Privacy policy

Preamble

This privacy policy explains which kinds of your personal data we process, for which purposes and to what extent. It applies to all processing of personal data carried out by us, both when providing our services and in particular on our websites.

Controller

Omid Amini
OA IT Solutions
Emil-Nohl-Straße 38, 42897 Remscheid, Germany
Email: contact@omidamini.de
Legal notice: https://omidamini.de/en/impressum

Security measures

We use technical and organisational security measures to protect the data we process. All data is transmitted encrypted via TLS/SSL (HTTPS).

International data transfers

Some of our service providers are located outside the EU (in particular in the USA). For transfers to the USA we rely on the EU-US Data Privacy Framework (DPF) and the standard contractual clauses of the European Commission.

Registration and user account

Users can create an account. We store the name, email address and an encrypted password. Profiles are not publicly visible. Data is removed when the account is deleted.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Single sign-on (Google and GitHub)

You can sign in with Google or GitHub. In that case the provider transmits authentication data (name, email) to us. We cannot see your password at the sign-on provider.

Providers: Google Ireland Limited, GitHub Inc. (USA)

Legal basis: Art. 6(1)(f) GDPR (legitimate interests)

Cookies

We use technically necessary session cookies for authentication (NextAuth.js) without consent, because they are required to run the protected area (§ 25(2) no. 2 TDDDG). We only use analytics cookies (Google Analytics) after your explicit consent via the cookie banner; see the section “Google Analytics”. We do not use marketing or cross-site tracking cookies.

Legal basis: necessary cookies: Art. 6(1)(f) GDPR together with § 25(2) no. 2 TDDDG. Analytics cookies: Art. 6(1)(a) GDPR together with § 25(1) TDDDG (consent).

Contact form

When you contact us via the contact form, we process your name, email address, message and any voluntary details about project type, budget and timeframe in order to handle your request. The details are forwarded to me by email. Emails are sent via Resend (USA). Cloudflare Turnstile is used to protect against automated requests.

Emails to contact@omidamini.de are forwarded to my mailbox via ImprovMX. Sender, recipient and content of the email are processed for delivery.

Your details are deleted once the request has been fully handled and no statutory retention obligations apply. If a contract is concluded, the retention periods for contract documents apply.

Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(a) GDPR (your consent in the form, which you can withdraw at any time with effect for the future).

Service providers

• Vercel: hosting (USA, EU data centres available)
• Neon: PostgreSQL database (EU data centre)
• Upstash Redis: rate limiting, temporary IP storage (EU data centre)
• Cloudflare Turnstile: CAPTCHA protection, no cookies (USA, DPF certified)
• Resend: email delivery (USA)
• Vercel Blob: file storage (USA)
• Google OAuth: optional sign-in (USA)
• GitHub OAuth: optional sign-in (USA)

Your rights

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact: contact@omidamini.de

Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de

Server log files

When you visit this website, the hosting provider (Vercel Inc., USA, DPF certified) automatically stores technical log data: IP address (shortened), user agent, time of access, referring URL, requested URL and HTTP status code. This data is processed to keep the service running and to prevent abuse (Art. 6(1)(f) GDPR). Retention: 30 days. It is not combined with other data sources.

Rate limiting (abuse protection)

To protect against automated attacks, spam and API abuse, we briefly process your IP address in a cache system (Upstash Inc., USA, DPF certified) and link it to a counter per API endpoint. Legal basis: Art. 6(1)(f) GDPR (IT security, abuse protection). Retention: at most 24 hours.

CAPTCHA (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect forms (registration, sign-in, contact) against automated abuse. Your IP address is transmitted to Cloudflare to verify that the request comes from a human. Unlike conventional CAPTCHA services, Cloudflare Turnstile sets no cookies and builds no cross-site tracking profile; the processing only serves to verify the individual request.

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (EU-US Data Privacy Framework certified).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest: protection against spam and automated attacks). No separate consent is required because no cookies are set (§ 25(2) no. 2 TDDDG).
Retention: the IP address is only processed for the duration of the verification and is not stored permanently.
Cloudflare privacy policy: cloudflare.com/privacypolicy

Data processing agreements (Art. 28 GDPR)

We have concluded data processing agreements under Art. 28 GDPR with all technical service providers that process personal data on our behalf. This applies in particular to: Vercel (hosting), Neon (database), Upstash (rate limiting), Resend (email delivery), ImprovMX (email forwarding), Cloudflare (CAPTCHA), Google (Analytics, OAuth) and GitHub (OAuth). Transfers to the USA are based on standard contractual clauses (SCC) or the provider’s EU-US Data Privacy Framework certification.

Automated decision-making

There is no solely automated decision-making with legal effect within the meaning of Art. 22 GDPR. All decisions relevant to contracts and services, including the approval of CV requests, are made personally.

Data deletion (Art. 17 GDPR)

You can delete your account and all related data yourself at any time in the dashboard under “Delete account”. Alternatively, send an email to contact@omidamini.de. Deletion takes place without delay.

Google Analytics

This website uses Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only activated after your prior explicit consent via the cookie banner. Until you consent, no analytics cookies are set (Google Consent Mode v2, default “denied”).

After consent, Google Analytics uses cookies that allow an analysis of how the website is used. The information generated by the cookie is usually transferred to a Google server in the USA and stored there. IP anonymisation is enabled on this website.

Legal basis: Art. 6(1)(a) GDPR (consent) together with § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by opening the cookie banner again or deleting the cookies in your browser.

Client portal and data storage

Registered users of the client portal (dashboard) allow us to process the following data for the purpose of performing the contract: name, email address, project descriptions, uploaded files, support messages and quote and invoice data.

Uploaded files are stored encrypted at Vercel Blob (Vercel Inc., 340 Pine Street Suite 701, San Francisco, CA 94104, USA). The database is run by Neon Inc. (PostgreSQL as a service, EU region). Both providers are contractually bound as processors under Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention: until the user account is deleted or on written request. You can request deletion of your account at any time by email to contact@omidamini.de.