Privacy Policy
1. Controller
IT Systeme Flores UG (haftungsbeschränkt)
Neufeldweg 25a, 51427 Bergisch Gladbach, Germany
Email: info@it-flores.de
Phone: +49 2204 7675640
German law does not require us to appoint a data protection officer at our company size (§ 38 BDSG). Send privacy questions directly to the email address above.
2. Server logs
When you visit this site, we automatically process technical access data on our own server (IP address, date and time, page requested, data transferred, browser type, referrer URL). This is not delegated to our hosting provider; Hetzner only supplies the underlying infrastructure (see section 5). This serves the secure, stable operation of the site, in particular defending against attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Logs are deleted after 14 days unless a concrete security incident requires keeping them longer.
3. Beta-notification form ("Get notified")
When you submit the form to be notified about Osiris's availability, we process what you enter (company, name, business email address, approximate mailbox count, sources in use, edition of interest, any free-text note, the page language, and the composed message text) to contact you about the availability of Osiris and, once it exists, its live demo. The legal basis for this is your consent (Art. 6(1)(a) GDPR), recorded as your two confirmations plus the text version you consented to and a timestamp; Art. 6(1)(b) GDPR applies once an order follows. You can withdraw this consent at any time, with effect for the future, by emailinginfo@it-flores.de. Withdrawal does not affect the lawfulness of processing carried out before it. The required fields are necessary so we can respond to you; without them we cannot process your enquiry.
The submission is separately logged with the IP address it came from and a country derived from it (using a local, offline GeoIP database on our own server: the IP address is not sent to any external geolocation service for this), for abuse prevention. This is processed under our legitimate interest (Art. 6(1)(f) GDPR), not your consent, and is kept for its own, shorter period: 30 days, unless a concrete abuse incident requires keeping it longer.
Your data is not sold and not shared for any other purpose. It is processed on our own server (see section 5), through a small internal tool ("the panel") that IT Systeme Flores UG (haftungsbeschränkt), operating under the brand name "Creo Digital" and not a separate legal entity, also uses for its other business email intake, and delivered from there as an email to our business mailbox: that mailbox is hosted by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft 365"), acting as our processor under Art. 28 GDPR. The same applies to any email you send us directly (Art. 6(1)(b)/(f) GDPR). Microsoft's infrastructure can involve access from outside the EU/EEA, in particular the United States; the legal basis for that is the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). A hidden field exists only to catch automated form submissions (bots): if it is filled in, the panel silently discards the submission (no email is sent, and the data is not otherwise processed) rather than storing or answering it. To limit abuse, the panel accepts at most 5 submissions per hour from the same IP address; an IP address used for this rate limit alone, without a form submission, is held only in the rate limiter for up to one hour and then discarded. We delete the data once its purpose is fulfilled (you have been contacted and the matter is closed), and in any case after 24 months without a response from you.
As of the date at the top of this page, submitting this form does not trigger a separate confirmation email before the later "Osiris is available" notification is sent to the address you gave us. Only your consent, given by ticking the checkboxes below, is required.
This offer is for business customers only, within the meaning of § 14 BGB. The form asks you to confirm this separately; if you are a consumer, please do not submit it.
4. Stripe, licence register and licence delivery
When you buy a Business or Service Provider licence, purchasing runs through Stripe Payment Links and Stripe Checkout, operated by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland, acting as our processor under Art. 28 GDPR for payment processing (Art. 6(1)(b) GDPR: performance of the purchase contract). Stripe collects and processes the billing details you enter at checkout (company name, billing address, VAT ID, email address for the licence key, and payment details) directly; we do not see or store your card or SEPA mandate details ourselves. See Stripe's own privacy policy for how Stripe itself processes that data.
The order (company, VAT ID, edition purchased, amount, payment method, the installation ID you supplied, the recipient email address for the licence key, and the licence terms version you accepted) is recorded in a licence register we operate ourselves (Art. 6(1)(b) GDPR). Depending on how approval is configured, a notification with these order details may be sent internally to review the order before the licence key is issued. Once issued, the licence key is emailed to the address you provided, from our own mail infrastructure (licence@osirisbackup.com), together with a link to the installation guide. If a payment is later refunded or disputed, we mark the corresponding register entry accordingly and may contact you about it.
Register entries for issued licences are kept for as long as the licence itself could be relevant (support, refunds, accounting and statutory retention obligations under German commercial and tax law), and in any case for the statutory retention periods that apply to invoices and business records (typically several years under HGB/AO). This is separate from, and in addition to, the server-log and beta-notification-form retention periods described in sections 2 and 3 above.
5. Hosting
The site runs on a server that IT Systeme Flores UG (haftungsbeschränkt) operates itself, under the brand name "Creo Digital" (hosting.creodigital.de). This is a brand of IT Systeme Flores UG, not a separate company, so no separate data processing agreement with "Creo Digital" is needed. The server itself is rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a German data centre. Hetzner hosts all of the data described on this page as our processor under Art. 28 GDPR (not only technical infrastructure data), under a data processing agreement we have entered into with Hetzner. Your data is not transferred outside the EU as a result of Hetzner's hosting.
6. Fonts, embedded content and local browser storage
This site loads fonts (Inter Tight, IBM Plex Mono), images and scripts exclusively from our own server. There are no connections to Google Fonts or any other font service, content-delivery network, analytics or tracking service, and no cookies. Your visit is therefore not reported to any third party.
osirisbackup.com (this site) stores one entry,osirisLangSuggestionDismissed (value 1), in your browser's local storage. The English home page (/) shows a small, dismissible bar suggesting the German or Spanish version when your browser is set to one of those languages; this entry is written only once you dismiss that bar or follow its link, so it is not shown to you again. It is never written automatically on page load. It never leaves your browser, identifies or tracks you, and can be removed at any time by clearing this site's data. Legal basis: it is technically necessary to carry out the setting you explicitly requested (§ 25(2) no. 2 TDDDG), not consent.
docs.osirisbackup.com (the documentation) stores a small amount of technical data in your browser's own local and session storage (never cookies): which color theme you picked, and, only for the current browser tab, which sidebar sections you had open and your scroll position, so navigating back does not lose your place. This is not used to identify or track you, is never sent to our server or anyone else, and the session data clears itself when you close the tab. We rely on it being technically necessary for navigating the site you asked for (§ 25(2) no. 2 TDDDG), not on consent.
7. SSL/TLS encryption
This site is reachable only over an encrypted HTTPS connection (TLS); an unencrypted request is automatically redirected to HTTPS. You can recognise an encrypted connection by the lock icon in your browser and by the address bar starting with "https://".
8. Outbound links
This site links to our documentation (docs.osirisbackup.com) and, once published, to the Osiris source code on GitHub. The operator of each linked site is responsible for data processing there.
9. Your rights
Under the GDPR, you have the right to:
- access the data we hold about you (Art. 15)
- have inaccurate data corrected (Art. 16)
- have your data erased (Art. 17)
- restrict processing (Art. 18)
- data portability (Art. 20)
- object, at any time and without formal requirements, to processing based on Art. 6(1)(f) (Art. 21)
- withdraw any consent you have given, at any time, with effect for the future and without affecting processing already carried out (Art. 7(3))
- lodge a complaint with a data protection supervisory authority; for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf,ldi.nrw.de/kontakt(Art. 77)
We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Changes
We update this policy whenever processing changes, for example once a sign-in area or a live demo is added. The version published at the time of your visit applies.