Given our size we are not required to appoint a data protection officer. Data protection questions go straight to the address above.
Your rights
You can exercise all of these free of charge, informally, by email. We answer within one month.
Access (Art. 15 GDPR) You can find out whether we process data about you, and which.
Rectification (Art. 16 GDPR) We have to correct inaccurate data and complete incomplete data.
Erasure (Art. 17 GDPR) You can ask for deletion unless a retention obligation stands in the way.
Restriction (Art. 18 GDPR) Instead of deleting, we can also freeze the processing.
Portability (Art. 20 GDPR) You get your data in a common, machine-readable format.
Objection (Art. 21 GDPR) You can object at any time to processing based on legitimate interests. Here that covers the server log files and Umami.
Withdrawal (Art. 7(3) GDPR) You can withdraw consent at any time with future effect, right from the cookie settings on this page.
Complaint (Art. 77 GDPR) You can complain to a supervisory authority. Ours is the Data Protection Commissioner of North Rhine-Westphalia, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.
How we use your data
Find the purpose, provider, data, retention period, and legal basis for each service below.
Traffic and usage measurement: which pages are viewed and how the callback form is used, including submission attempts and delivery outcomes. Umami works without cookies and without cross-device recognition.
Data
Page viewed, referrer, screen size, browser, operating system, country. Umami derives a pseudonymous session ID from the IP address and browser string; the IP address itself is not stored. URL query parameters and fragments are removed from all page views. Callback-form events contain language, public workflow category, interaction type and delivery outcome; no phone number, monetary amounts, letter or campaign identifiers. We also remove the referrer from these events.
Legal basis
Art. 6(1)(f) GDPR. Our legitimate interest is understanding which content gets read. Because nothing is stored on or read from your device, §25(1) TDDDG does not apply, which is why this script loads before you make a choice in the cookie banner.
Retention
Individual page views stay stored with their session ID until we delete them. No automatic deletion period is configured at the moment.
Transfer outside the EU
No transfer outside the EU or EEA.
PostHog
Only with your consent
PostHog, Inc., via its EU cloud (eu.i.posthog.com), data centre in Germany
Purpose
Product analytics: the paths visitors take through the site, so we can improve pages and calculators.
Data
Pseudonymous visitor ID, pages viewed, timestamps, browser and device details. Page views contain no URL query parameters or referrers. Automatic form capture and session recording are disabled.
Legal basis
Your consent under Art. 6(1)(a) GDPR and §25(1) TDDDG. PostHog does not load without it.
Retention
Up to 12 months. If you withdraw consent, the identifiers stored on your device are deleted immediately.
Company identification: the IP address is used to estimate which company is visiting, so we can approach the right contact. No advertising is served.
Data
IP address, the company and location derived from it, pages viewed, timestamps, referrer.
Legal basis
Your consent under Art. 6(1)(a) GDPR and §25(1) TDDDG. Apollo does not load without it.
Retention
Per the provider's own schedule, see their privacy policy.
Transfer outside the EU
The provider is based in the USA and is certified under the EU-US Data Privacy Framework. The transfer therefore rests first on the European Commission adequacy decision of 10 July 2023, backed by standard contractual clauses under Art. 46(2)(c) GDPR so that it stays covered should the adequacy decision fall away.
OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
Purpose
We measure whether our ChatGPT ads lead to callback requests. With your consent, we report a successfully delivered request to OpenAI. An ad reference (oppref) stays on your device for up to 30 days for this purpose.
Data
Page viewed, referrer, timestamp, browser and device details, truncated or hashed identifiers from the ad click, and a random browser reference. The script can automatically hash filled-in form fields, including the callback form’s phone number, with SHA-256 in the browser and report that hash (automatic advanced matching). Our own conversion event contains no phone number or campaign identifiers.
Legal basis
Your consent under Art. 6(1)(a) GDPR and §25(1) TDDDG. Without it, the ad script does not load or store anything on your device.
Retention
The ad reference (oppref) stays on your device for up to 30 days and the browser reference for up to 365; we delete both immediately when you withdraw. How long OpenAI keeps the reported events is OpenAI’s decision under its own privacy policy.
Transfer outside the EU
OpenAI also processes data in the USA and other countries outside the EEA. OpenAI cites standard contractual clauses under Art. 46(2)(c) GDPR and the UK addendum for these transfers. EU-US Data Privacy Framework certification is not confirmed for this provider.
Processed by us, together with our email provider.
Purpose
Answering your enquiry.
Data
Your email address, your name, and whatever you write to us.
Legal basis
Art. 6(1)(b) GDPR for enquiries about working together, otherwise Art. 6(1)(f) GDPR.
Retention
Until your matter is settled. Business correspondence is subject to commercial and tax retention periods of up to 10 years.
Transfer outside the EU
No transfer outside the EU or EEA.
Rückrufformular
No cookie consent required
Our mailbox runs on our server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
Purpose
We email your callback request to our mailbox to process your enquiry and call you back.
Data
Your phone number, public workflow category and any letter code or campaign identifiers. Your browser sends these details to our website.
Legal basis
Art. 6(1)(b) GDPR: handling your enquiry about working together.
Retention
We keep no record of the request ourselves; our email mailbox follows the usual retention rules and is deleted once your enquiry is settled.
Transfer outside the EU
No transfer outside the EU or EEA.
Storage on your device
We use browser storage for settings and, with your consent, analytics. Only ad measurement uses cookies, also with your consent. The entries and their lifetimes are listed below.
Entry: cookie-consent-v4
Stores your choice in the consent banner so we do not ask again on every visit.
Lifetime: Until you clear your browser storage.
Entry: theme
Remembers whether you picked the light or dark appearance.
Lifetime: Until you clear your browser storage.
Entry: olio.pflichtenheft.draft.v1
Keeps your draft in the requirements generator from being lost on reload. The content stays on your device and is not transmitted to us.
Lifetime: Until you reset the draft or clear your browser storage.
Entry: ph_*
PostHog pseudonymous visitor ID. Set only with your consent and deleted immediately when you withdraw it.
Lifetime: Until you withdraw your consent.
Entry: __oppref (Cookie)
Reference to the ChatGPT ad you arrived from. It is appended to the landing page address and stored here so a later enquiry can be attributed to that ad. Set only with your consent and deleted immediately when you withdraw.
Lifetime: 30 days, or until you withdraw your consent.
Entry: __obref (Cookie)
A random browser reference for ad-conversion measurement. It carries no information about you. Set only with your consent and deleted immediately when you withdraw.
Lifetime: 365 days, or until you withdraw your consent.
Entry: __oaiq_consent (Cookie) und oaiq_consent
The ad script’s own record of your consent, once as a cookie and once in local storage. It is what stops events being sent after you withdraw.
Lifetime: 30 days, or until you withdraw your consent.
Entry: oaiq_cs:* (sessionStorage)
A short-lived note the ad script keeps for the duration of your visit, recording whether this was your first page view in the session. It ends when you close the tab.
Lifetime: Until you close the tab.
Fonts and images
Fonts load from our own server, not Google Fonts or another font CDN. Loading fonts does not send your IP address to a font provider.
Our presence on LinkedIn
We also have a LinkedIn company page. LinkedIn does not load on this website. For visitor statistics on our LinkedIn page, we and LinkedIn share responsibility.
We run a company page on LinkedIn to show what we do and to talk to people who are interested. Nothing from LinkedIn loads on olio.solutions itself: our links there are ordinary links, and a connection is only made once you click one.
Data
When you visit our LinkedIn page, LinkedIn processes your interactions (content viewed, clicks), device details (IP address, operating system, browser, language setting, cookie data), and profile details (job function, country, industry, seniority, company size). All we receive from that is aggregated statistics, no individual records and no names.
Legal basis
Art. 6(1)(f) GDPR. Our legitimate interest is presenting our company and understanding which posts land.
Retention
The statistics reach us only in aggregate and over the periods LinkedIn sets. How long LinkedIn keeps the underlying data is LinkedIn's decision.
Transfer outside the EU
LinkedIn Ireland is based in the EU. Passing data on to its US parent, LinkedIn Corporation, is LinkedIn's responsibility alone; it relies on the adequacy decision for the EU-US Data Privacy Framework, backed by standard contractual clauses.
Who is responsible
We are jointly responsible with LinkedIn Ireland for collecting this data and passing it to LinkedIn (Art. 26 GDPR). Everything LinkedIn does with it afterwards is LinkedIn's responsibility alone. You can exercise access, erasure, and objection with us or directly with LinkedIn; going to LinkedIn is faster, because the individual records only exist there. None of this limits the rights listed above.
We use the following measures to protect your data under Art. 32 GDPR.
Encrypted transport
Every connection to olio.solutions runs over HTTPS (TLS). Requests over unencrypted HTTP are redirected to the encrypted address automatically, and the certificates renew themselves continuously.
Where the servers are
The site and its log files sit with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, inside the EU. Rotated access logs are deleted after 30 days.
Collect little rather than guard a lot
This site has no user accounts or payment function. We store callback requests in a database we operate, hosted by Hetzner. Page views and callback-form events without contact details or monetary amounts are stored in our own Umami database. We set cookies only with your consent, for ad-conversion measurement.
Recognition only after consent
Services that store or read something on your device only load once you have agreed in the banner. If you withdraw, the entries they left are deleted immediately and the page reloads so that already-loaded scripts stop too.
Limited access
Only the people who need it to run the site have access to the servers and the analytics.
Change your choice
You can review or withdraw your consent at any time with effect for the future.
Changes to this policy
We update this policy when our services or data practices change. The date below shows the latest update.
Last updated: October 6, 2026
Let's Talk
Automation, AI, infrastructure or a software idea? Leave your phone number and we will call to discuss what you need.
Prefer to contact us directly? Write to us or give us a call.
Olio on LinkedIn
Our presence on LinkedIn
We also have a LinkedIn company page. LinkedIn does not load on this website. For visitor statistics on our LinkedIn page, we and LinkedIn share responsibility.
LinkedIn
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland
Our company pageProvider's privacy policyJoint controller arrangement