off-site backup storage.
- Resend — delivery of the email generated when you submit the enquiry form.
- OpenStreetMap Foundation — the two maps embedded on the contact page. Loading that page requests map tiles, which discloses your IP address to them. No other page embeds a third party.
- Google Ireland Limited — website statistics, only after you consent.
Where a processor transfers data outside the European Economic Area, that transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
Enquiry messages are kept while the conversation is live and for up to 24 months afterwards, so that we can pick up a thread you started; then they are deleted. Rate-limiting records expire within hours. Diagnostic logs are held on a rolling basis and overwritten as space requires.
Your rights
Under the GDPR you may request access to your personal data, and its rectification or erasure; you may ask us to restrict processing, object to it, or receive your data in a portable form; and where processing rests on consent, you may withdraw that consent at any time without affecting what was lawful before.
Write to inquiry@opaseltd.com with the subject line DATA REQUEST. We answer within one month. We do not charge for this, and we will not ask you for more identification than we need to be sure it is you.
Complaints
If you think we have handled your data badly, please tell us first — it is usually quicker. You also have the right to complain to a supervisory authority, in particular the Belgian Data Protection Authority (dataprotectionauthority.be) or the Hellenic Data Protection Authority (dpa.gr), or the authority where you live.
What we do not do
We do not sell personal data. We do not use it for automated decision-making or profiling. We do not run advertising trackers, social-media pixels or session recording. We do not ask for personal data we have no use for.
Changes
If this statement changes materially we will update the date in the sidebar and, where the change affects you, say so on the page. This version is dated 3 September 2026.