GDPR Compliant

GDPR Compliance

OptiStack is fully committed to the EU General Data Protection Regulation. We embed privacy by design and by default into every aspect of our platform.

Last updated: February 22, 2026 · Effective: February 22, 2026

1. Data Protection Officer

Contact Details

Data Protection Officer
Datatent B.V. (trading as OptiStack)
Amsterdam, Netherlands
Email: dpo@optistack.com

Responsibilities

• Monitoring GDPR compliance across all operations
• Advising on Data Protection Impact Assessments
• Handling data subject rights requests
• Liaising with supervisory authorities
• Overseeing data breach response procedures

2. Data Protection Principles

We adhere to the six principles of GDPR (Article 5) in all our data processing activities.

Lawfulness, Fairness & Transparency

We process personal data lawfully, fairly, and in a transparent manner. Every processing activity has a clearly documented legal basis under GDPR Article 6.

Purpose Limitation

Personal data is collected for specified, explicit, and legitimate purposes. We never process data in a manner incompatible with the original collection purpose.

Data Minimisation

We collect only the minimum data necessary for our stated purposes. We access cloud metadata only — never your actual table data, files, or query results.

Accuracy

We take reasonable steps to ensure personal data is accurate and up to date. You can update your information at any time through your account settings.

Storage Limitation

Personal data is retained only for as long as necessary. We maintain documented retention schedules with automatic purging for expired data.

Integrity & Confidentiality

We implement appropriate technical and organisational measures including AES-256 encryption at rest, TLS 1.3 in transit, and strict access controls.

3. Lawful Bases for Processing

Every processing activity at OptiStack has a documented lawful basis under GDPR Article 6.

Contract Performance (Art. 6(1)(b))

Processing necessary to provide the OptiStack service as agreed in our Terms of Service.

Examples: Account creation, authentication, connected platform data access for cost analysis, service delivery.

Legitimate Interest (Art. 6(1)(f))

Processing necessary for our legitimate interests, balanced against your rights and freedoms.

Examples: Usage analytics, service improvement, security monitoring, fraud prevention, customer support.

Legal Obligation (Art. 6(1)(c))

Processing necessary to comply with legal obligations to which we are subject.

Examples: Tax compliance, financial record keeping, regulatory reporting, law enforcement requests.

Consent (Art. 6(1)(a))

Processing based on your freely given, specific, informed, and unambiguous consent.

Examples: Analytics cookies, marketing communications, optional feature telemetry.

4. Data Subject Rights

We respect and facilitate all data subject rights under GDPR. Below is a detailed guide on how to exercise each right.

Right of Access (Art. 15)

Obtain confirmation of whether we process your data and receive a copy of all personal data we hold about you.

How to exercise:

Email dpo@optistack.com with subject 'Data Access Request'. We will verify your identity and respond within 30 days.

Response timeline:

30 days

Right to Rectification (Art. 16)

Request correction of inaccurate personal data or completion of incomplete personal data without undue delay.

How to exercise:

Update directly via account settings, or email dpo@optistack.com for data we process on your behalf.

Response timeline:

Without undue delay

Right to Erasure (Art. 17)

Request deletion of your personal data when it is no longer necessary, you withdraw consent, or you object to processing.

How to exercise:

Email dpo@optistack.com with subject 'Erasure Request'. Note: some data may be retained where required by law.

Response timeline:

30 days

Right to Restriction (Art. 18)

Request restriction of processing while we verify accuracy of your data, assess our legitimate interests, or if processing is unlawful.

How to exercise:

Email dpo@optistack.com with subject 'Restriction Request' specifying the grounds for restriction.

Response timeline:

Without undue delay

Right to Data Portability (Art. 20)

Receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and transmit it to another controller.

How to exercise:

Email dpo@optistack.com with subject 'Portability Request'. Specify your preferred format (JSON or CSV).

Response timeline:

30 days

Right to Object (Art. 21)

Object to processing based on legitimate interests, including profiling. Object to direct marketing at any time.

How to exercise:

Email dpo@optistack.com with subject 'Objection'. For marketing, use the unsubscribe link in any email.

Response timeline:

Without undue delay

Right Not to Be Subject to Automated Decisions (Art. 22)

Not be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.

How to exercise:

OptiStack does not make solely automated decisions with legal effects. Our cost recommendations are advisory only.

Response timeline:

N/A

5. Data Breach Notification

We maintain a comprehensive data breach response plan in compliance with GDPR Articles 33 and 34:

Supervisory Authority

• Notification within 72 hours of becoming aware of a breach (Art. 33)
• Detailed description of the nature, scope, and likely consequences
• Categories and approximate numbers of data subjects affected
• Measures taken or proposed to address the breach

Affected Individuals

• Direct notification without undue delay when breach poses high risk (Art. 34)
• Clear description in plain language of the breach
• Recommendations for protective measures individuals can take
• Contact information for further questions

6. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) in compliance with GDPR Article 35 whenever a processing activity is likely to result in a high risk to individuals' rights and freedoms. Our DPIA process includes:

1.Systematic description of the processing operations and their purposes
2.Necessity and proportionality assessment of the processing relative to the purpose
3.Risk assessment evaluating the likelihood and severity of risks to data subjects
4.Mitigation measures to address identified risks, including technical and organisational safeguards
5.DPO consultation and sign-off before processing commences

7. International Data Transfers

OptiStack primarily stores and processes data within the EEA. Where international transfers are necessary, we rely on:

•EU Adequacy Decisions (Art. 45): For transfers to countries recognised by the EU Commission as providing adequate protection.
•Standard Contractual Clauses (Art. 46(2)(c)): EU Commission-approved clauses in our agreements with all non-EEA sub-processors.
•Transfer Impact Assessments: Conducted for all international transfers to evaluate the level of protection in the destination country.
•Supplementary Measures: Encryption (AES-256 at rest, TLS 1.3 in transit), pseudonymisation, and access controls.

8. Sub-Processor Management

We maintain a transparent sub-processor management program in accordance with GDPR Article 28:

•All sub-processors undergo thorough security and privacy assessments before engagement.
•Data Processing Agreements are in place with all sub-processors including appropriate technical and organisational measures.
•Customers are notified of sub-processor changes at least 30 days in advance with the right to object.
•A complete list of sub-processors is available in our Privacy Policy.

9. Data Retention Schedule

We maintain documented retention periods for all categories of personal data. Data is automatically purged when retention periods expire.

Data Type	Retention Period	Justification
Account Information	Duration of account + 30 days	Contract performance, legitimate interest in account recovery
Usage Analytics	24 months	Legitimate interest in service improvement
Technical/Security Logs	12 months	Legitimate interest in security and fraud prevention
Connected Platform Metadata	Duration of account + 90 days	Contract performance
Billing Records	7 years	Legal obligation (tax/financial regulations)
Support Communications	36 months from last interaction	Legitimate interest in customer support quality
Cookie Consent Records	365 days (auto-renewed)	Legal obligation (ePrivacy compliance)

10. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority (GDPR Article 77). We encourage you to contact us first so we can address your concerns directly.

Lead Supervisory Authority

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Bezuidenhoutseweg 30, 2594 AV The Hague
Website: autoriteitpersoonsgegevens.nl
Phone: +31 (0)70 888 8500

GDPR Questions?

Our Data Protection Officer is available to answer any questions about our GDPR compliance or to assist with data subject requests.

Email: dpo@optistack.com · Response within 5 business days