1 Controller and contact
1.1 The controller for the activities identified in this notice is Olive Robotics GmbH, Daimlerstraße 7, 85521 Ottobrunn, Germany, registered at Amtsgericht München, HRB 281200, VAT identification number DE358511336, represented by Managing Director Dr.-Ing. Mojtaba Karimi.
1.2 For privacy questions and requests, email contact@olive-robotics.com with the subject Privacy, write to the address above or telephone +49 155 6335 0077. General enquiries may also be sent to info@olive-robotics.com. These contact details reach the company; they do not represent an assertion that a statutory data protection officer has been appointed. Where a designated officer or representative is required, the relevant contact details must be included in the released notice or the applicable service-specific notice.
1.3 We respond through a suitable channel and may request proportionate information to verify identity or authority where necessary. Do not send identity documents, passwords, health information or other sensitive data unless requested through an appropriate secure process.
2 Scope and different processing roles
2.1 This notice covers visitors to Olive-operated websites and documentation, business contacts, prospective and existing customers, suppliers, applicants, event participants, support users, developer-resource users and persons whose data are supplied in connection with those activities. A more specific notice at a collection point supplements this one for that particular activity.
2.2 Most Olive sensor and robotics kits are supplied for professional research, development, evaluation and integration. Local operation by a customer does not automatically mean that Olive receives the resulting data. Where the customer decides why and how to collect images, locations, sensor streams or personnel data in its own environment, the customer is normally responsible for that processing. Its notice and legal basis are required independently of ours.
2.3 If Olive processes customer personal data solely on documented customer instructions, Olive acts as processor under the agreed data processing agreement. Requests concerning that data should normally be made to the customer controller. If they reach Olive, we direct or assist the request as required, without independently disclosing customer-controlled data to an unauthorised person.
2.4 Olive may also be an independent controller for its own account administration, business records, security, legal compliance or handling of a customer inquiry. The same commercial relationship can therefore involve different roles for different operations. A contractual label does not determine the role if the actual purposes and decisions differ. Joint control, if present for a particular activity, requires a corresponding arrangement and information about its essential allocation of responsibilities.
2.5 A customer remains responsible for personal data processing it independently determines in its experiments, premises, applications or final system, including the necessary notices, legal bases, access permissions, retention and safeguards. A development-kit designation does not exempt that processing from the GDPR. Olive is responsible for the processing it actually controls or carries out as processor. These roles follow Articles 4, 24, 26 and 28 GDPR and the facts; a contract cannot reassign a controller role contrary to those facts.
3 Categories and sources of personal data
3.1 Identity and contact information can include name, business address, email, telephone number, employer, department, role, country and authorised signatory details. Account information can include user identifiers, permissions, authentication records and credential-management information. We do not ask users to send plaintext passwords in ordinary correspondence.
3.2 Commercial information can include enquiries, quotes, purchase orders, delivery addresses, order history, payment references, bank-account details where relevant, tax identifiers, invoices, service entitlements and contract correspondence. Information about an organisation can be personal data when linked to an identifiable contact or sole trader.
3.3 Technical and usage information can include IP addresses, timestamps, request paths, browser and operating-system details, errors, security events, consent preferences and, where an optional analytics service is lawfully enabled, page interactions and pseudonymous identifiers. Cookie and device-access rules apply even where a stored item is not itself personal data.
3.4 Product and support information can include serial numbers, firmware versions, network configuration, license identifiers, crash reports, ROS bags, sensor streams, logs, calibration data, maps, images, video, thermal imagery, approximate or precise location, and diagnostic correspondence. These categories are processed only where they are actually transmitted to us, made available for authorised support or generated in an Olive-controlled service. They are not all collected merely because a customer owns a kit.
3.5 Recruitment and event information can include a CV, qualifications, employment history, portfolio, availability, business interests, registration details, attendance, correspondence and requested accommodations. Special-category information, such as health data, requires an additional lawful condition and should be limited to what is necessary for the specific purpose.
3.6 We receive data directly from the individual, from the organisation they represent, from an authorised reseller or business partner, and from service providers involved in the relevant transaction. We may obtain relevant business contact details from a professional profile, company website, trade-fair introduction or public register. Public availability does not make unrestricted reuse lawful.
3.7 When we obtain personal data indirectly, the information required by Article 14 GDPR is provided within the applicable period, normally no later than one month, the first communication or the first disclosure, whichever is relevant, unless a statutory exception applies. The source and the categories are explained in the relevant communication. This notice is not a substitute for identifying an actual source when that information is required.
4 Legal bases and purpose limits
4.1 We use Article 6(1)(b) GDPR when processing is necessary to take steps requested by an individual before entering a contract with that individual or to perform that contract. For employees and representatives of a corporate customer who are not themselves contracting parties, necessary business communication is normally based on Article 6(1)(f), not automatically on Article 6(1)(b).
4.2 Article 6(1)(f) permits processing necessary for a legitimate interest when the individual's interests and rights do not override it. The relevant interests can include responding to enquiries, managing professional relationships, providing secure systems, preventing fraud, resolving disputes and maintaining necessary business records. We assess necessity and the effect on individuals rather than treating a general business interest as authority for any processing.
4.3 Article 6(1)(c) applies to processing required by a legal obligation, for example applicable tax, commercial-record, product-safety, export-control or court requirements. The obligation and its scope depend on the activity. It does not justify collecting every available detail about a person.
4.4 Article 6(1)(a) applies where consent is required or chosen for a specific optional purpose, such as non-essential analytics or newsletter registration. Section 25 TDDDG separately governs storing information on, or accessing information from, terminal equipment. A legitimate interest under the GDPR does not replace required terminal-equipment consent.
4.5 Recruitment processing is assessed under § 26 BDSG where applicable and the relevant GDPR provisions. Special-category data require an applicable Article 9 condition in addition to an Article 6 basis; criminal-conviction data are subject to Article 10. Where legally appropriate, explicit consent or processing necessary for legal claims may apply to a specific limited operation. These categories are not routinely required for product enquiries.
4.6 We do not change from consent to a different basis merely to defeat a valid withdrawal. Further use for a different purpose requires a lawful compatibility assessment or a separate basis and the required advance information. Research, statistics and anonymisation are not blanket exemptions from these requirements.
5 Website delivery hosting and security
5.1 When a browser requests a page, the hosting infrastructure processes the connection and request information needed to deliver it. Security and error records can include IP address, time, requested resource, response status, referring page where transmitted and technical client information. The purposes are reliable delivery, fault diagnosis and protection against abuse. The normal GDPR basis is Article 6(1)(f), with the legitimate interest in operating a secure business website.
5.2 Our website and documentation workflows use web-publishing and hosting infrastructure. Where WordPress-related services or AWS infrastructure are involved, their role depends on the actual deployment. The service register identifies the hosting recipients and locations for the relevant service. A locally installed publishing plugin is not automatically an external recipient, while an externally loaded asset or telemetry call may create a disclosure.
5.3 Security processing may include limited access logs, rate limiting, authentication checks and investigation of an identified incident. Security records must be retained only for the period justified by operational need, with longer restricted retention for a documented incident, legal duty or claim. Logs must not be silently repurposed into optional marketing profiles.
5.4 Ordinary log retention is determined by the time needed to detect and investigate relevant failures and threats, the sensitivity of the recorded data, incident evidence needs and legal requirements. Indefinite retention solely in case something might happen is not authorised by this notice.
6 Cookies device storage and external content
6.1 A cookie, browser storage item, pixel, fingerprint or similar mechanism can store or access information on a user's device. Necessary operations can include maintaining a requested login, a requested cart, security functions essential to the requested service and remembering a privacy choice. The applicable exception under § 25(2) TDDDG must be assessed for the particular operation; calling a technology essential is not sufficient.
6.2 Optional analytics, marketing tags, cross-site tracking and optional third-party media that require consent must remain disabled until an affirmative choice. Continuing to browse, silence, a preselected control or acceptance of general terms is not consent. Refusing optional processing must leave the core service available unless a separately assessed lawful model applies.
6.3 The consent interface must offer clear purposes and recipient information, accessible accept and reject options, and a way to change or withdraw the choice as easily as giving it. A Cookie settings control should remain available on the website. Withdrawal takes effect for future optional processing and does not make past lawful processing unlawful.
6.4 The service register shown with the consent interface identifies the active technologies or cookie names, providers, purposes, categories, durations, device access, data recipients and relevant transfer information. That service-specific information forms part of this notice. A configuration change requires a corresponding notice and, where necessary, fresh consent before activation.
6.5 Ordinary external links are distinct from embedded content. A video, map, calendar, font, CAPTCHA or social widget may disclose technical information before a user clicks it if it loads directly from another provider. Where required, we must use a consent-gated or otherwise lawful configuration. Browser privacy controls and legally recognised opt-out signals are respected to the extent applicable to the relevant processing; this notice does not claim that a technical integration has been verified when it has not.
7 Optional audience measurement
7.1 Where Google Analytics is enabled as an optional audience-measurement service on an Olive page, it may process event information, page use, technical device information and pseudonymous identifiers to produce usage reports. The exact product configuration, recipient entity, data collection, retention and linked services are stated in the relevant service register and consent interface.
7.2 Optional analytics that require device access or personal data consent rely on § 25(1) TDDDG and Article 6(1)(a) GDPR. Analytics must not be triggered simply because a user continues browsing. An IP-masking feature, a server-side relay or a consent-mode setting does not by itself remove all consent and transfer obligations.
7.3 We use the resulting reports for understanding website performance and content use within the disclosed scope. Advertising personalisation, signals across services, remarketing or linking with individual customer records require their own assessment and sufficiently specific information and consent where necessary. They are not authorised by a generic analytics description.
7.4 Users may decline or withdraw analytics consent through the active consent controls. Historical records that must be retained to demonstrate the consent decision are kept separately from analytics use and only as necessary. The applicable analytics retention setting must be published; it is not inferred from a supplier's default.
8 Enquiries quotes orders and payments
8.1 We process contact and transaction details to answer enquiries, assess requirements, issue quotes, conclude and perform orders, arrange shipping, administer licenses, collect payment, handle warranties and meet recordkeeping duties. The bases are Article 6(1)(b) for an individual contracting party, Article 6(1)(f) for necessary organisational contact management, and Article 6(1)(c) for legal records and obligations.
8.2 Necessary information may be disclosed to delivery providers, distributors involved in the transaction, payment providers, banks, tax advisers, accounting services and public authorities where required. We limit disclosures to the relevant function. A delivery provider normally does not need a full technical support history, and a payment provider does not need an unrelated sensor dataset.
8.3 Where an Olive checkout or order-management workflow uses Shopify, the relevant Shopify entity and services receive the order, account, technical and payment-related information necessary for that workflow. Shopify may act as processor for some activities and independent controller for others under its applicable services. Installed apps, payments and analytics require separate identification; use of Shopify alone does not identify every recipient.
8.4 Qonto and accounting workflows involving DATEV, AccountOne or invoice-management providers can process transaction references, contact information, invoice content and legally required financial records. Their actual roles and recipient entities depend on the contracted service. A named software product is not assumed to receive all customer data in every case.
8.5 Export and sanctions screening may require identifying relevant business parties, destination and end use. We use only the information necessary for an applicable legal obligation or a proportionate legitimate compliance interest, assess potential matches and do not assume a person is prohibited based only on nationality or an unverified name match. A product purchase does not automatically make Olive subject to every anti-money-laundering customer due-diligence obligation.
9 Business communication and collaboration
9.1 We process correspondence, meeting details, business contact records and shared documents to conduct our business and manage the relevant relationship. Providers involved in these workflows can include Google Workspace for email and collaboration and Twilio SendGrid for email delivery. Their role and access are limited to the relevant configured service; the service-specific information identifies recipient entities and transfer arrangements.
9.2 Recipient access is limited to personnel and service providers needing the data for the relevant activity. Shared links must be configured for their intended audience. Emailing Olive does not give permission to publish the message, add the sender to unrelated marketing or share confidential technical material with an unrestricted AI service.
9.3 Meeting invitations and scheduling services may process names, contact details, availability, subject and attendance. If an external scheduling or conferencing provider is used, the invitation or collection point must identify it and the applicable notice. A recording, transcription or AI meeting assistant requires advance information and an appropriate lawful basis; it is not enabled merely by joining an ordinary call under these terms.
10 Marketing newsletters and professional outreach
10.1 Optional newsletters and promotional emails are sent on the basis of valid consent unless the narrow existing-customer exception under § 7(3) UWG applies. A professional email address does not remove the email-marketing consent requirement. A trade-fair badge scan, business-card exchange or request for a quotation is not blanket permission for all future campaigns.
10.2 The existing-customer exception requires that the address was obtained in connection with a sale, the marketing concerns our own similar products or services, the recipient has not objected and the required opt-out information was given at collection and with each message. Where those conditions apply, the GDPR basis is normally Article 6(1)(f), with the interest in relevant customer communication. Otherwise we obtain consent.
10.3 Where used, double opt-in records provide evidence of the subscription and can include the request time, confirmation time, notice version and necessary technical information. Tracking whether an individual opens a message or clicks a link is assessed separately and is not assumed to be covered by permission to receive the message.
10.4 You can unsubscribe using the message's mechanism or contact us. Objection to direct marketing is effective without giving a reason. We may keep a minimal suppression record to ensure that the objection is respected and limited evidence needed to establish compliance. Necessary safety notices, invoices and requested service messages remain distinct from promotional messages.
10.5 Postal or telephone outreach is governed by the applicable channel-specific law and GDPR basis. Consumer telephone marketing requires prior express consent; business telephone marketing requires at least the legally necessary presumed consent supported by the specific circumstances. Public contact details are not general marketing authorisation.
11 Support diagnostics and remote access
11.1 When you request support, we process your message, relevant product identifiers, service entitlement and the diagnostic information necessary to address the issue. We may ask for a limited log excerpt, sample dataset or reproduction case. Please remove unnecessary personal data, private keys and third-party secrets. This request does not reduce our duty to protect data we receive.
11.2 Remote access is used only within an authorised support arrangement. Its scope, participants and purpose must be clear. Permissions should be limited and temporary, and access should end when the support task ends. The fact that a product has Ethernet, USB networking, Wi-Fi or a web interface does not itself authorise Olive to connect remotely.
11.3 Product telemetry and optional diagnostic uploads require product-specific information about the fields, frequency, trigger, recipient, purpose, storage and controls. We do not assume that every kit transmits telemetry. Equally, no general statement of offline use or no cloud access is made for all products without a verified architecture.
11.4 Necessary support processing uses the relevant contract or legitimate-interest basis. Processing on behalf of a customer follows its instructions and the data processing agreement. Optional diagnostic sharing for unrelated product improvement requires a separate lawful basis and clear notice; consent is obtained where appropriate or required.
11.5 For returns or repairs, back up needed data and remove unnecessary information where possible. We process residual data only to the extent required for the authorised work, secure handling or legal duties. We do not treat a returned device as permission to inspect all stored customer content.
11.6 For a safety incident, unsafe-use report, suspected prohibited deployment or product claim, we may process the reporter's contact information, affected model and serial number, relevant configuration and version details, incident description, relevant technical logs, correspondence, measures taken and information needed to assess the claim. The purposes are investigation, necessary corrective action, legal compliance and the establishment, exercise or defence of legal claims. The basis is Article 6(1)(c) GDPR where a specific legal obligation requires the processing and Article 6(1)(f) for necessary product-security, safety and legal-claims interests, subject to the individual's interests and rights. A request does not authorise unrestricted access to a customer's site or entire dataset.
11.7 Incident information may reveal injuries or other special-category information. Such information is processed only where a separate Article 9 GDPR condition applies, for example Article 9(2)(f) for necessary legal claims, and with proportionate safeguards. Do not send unrelated medical records or identities of bystanders when a less intrusive account is sufficient. Recipients may include appropriate technical personnel, external experts, legal advisers, insurers and competent authorities where necessary and lawful. An insurer or adviser is not automatically a processor; its actual role governs.
11.8 We retain an incident or claim record for the period justified by the relevant investigation, legal obligation and limitation or preservation requirements. Relevant evidence may need retention beyond the ordinary support-ticket period, while unnecessary raw data should be removed earlier. A legal hold must be tied to a concrete purpose and restricted access, not a general indefinite retention of all customer telemetry.
12 Sensor data research and artificial intelligence
12.1 Acceleration, angular velocity, orientation, vibration, images, thermal patterns, radar returns, motion paths and environmental data can be non-personal in one context and personal in another. Linking them with an operator, badge, location, household or identifiable person can bring them within data protection law. Pseudonymisation reduces risk but does not necessarily make data anonymous.
12.2 A customer conducting research is responsible for the lawful collection and use of data within its own project. Before transferring a dataset to Olive, the parties must establish the purpose, roles, permitted uses, affected persons, rights, security and retention. A general development-kit purchase does not grant a right to use recordings of employees, customers or bystanders for model training.
12.3 Training, fine-tuning, validation or benchmarking on customer-provided personal data requires a documented lawful basis and purpose-specific arrangement. Customer support content and uploaded logs are not licensed for unrelated general-purpose training through this notice. If a separately agreed research project uses data for model development, the project information must explain whether trained artefacts may retain personal information and how withdrawal or other rights affect future processing.
12.4 Business AI tools, including OpenAI services, may support specifically approved internal workflows. This does not mean that all customer messages, source code or sensor datasets are sent to them. Before any personal data are provided to an AI provider, Olive must assess necessity, the contracted product, recipient role, data-use terms, retention and transfers and provide the required specific information. Confidential or sensitive data must not be placed in an unapproved workflow.
12.5 Truly anonymised statistical information falls outside the GDPR, but creating it from personal data is itself processing requiring a lawful basis. We assess the risk of re-identification before treating a dataset as anonymous. A claim that a dataset is anonymised is not based solely on removing names.
13 Events demonstrations and media
13.1 Registration and attendance information are used to organise the requested event, provide joining details and address practical requirements. The normal basis is the relevant contract or pre-contract request, or a legitimate interest in organising professional events. A co-host or event platform is identified for the particular event rather than assumed from this general notice.
13.2 Photography, video, livestreaming and publication require a separate assessment and clear information at the event. Where consent is relied on, refusal or withdrawal must be practicable. A registration does not itself authorise unrestricted use of a person's portrait or voice in marketing. Rights under applicable image and personality law are considered in addition to the GDPR.
13.3 Health or accessibility information is collected only to the extent necessary for the requested accommodation and under an appropriate Article 9 condition. Access is limited to persons arranging that accommodation. It is not added to ordinary sales profiles.
14 Applications and recruitment
14.1 We process application information to assess suitability, communicate with the applicant and make recruitment decisions under the applicable employment-data provisions. Information may be reviewed by the persons involved in recruitment and necessary service providers. We ask only for information relevant to the role and process special-category data only where a lawful condition applies.
14.2 If an application does not lead to employment, records are retained for the limited period needed to conclude the process and address potential claims, normally up to six months after the final decision under this notice. Longer retention for a talent pool requires a separate arrangement, normally optional consent specifying its period. A live dispute can justify restricted retention beyond the ordinary period.
14.3 A successful application may become part of the employment record, governed by the relevant employee privacy information. This public notice does not replace a complete employee notice or works-council arrangements. Any automated screening or profiling must be separately assessed and disclosed before use.
15 Social media and public developer platforms
15.1 When you interact with Olive on LinkedIn, YouTube or GitHub, we process visible profile information, comments, messages and related interaction information to respond and maintain our professional presence. The basis is normally Article 6(1)(f), with the interest in business communication, or the basis appropriate to a requested contractual step.
15.2 The platform provider separately processes account, device and usage information under its own notice. Users should consult the relevant platform settings and notice. A public post may be accessible worldwide and copied by others. Please avoid posting personal information or confidential technical data in public issues or comments.
15.3 Where the configuration of a page or insights feature creates joint responsibility, the applicable arrangement and its essential allocation is identified in the applicable platform-specific information. General wording cannot determine that role in every case. Individuals may contact Olive concerning processing for which it is responsible and may also exercise rights against the relevant provider.
15.4 Linking a platform from the website is distinct from loading its tracking technology or embedded player. Any required consent must be obtained before the relevant embedded transfer. A user following an external link should expect the destination's own processing to apply.
16 Recipients and disclosures
16.1 Within Olive, authorised personnel receive personal data only where needed for their duties. External recipient categories include hosting and infrastructure providers, email and collaboration providers, commerce and payment providers, delivery companies, support and security suppliers, accounting and tax advisers, legal advisers, auditors and authorities with a lawful entitlement. Which recipients apply depends on the actual interaction.
16.2 Where a provider processes on our behalf, we require the appropriate Article 28 agreement and assess security and any subprocessing. Independent controllers process under their own responsibilities. A contract with a provider does not by itself establish that every transfer or use is lawful.
16.3 In financing, due diligence, restructuring or a business sale, limited information may be disclosed to advisers and potential counterparties where necessary and lawful, normally on a legitimate-interest basis with confidentiality and minimisation. Customer datasets and personnel records are not automatically disclosed wholesale. Any resulting change of controller requires the relevant information and safeguards.
16.4 We may preserve and disclose information required for a legal obligation, proportionate fraud investigation or legal claim. A third party's request alone does not establish an entitlement. Where lawful, we assess scope, necessity and the opportunity to notify affected individuals.
16.5 This notice does not grant a right to sell personal data or disclose them for unrelated advertising. Whether a particular advertising or platform arrangement constitutes a sale or sharing under another jurisdiction must be assessed against its legal definition and actual configuration, rather than inferred from the absence of a cash payment.
17 Transfers outside the EEA
17.1 Service providers, their support teams or counterparties may process data outside the European Economic Area. Remote access from another country may itself be relevant. The service-specific information identifies the destination countries and the applicable transfer mechanism for the relevant service, including relevant onward transfers.
17.2 Where an applicable European Commission adequacy decision covers the recipient and processing, we may rely on it. For the United States, reliance on the EU-US Data Privacy Framework requires the actual recipient to be actively certified and the transfer to fall within its scope. Merely using a US brand does not establish valid certification, and an EU establishment does not prove that all data remain in Europe.
17.3 Otherwise an appropriate safeguard may include the applicable Commission Standard Contractual Clauses with the correct modules, assessment of the destination's law and practice and supplementary measures where necessary. Where adequate protection cannot be achieved, the transfer must not proceed on that mechanism. Limited statutory derogations are assessed narrowly and are not a routine replacement for safeguards.
17.4 You may request information about the applicable safeguards or a copy through the privacy contact. Necessary redactions may protect confidential information and third-party rights without preventing meaningful understanding of the safeguards. Consent to optional analytics does not automatically constitute explicit consent to an otherwise unlawful transfer.
18 Retention deletion and evidence
18.1 We retain personal data only while necessary for the identified purpose, an applicable legal obligation or a specific legitimate legal-claims need. We consider the nature of the record, the relationship, limitation periods, product-safety traceability, sensitivity and whether a smaller record is sufficient. Different copies and systems may have different lawful purposes.
18.2 Under the applicable German recordkeeping rules, books and certain accounting records are generally retained for ten years, accounting vouchers and invoices generally for eight years, and commercial correspondence generally for six years. The correct category and statutory commencement, normally the end of the relevant calendar year, must be applied. Tax proceedings, other specific legislation and lawful preservation requirements can extend a period. Not all personal data are retained for ten years.
18.3 Ordinary enquiry and business-relationship records are retained while the matter is active and, where needed, for the relevant claims or commercial-record period. The usual German limitation period for many contractual claims is three years calculated under the statutory rules, but this is not a universal deletion rule for every record. Irrelevant attachments and excessive data should be removed earlier.
18.4 Support datasets are retained while needed to resolve the issue and for a justified evidence or follow-up period. The service-specific retention schedule distinguishes a small ticket record from a large raw recording. Raw diagnostic data must not be retained indefinitely merely because a ticket may be relevant later.
18.5 Account information is retained for the active account and necessary closure, contractual and statutory purposes. Consent evidence and suppression information may remain for a limited compliance period after withdrawal; they are not reused for marketing. Applicant retention is addressed in section 14. Cookie, analytics and ordinary log periods must match the active service register.
18.6 Legal holds are limited to information reasonably necessary for the identified proceeding or duty and reviewed when the basis ends. Backup copies are isolated from ordinary use and deleted through the defined backup cycle, with deletion requests re-applied if restoration occurs. A backup is not authority for indefinite active retention.
18.7 Records of contractual acceptance, accepted document version, order reference and authorised business contact may be kept to administer and evidence the contract and enforce or defend rights under Articles 6(1)(b), 6(1)(c) or 6(1)(f) GDPR as applicable to the actual person and purpose. We collect only necessary evidence; a business-to-business acceptance record is not permission for behavioural profiling or unrelated marketing.
19 Security and incident handling
19.1 We apply technical and organisational measures appropriate to the processing and risk, including proportionate access controls, secure transmission, account protection, update management and data minimisation. The implemented measures must be documented and maintained. This notice does not promise a particular security certification, perfect security, encryption of every historical record or a completed audit that has not occurred.
19.2 Internet transmission and electronic storage cannot be guaranteed free from all risk. That fact does not remove our statutory security obligations or liability. For sensitive material, contact us for an appropriate exchange method rather than sending it to a public support forum.
19.3 We assess suspected personal data breaches and make notifications to supervisory authorities and affected individuals where required by Articles 33 and 34 GDPR. Where acting as processor, we notify the controller without undue delay under the applicable agreement. Product-cybersecurity reporting and personal data breach reporting can both apply; one does not replace the other.
20 Your rights
20.1 Subject to the statutory conditions, you may request access to your personal data and a copy; correction of inaccurate information; erasure; restriction of processing; and portability of data you provided where processing is automated and based on consent or contract. Portability is not a right to all internal analyses, trade secrets or another person's data.
20.2 Where we rely on Article 6(1)(e) or (f), you may object on grounds relating to your particular situation. We then stop the affected processing unless the legal conditions for continuing it are met, including compelling legitimate grounds overriding your interests or the establishment, exercise or defence of legal claims.
20.3 You may object to direct marketing at any time, including associated profiling. We will stop processing for that purpose. You do not need to give a reason and incur no charge beyond ordinary communication costs. This right is distinct from an objection that requires assessment of your particular circumstances.
20.4 You may withdraw consent at any time with effect for the future. Withdrawal does not affect processing before withdrawal that was lawful. Refusing optional consent does not make an otherwise available core service conditional on unrelated tracking.
20.5 Contact us using section 1. We normally respond without undue delay and within one month of receiving a request. Where legally permitted because of complexity or number, that period may be extended by two further months; we inform you within the first month and explain why. A month is not invariably 30 days. Requests are normally free; a lawful exception for manifestly unfounded or excessive requests requires justification.
20.6 Identity verification is proportionate to the risk. An authorised representative may act with appropriate authority. We explain any refusal or limitation and available complaint or judicial remedies as required by law. We do not require a non-disclosure agreement, marketing consent or waiver of claims as a condition for exercising privacy rights.
21 Supervisory complaints
21.1 You may complain to a competent data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the place of an alleged infringement. You do not have to contact Olive first.
21.2 The authority generally responsible for a Bavarian private-sector company is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany. Website: https://www.lda.bayern.de. Its complaint service is at https://www.lda.bayern.de/de/beschwerde.html. The authority determines its competence in the particular matter.
22 Required information children and automated decisions
22.1 Information necessary to answer a request, conclude a contract, ship a product, administer access or comply with a legal obligation must be provided if you want that activity to proceed. We identify mandatory fields or explain the requirement at collection. Optional marketing, unrelated telemetry or an unnecessary date of birth are not automatically required for an ordinary business enquiry.
22.2 The professional product and account offering is not directed to children. If a child participates in a school or research activity, the responsible institution and Olive must establish an appropriate lawful process for the actual activity. We do not infer that a person over 16 can enter every commercial contract or that parental consent cures every processing issue.
22.3 Any solely automated decision producing legal or similarly significant effects requires the Article 22 assessment and the relevant information and safeguards before use. Under the processing described by this notice, orders, support and recruitment are handled with human decision-making and are not subject to a solely automated decision producing legal or similarly significant effects. Introducing such a process requires separate information about the relevant logic, significance, expected consequences and safeguards, and a lawful basis before it starts.
23 International users
23.1 GDPR protections apply within their territorial scope. Where the UK GDPR and related UK law apply, the applicable UK rights, transfer requirements and complaint route to the Information Commissioner's Office also apply. UK transfers may require a UK adequacy rule, approved agreement or UK addendum rather than relying solely on an EU instrument. Information is available at https://ico.org.uk.
23.2 Where Swiss data protection law applies, the relevant transparency, access, correction, objection and cross-border disclosure requirements are respected. Individuals may contact the Swiss Federal Data Protection and Information Commissioner through https://www.edoeb.admin.ch. Applicable Swiss transfer safeguards and disclosures must be assessed separately.
23.3 US state privacy rights apply when their territorial, business and processing thresholds are met. Depending on the applicable law, they can include access, correction, deletion, portability, opt-outs for sale, sharing, targeted advertising or specified profiling, limitation of certain sensitive-data uses, appeal and non-discrimination. Requests may be sent to the contact in section 1. Legally recognised authorised agents and opt-out preference signals are handled as required.
23.4 This general international section is not a representation that Olive meets or falls below every US statutory threshold. If a California or other state-specific notice is required, it must include the actual categories, purposes, recipients, retention criteria, look-back disclosures, request methods and relevant opt-out controls. No unsupported claim is made that no sale, sharing or third-party disclosure occurred in the preceding twelve months.
23.5 Other mandatory local protections are not waived by use of our website or by a German choice-of-law clause. Additional local notices or representation may be necessary for a specifically targeted market; this notice is not a certification of compliance in every jurisdiction.
24 Changes and service specific information
24.1 We update this notice when processing or legal requirements change. The released version states its effective date. Material changes are brought to attention through an appropriate channel before the affected processing where required. Posting a notice does not authorise a new incompatible purpose or replace a fresh consent that is legally necessary.
24.2 Read this notice together with the cookie and service information, product telemetry disclosures and event notices made available at the relevant collection point. A specific customer data processing agreement governs processing on behalf of that customer. Contact us if you need clarification about the service you use or cannot access its supplementary information.
24.3 Product-use restrictions and commercial liability provisions do not waive your privacy rights, access to a supervisory authority or the judicial remedies and compensation rights provided by the GDPR. This notice is a transparency document, not a consent to all processing or a contractual release. References to Articles 77 to 82 GDPR preserve the applicable complaint, remedy and responsibility framework.
