DPA

The controller responsible for the processing of personal data described in this Privacy Policy is:

Stefan Kneisel trading as PureVision Digital

6 Croftwell Drive

Dublin 24

D24 EY9D

Ireland

CRO Business Name Registration Number: 791088

Email: hello@purevisiondigital.com

Website: purevisiondigital.com

PureVision Digital is operated as a sole trader established in Ireland.

2. Scope of this Privacy Policy

This Privacy Policy explains how PureVision Digital collects, uses, stores and otherwise processes personal data in connection with its website, enquiries, prospective customers, business customers, suppliers, professional contacts and the provision of its services.

PureVision Digital primarily provides services to businesses.

This Privacy Policy primarily applies where PureVision Digital acts as a data controller.

Where PureVision Digital processes personal data on behalf of a Client as part of an Odoo implementation, migration, integration, support service or other project, the Client will generally remain the controller and PureVision Digital may act as a processor. Such processing is governed by the relevant Client agreement and, where required, a Data Processing Agreement under Article 28 GDPR.

3. Personal Data We May Process

Depending on the way you interact with PureVision Digital, we may process:

name;

business name and employer;

job title or business function;

business address;

email address;

telephone number;

information contained in enquiries and correspondence;

meeting and appointment information;

project requirements;

quotations, proposals and contracts;

customer and supplier records;

invoice, payment and accounting information;

Odoo user and project information;

technical support information;

system access information where required for a project;

IP addresses and technical website information;

server and security logs;

documents and files supplied in connection with a project;

and other information voluntarily provided to PureVision Digital.

Where necessary for the delivery of an agreed Client project, PureVision Digital may also process personal data relating to the Client’s employees, customers, suppliers or other business contacts on behalf of the Client.

4. Purposes and Legal Bases

PureVision Digital processes personal data only where there is an appropriate legal basis under applicable data protection law.

We may process enquiries and prospective customer information in order to respond to requests, prepare quotations, discuss projects and take steps prior to entering into a contract.

The legal basis is generally Article 6(1)(b) GDPR where the processing is necessary to take steps at the request of a person prior to a contract, or Article 6(1)(f) GDPR where we have a legitimate interest in responding to business enquiries and developing our business relationships.

We process Client contact and project information in order to provide agreed services, administer projects, provide support, communicate with Clients and manage our contractual relationships.

The legal basis is generally Article 6(1)(b) GDPR and, in relation to contact persons acting on behalf of corporate customers, Article 6(1)(f) GDPR.

We process invoices, transaction records and accounting information in order to manage our business and comply with tax, accounting and other legal obligations.

The legal basis is Article 6(1)(c) GDPR and, where applicable, Article 6(1)(f) GDPR.

We may process technical and security information in order to protect our systems, prevent misuse, diagnose faults and maintain the security of our website and infrastructure.

The legal basis is generally Article 6(1)(f) GDPR based on our legitimate interest in operating secure and reliable systems.

Where processing is based on consent, the legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

5. Odoo

PureVision Digital uses Odoo as a CRM, ERP and business management platform for purposes that may include customer relationship management, project management, quotations, business records, service administration, invoicing and related business processes.

PureVision Digital does not use Odoo Online or Odoo.sh to host its primary Odoo production database.

The PureVision Digital Odoo environment is self-hosted on infrastructure provided by Hetzner Online GmbH.

The production server is located at Hetzner’s data centre location in Falkenstein, Germany.

Depending on the relevant business process, information stored in Odoo may include:

business contact information;

Client and supplier information;

project records;

quotations and orders;

contract information;

invoice and accounting-related information;

support information;

communications relating to Client projects;

and other information required for managing the business relationship.

Processing within Odoo is based on the legal bases applicable to the underlying business process, particularly Article 6(1)(b), Article 6(1)(c) and Article 6(1)(f) GDPR.

6. Hetzner

PureVision Digital uses infrastructure supplied by:

Hetzner Online GmbH

Industriestraße 25

91710 Gunzenhausen

Germany

Hetzner provides the server infrastructure on which PureVision Digital’s self-hosted Odoo environment operates.

The production Odoo server used by PureVision Digital is located in Falkenstein, Germany.

Personal data stored within the Odoo production environment may therefore be processed on Hetzner infrastructure.

Hetzner acts as a processor in relation to personal data processed on infrastructure provided to PureVision Digital where the requirements of Article 28 GDPR apply.

PureVision Digital maintains the appropriate contractual data-processing arrangements with infrastructure providers as required by applicable data protection law.

7. CloudPepper.io

PureVision Digital uses CloudPepper.io for technical management and operation of its self-hosted Odoo environment.

The relevant service provider is Cloudpepper BV, Belgium.

CloudPepper may provide services such as deployment, monitoring, maintenance, system administration, updates, troubleshooting, technical support and backup management.

In carrying out these activities, CloudPepper may have technical access to personal data stored in the Odoo environment where such access is necessary to provide the services.

CloudPepper acts as a processor in relation to relevant personal data processed on behalf of PureVision Digital.

The primary infrastructure is selected and contracted by PureVision Digital directly from Hetzner. Hetzner is therefore PureVision Digital’s infrastructure provider rather than CloudPepper’s infrastructure sub-processor for this environment.

Backups managed through the CloudPepper setup are stored on Hetzner infrastructure.

CloudPepper may use further service providers in accordance with its applicable Data Processing Agreement and sub-processor arrangements.

8. Google Workspace

PureVision Digital uses Google Workspace for business communication and productivity purposes.

Depending on the service used, this may include Gmail, Google Drive, Google Docs, Google Sheets, Google Calendar and Google Meet.

Personal data processed through Google Workspace may include:

names and business contact information;

emails and email attachments;

calendar appointments;

meeting information;

documents and files;

project information;

business correspondence;

and other information shared through the relevant Google Workspace service.

Google processes relevant customer data in accordance with the contractual terms and data-processing terms applicable to Google Workspace.

Google and its authorised sub-processors may process data in countries outside the European Economic Area where permitted by applicable law.

Where personal data is transferred outside the EEA and an adequacy decision is not available, appropriate safeguards such as the European Commission’s Standard Contractual Clauses may be used in accordance with applicable data protection law.

9. Website and Server Information

When you visit purevisiondigital.com, technical information may be processed automatically by the systems necessary to deliver and secure the website.

This information may include:

IP address;

date and time of the request;

requested page or resource;

browser and device information;

operating system information;

referring page;

HTTP status information;

and security-related technical information.

This information may be processed to deliver the website, maintain system security, detect technical problems, prevent attacks and misuse and maintain reliable operation.

The legal basis is generally Article 6(1)(f) GDPR based on PureVision Digital’s legitimate interest in providing and protecting its website and IT infrastructure.

Website hosting and technical providers may process such information on behalf of PureVision Digital where necessary to operate the website.

10. Cookies and Similar Technologies

The website may use cookies or similar technologies that are technically necessary for its operation and security.

Strictly necessary technologies may be used where they are required to provide a service requested by the user.

Where non-essential analytics, advertising, tracking or comparable technologies are used, they are activated only where the required consent has first been obtained.

Where applicable, visitors can provide, refuse or withdraw consent through the website’s cookie consent mechanism.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

11. Business Communications and Marketing

PureVision Digital may use business contact information to communicate with existing and prospective business contacts about enquiries, ongoing projects, relevant services and business relationships.

Where electronic direct marketing is subject to consent or other requirements under applicable electronic communications law, PureVision Digital will comply with those requirements.

Recipients may object to direct marketing at any time.

Where marketing communication is sent by email, the recipient may use the unsubscribe mechanism provided or contact hello@purevisiondigital.com.

12. Recipients of Personal Data

PureVision Digital does not sell personal data.

Personal data may be disclosed where necessary to:

IT and hosting providers;

Odoo infrastructure and management providers;

Google Workspace and communications providers;

professional advisers such as accountants, tax advisers, solicitors or insurers;

payment and banking providers;

contractors involved in delivering an agreed service;

public authorities where disclosure is legally required;

and other service providers reasonably required for the operation of PureVision Digital.

Service providers that process personal data on behalf of PureVision Digital are subject to appropriate contractual and data-protection obligations where required.

13. International Data Transfers

PureVision Digital seeks to use European infrastructure where reasonably appropriate.

The primary PureVision Digital Odoo production environment is hosted at Hetzner in Falkenstein, Germany.

Some other service providers, particularly global cloud and communications providers such as Google, may process personal data outside the European Economic Area.

Where personal data is transferred to a country outside the EEA that is not covered by an adequacy decision, PureVision Digital relies on appropriate safeguards where required, including Standard Contractual Clauses adopted by the European Commission and supplementary measures where appropriate.

14. Retention of Personal Data

PureVision Digital retains personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, contractual, accounting and regulatory requirements.

Enquiry information that does not result in a Client relationship will be retained only for as long as reasonably necessary for follow-up, business administration and the establishment or defence of legal claims.

Client and project information may be retained for the duration of the Client relationship and for an appropriate period afterwards where required for contractual, legal, professional or evidential purposes.

Invoices, accounting records and other records that must be retained for Irish tax purposes will normally be retained for the statutory retention period applicable to those records.

Irish business tax records are generally required to be retained for six years.

Technical logs are retained only for a period reasonably necessary for security, troubleshooting and system administration unless longer retention is required in connection with a security incident or legal obligation.

Personal data used solely for direct marketing will no longer be used for that purpose after a valid objection or withdrawal of consent, although limited information may be retained where necessary to ensure that the marketing preference continues to be respected.

15. Data Processed on Behalf of Clients

During Odoo implementations, migrations, integrations, support engagements and other technical projects, PureVision Digital may receive access to personal data controlled by a Client.

Examples may include employee information, customer records, supplier information, CRM records, sales information or other information contained in the Client’s systems.

In these situations, PureVision Digital may act as a processor rather than a controller.

PureVision Digital will process such personal data only in accordance with the Client’s documented instructions and the applicable Data Processing Agreement.

Where PureVision Digital uses a sub-processor for such processing, the required contractual protections will be implemented in accordance with Article 28 GDPR.

Individuals seeking to exercise rights in relation to personal data that PureVision Digital processes solely on behalf of one of its Clients should normally direct the request to the relevant Client as controller. PureVision Digital will assist the controller where required by applicable law and the relevant Data Processing Agreement.

16. Security

PureVision Digital takes appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Measures are selected having regard to the nature of the processing, the available technology, implementation costs and the risks presented by the processing.

No internet-based or electronic system can be guaranteed to be completely secure.

17. Your Data Protection Rights

Subject to the conditions and limitations contained in applicable data protection law, you may have the right to:

request access to your personal data;

request correction of inaccurate personal data;

request deletion of personal data;

request restriction of processing;

object to processing based on legitimate interests;

object at any time to processing for direct marketing purposes;

receive certain personal data in a portable format;

and withdraw consent where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Requests may be sent to hello@purevisiondigital.com.

PureVision Digital may request reasonable information to verify the identity of a person making a data protection request.

18. Complaints

If you have concerns about the way PureVision Digital processes your personal data, you may contact PureVision Digital at:

hello@purevisiondigital.com

You also have the right to lodge a complaint with the competent supervisory authority.

For PureVision Digital, the principal supervisory authority is the Data Protection Commission in Ireland.

Further information is available from dataprotection.ie.

19. Changes to this Privacy Policy

PureVision Digital may update this Privacy Policy where its services, systems, service providers or legal obligations change.

The current version will be published on purevisiondigital.com.

The Privacy Policy should be reviewed periodically to ensure that it continues to accurately reflect PureVision Digital’s actual processing activities.