GDPR Compliance

1Our Commitment

OONH is committed to GDPR compliance for all users, including those in the EU/EEA. We process personal data lawfully, fairly, and transparently. We collect only what is necessary, keep it accurate, and retain it only as long as needed.

2Lawful Basis for Processing

• Contract performance — Processing necessary to provide the Platform (account management, billing, service delivery)
• Legitimate interest — Product improvement, security monitoring, fraud prevention
• Consent — Marketing communications (opt-in only), analytics cookies (opt-out available)
• Legal obligation — Tax records, regulatory compliance

3Your Rights Under GDPR

If you are in the EU/EEA, you have the following rights. We respond within 30 days:

• Right of access (Art. 15) — Request a copy of all personal data we hold
• Right to rectification (Art. 16) — Correct inaccurate personal data
• Right to erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing (Art. 18) — Limit how we process your data
• Right to data portability (Art. 20) — Receive your data in a machine-readable format (JSON/CSV)
• Right to object (Art. 21) — Object to processing based on legitimate interest
• Right to withdraw consent (Art. 7) — Withdraw consent for optional processing at any time

4Data Processing Activities

We maintain a Record of Processing Activities (ROPA) as required by Art. 30. Key processing activities include: user account management, workspace data storage, payment processing, email notifications, optional WhatsApp messaging, optional social media publishing, and anonymized analytics.

5Sub-Processors

We use the following sub-processors who may process EU personal data:

• Razorpay (India) — Payment processing
• Cloudinary (US/EU) — Media storage and delivery
• Resend (US) — Transactional email
• Meta Platforms (US/EU) — WhatsApp API, Facebook/Instagram API (optional)
• LinkedIn (US) — Social publishing API (optional)
• Google (US) — Gemini AI content generation (optional, no data retained)

6International Transfers

Where data is transferred outside the EU/EEA, we ensure adequate protection through: Standard Contractual Clauses (SCCs) with sub-processors, adequacy decisions where applicable, and contractual obligations requiring equivalent data protection standards.

7Data Protection Contact

For GDPR-related inquiries, data access requests, or to exercise any of your rights, contact our Data Protection team at [email protected]. You also have the right to lodge a complaint with your local supervisory authority.

8Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours (Art. 33) and affected individuals without undue delay where the breach poses high risk to their rights (Art. 34).