Privacy notice (DRAFT)

Controller for the website and pilot requests: The operator's name, seat and contact details are being finalised and will be published here. For customer data in the product Okmand acts as processor; the customer is controller (see the DPA).

What we process and why:

• Pilot request form: name, company, email, message — to answer your request (legitimate interest / steps prior to contract). Kept 24 months, then deleted.
• Website page views (Vercel Web Analytics, public website only, on the Okmand-hosted site): the page address without query string or ids, the referring page, approximate location derived from the IP address (country, region, city), browser, operating system and device type — to see which pages are used (legitimate interest, GDPR Art. 6(1)(f)). No cookies and nothing stored on your device; page views are told apart only by a hash of the request that is discarded after 24 hours. The signed-in app does not use it. Storage period of the page-view records at Vercel: the reporting window of our Vercel plan (Hobby: 1 month, per vercel.com/docs/analytics/limits-and-pricing, checked 15 November 2026). That window is the period Vercel guarantees to keep the records; Vercel may keep them longer (for example so that a plan upgrade keeps them) and publishes no deletion deadline. We do not export or copy the records. Balancing test (Art. 6(1)(f)): the interest is knowing which public pages are read, to improve them; the data is limited to the points above (no cookies, no query strings or ids, no signed-in pages, no profile across sites or days), visitors of a business website can expect such counting, and they may object at any time; on that basis the interest is not overridden. Whether the script's request from the visitor's browser needs consent under ePrivacy Directive Art. 5(3) (Hungarian Eht. 155. § (4)) is pending legal review; until it is settled the analytics stays limited to the public website.
• Self-service sign-up (where it is open; it is off on the review deployment): company name and registration number, your name and work email, and the sign-in email we send — to set up the organisation you asked for (steps prior to contract). If the emailed link is not used within 7 days, all of it is deleted.
• Product accounts: name, work email, role, passkey public keys, signing-certificate subject and fingerprint — to provide the service (contract).
• Approval records: decisions, signatures, timestamps — to provide evidence the customer relies on (customer's legal obligations); retained per the customer's retention settings, never below the legal floors in the retention schedule.
• Security logs without payload content — legitimate interest in security.

Cookies: the website sets none. The app sets the session cookie needed to stay signed in (__Host-okm_session, okm_session on a local installation without HTTPS) and, only while you sign in with your organisation's single sign-on, __Host-okm_oidc (okm_oidc locally), which ties the sign-in to your browser and is deleted when sign-in completes or after 10 minutes. Both are strictly necessary; see the cookie statement.

Recipients and location:

• Website, pilot requests and the review deployment (okmand.hu, okmand.vercel.app; Okmand as controller): hosted by Vercel Inc. (USA; functions run in Frankfurt, fra1; the edge network, request logs and web analytics run on Vercel's global infrastructure, including the USA), with pilot requests and review data in a Neon Postgres database (Neon, USA; data region Frankfurt). Both are US companies, so access from the USA cannot be ruled out; transfer mechanism: EU-US Data Privacy Framework or SCCs, to be confirmed before customers use the site. See the sub-processors list.
• Customer data in the product: hosting provider and region to be decided (EU-only hosting). No customer is hosted yet.

Rights: access, rectification, erasure (personal data in the audit log is erased by destroying its key, the account is anonymised, and stored evidence exports the person made are deleted; signed artefacts under legal retention are kept for that period; while the customer has a legal hold on, erasure waits until it is lifted), restriction, objection (including to the web analytics, which rests on legitimate interest), portability, complaint to the NAIH (Hungarian National Authority for Data Protection and Freedom of Information). The address for these requests will be published here together with the operator's details. Erased data can remain in encrypted backups until they age out (see the retention schedule).