Privacy notice

The controller under the GDPR is Ruth Ogubuike, impressum@oxaron.com.

This notice covers the oxaron.com website only. Processing inside the Oxaron product is governed by the data-processing agreement with each customer; the product is not served from this website.

This site sets no advertising or tracking cookies, embeds no fonts, maps or videos from third-party servers, and builds no user profiles. All fonts are bundled at build time and served from our own origin, so loading a page makes no connection to Google Fonts or any comparable service. There is no cookie banner because nothing is stored on your device that would require your consent.

The site is hosted by Cloudflare, Inc., acting as a processor under Art. 28 GDPR. When a page is requested, Cloudflare processes the connection data technically required to deliver it: IP address, date and time, the resource requested, referrer, volume transferred and browser identification.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in operating the site reliably and defending it against attack. Processing outside the EU cannot be excluded and takes place on the basis of the European Commission's Standard Contractual Clauses. This data is not combined with other sources and is not used to analyse individual behaviour.

We use Cloudflare Web Analytics to see how many pages are viewed and where visitors arrive from. It sets no cookie and neither stores nor reads anything on your device; there is no recognition across sites or sessions and no user profile is built. What is processed is aggregate information such as the page requested, the referrer, approximate region, device type and time.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in understanding whether the site is clear and whether it is found at all. Because nothing is stored on or read from your device, no consent is required under § 25 TDDDG. The service is provided by Cloudflare, the same processor that hosts the site; no further provider is involved.

We set exactly one cookie: oxaron-lang. It records whether you want to read the site in German or English, lasts one year, and is written only when you actively switch languages. It carries no identifier that could recognise you — its value is either “de” or “en”.

Because it serves only a function you explicitly requested, it is strictly necessary under § 25(2) TDDDG and requires no consent. You can delete it in your browser at any time; the site then returns to English.

When you submit the form at /demo we process what you entered: name, email address, company, company size as a band, and your optional message. The purpose is solely to answer your enquiry and arrange a session.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering a contract), otherwise Art. 6(1)(f). Providing the data is voluntary, but without a name, an email address and a company we cannot act on the enquiry.

The enquiry is delivered to us by email, through the same processor that hosts the site (Cloudflare); no further provider is involved. Enquiries are not stored in the product database. We delete them once the enquiry has been dealt with and no statutory retention period applies — for business correspondence, typically after six months where no contract results.

To resist automated submissions the form carries a field invisible to you, a signed and time-limited stamp, and a short-lived count of submissions per IP address. No CAPTCHA and no third-party service is involved, and no data is passed on.

Your enquiry is read by people. We pass no personal data from this website to language models or comparable systems, and there is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20). You may object at any time under Art. 21 GDPR to processing based on Art. 6(1)(f).

To exercise them, contact impressum@oxaron.com. You also have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority; the competent authority is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach.

We update this notice when the site changes — for instance when a further service is added. The version published here, carrying the date above, is the one that applies.