This document outlines how the General Data Protection Regulation (GDPR) affects Opsaro and its customers. It includes actions Opsaro has taken in response to GDPR and provides information to help customers meet their own compliance obligations.

---

Introduction

The European Union’s General Data Protection Regulation (GDPR), which came into effect on May 25th, 2018, strengthens the rights of EU residents in relation to the collection, processing, and storage of personal data. The regulation applies to any organization processing EU residents’ personal data—regardless of location. Opsaro is committed to helping its customers comply with GDPR by embedding privacy-by-design principles into its products and services.

---

Opsaro’s Commitment

At Opsaro, data privacy and protection are core to how we operate. We do not monetize user data or engage in targeted advertising, and we limit personal data collection to only what is necessary to deliver and support our services.

Some of our initiatives to support GDPR compliance include:

• Identifying Personal Data
  We maintain a clear understanding of the personal data processed by our systems and services and regularly review data flows, storage, and retention practices.

• Transparency and Visibility
  Opsaro enables its customers (as data controllers) to manage user data through intuitive interfaces and comprehensive audit trails.

• Security and Data Integrity
  Our infrastructure is designed with security in mind, including encrypted storage, secure access controls, and routine security assessments.

• Data Portability
  Opsaro supports data export features that allow customers to fulfill subject access requests in a timely and compliant manner.

---

What Personal Data is Collected

Please refer to the Opsaro Privacy Policy for full details on the types of personal data we collect and how that data is used.

---

Data Retention

• Demo Requests: Data submitted for demo or contact requests is retained for up to 12 months from the last interaction.

• Customer Data: Personal data related to customer accounts is retained for up to 3 months following the end of a contract, in line with our service agreements.

• Billing Information: Payment-related data is deleted within 3 months post-processing, unless otherwise required by law.

• Inquiries: Data submitted via website contact forms is retained for up to 3 months after response, unless legally required to retain longer.

---

Children’s Privacy

Opsaro’s services and website are not intended for individuals under the age defined as a child by applicable data protection laws, and we do not knowingly collect data from children.

---

Legal Basis for Processing

If you are based in the EEA, we process your personal data on the basis of legitimate interest as necessary to operate and improve our services.

---

Data Processor Role

Opsaro acts as a Data Processor for its customers, who are the Data Controllers. We process personal data only under customer instruction and in accordance with our contractual obligations.

---

Subprocessors

Opsaro may use trusted third-party service providers (“Subprocessors”) to support our operations. These vendors are subject to strict data protection obligations under formal agreements.

Current Subprocessors (subject to change):

Name	Subprocessing Activity	Country