Privacy Policy

1. Roles and scope

Odenaro provides hosted workspaces to businesses. For personal data that customers place in their workspace, the customer generally acts as data controller and Odenaro acts as data processor. Odenaro may act as data controller for account administration, subscription, security, support and service-operation data.

2. Data we process

Depending on the selected product, data may include account and company details, login and security activity, customer and supplier records, invoices, payments, inventory, operational records, support communications and product-specific records. Some products may contain information about children, guardians, attendance, emergency contacts, allergies or medical notes when entered by the customer.

3. Purposes

We process data to provide and secure the service, authenticate users, deliver requested features, manage subscriptions, provide support, prevent abuse, troubleshoot incidents, maintain auditability and comply with applicable legal obligations.

4. Service providers and subprocessors

We use service providers for infrastructure, email delivery, payments and other operational services where required. The current categories and principal providers are listed on our Subprocessors page. Providers receive only the access needed for their service and are subject to applicable contractual and security measures.

5. Security, audit logs and access

We apply technical and organisational measures including access controls, customer-data separation, authentication protections, backups and security-event logging. Critical actions may generate limited audit metadata. Audit logs are not intended to contain sensitive free-text content and are retained separately where needed for integrity, security and dispute resolution.

6. Retention and deletion

Data is retained only for as long as needed for service delivery, contractual, security or legal purposes. Different categories may have different retention periods. Deletion of a business record does not necessarily require immediate deletion of minimal audit metadata where a legitimate security, compliance, dispute-resolution or legal-retention purpose remains. Our Retention Policy provides more detail.

7. International use and local obligations

Odenaro may be used by customers in multiple jurisdictions. Customers are responsible for ensuring they have a lawful basis to enter personal data into the service and for providing notices, obtaining permissions or consents, and meeting local sector-specific requirements where applicable.

8. Rights and contact

Requests relating to data held inside a customer workspace should normally be directed first to that customer as data controller. For Odenaro privacy matters contact info@odenaro.com.