Privacy Policy
Operos
As of: October 2026
The protection of personal data is important to us. In this privacy policy we inform you about which personal data we process when you use our website and our services, for what purposes this is done, on what legal basis the processing takes place and what rights you have under applicable data protection law.
We comply in particular with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the applicable data protection provisions.
1. Controller
The controller responsible for the processing of personal data within the meaning of the GDPR is:
Noor Aldeen Wisam Kareem, trading as Operos
Otto-Siffling-Straße 16
68305 Mannheim
Germany
Email: info@operos.de
Phone: +49 160 8309306
Website: operos.de
If you have questions about data protection or wish to exercise your data protection rights, you can reach us using the contact details above.
2. General Principles of Data Processing
We process personal data only to the extent legally permitted and necessary for a specific purpose.
Personal data is all information relating to an identified or identifiable natural person. This includes, for example, names, email addresses, IP addresses, contact details and usage data.
Processing takes place in particular for the following purposes:
- Provision and technical operation of our website
- Processing of contact requests
- Initiation, conclusion and performance of contracts
- Provision of our hosting, email, cloud and software services
- Billing and payment administration
- Ensuring IT security and defending against misuse
- Compliance with legal obligations
- Processing of support requests and technical faults
Processing takes place, depending on the respective purpose, on the basis of Art. 6(1)(a), (b), (c) or (f) GDPR.
3. Access to Our Website and Server Log Files
When you access our website, the server infrastructure used processes technically necessary information.
In particular, the following data may be recorded:
- IP address of the accessing device
- Date and time of access
- Page or file accessed
- Amount of data transferred
- HTTP status code
- Referrer URL, if transmitted by the browser
- Browser type and browser version
- Operating system used
- Technical information for error detection and system security
This data is processed to provide the website, detect technical errors, ensure the stability of the systems and investigate unauthorized access or attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our website and our technical infrastructure.
Server log files are generally stored for a period of 7 to 14 days and then deleted, unless longer storage is necessary to investigate a specific security incident, for legal enforcement or due to statutory obligations.
Merging with other data for marketing purposes does not take place merely through the collection of server log files.
4. Hosting and Technical Infrastructure
Our website and the services we operate are hosted on our own servers located in Mannheim (Germany), unless otherwise stated for individual services.
To the extent the relevant infrastructure is operated in Germany, the corresponding data is stored there. The actual storage location may differ for individual third-party services, for example for email delivery, DNS, CDN or external software.
When operating our systems, personal data may be processed in order to:
- provide websites and applications
- technically enable access
- analyze errors and faults
- detect attacks and misuse
- carry out security updates and maintenance measures
- ensure the availability and integrity of the systems
Legal basis: Art. 6(1)(b) GDPR to the extent processing is necessary for a contract, and Art. 6(1)(f) GDPR for secure and proper technical operation.
Where an external service provider processes personal data on our behalf, we conclude a data processing agreement pursuant to Art. 28 GDPR where required.
5. Contact by Email, Phone or Contact Form
When you contact us, we process the information you provide in order to handle your request and respond to you.
In particular, the following data may be processed:
- Name
- Email address
- Phone number, if provided
- Content of your message
- Time and communication history
- Other details you voluntarily provide
Providing this data is generally voluntary. However, without certain details we may not be able to process your request.
Legal basis:
- Art. 6(1)(b) GDPR if your request relates to an existing contract or the initiation of a contract.
- Art. 6(1)(f) GDPR for other requests, to the extent processing is necessary to handle the request and no overriding interests of the data subject conflict.
- Art. 6(1)(c) GDPR to the extent a legal obligation to process exists.
Contact requests are generally stored until final processing is completed and then deleted, unless statutory retention obligations, legitimate grounds for longer storage or other legal obstacles exist.
The usual processing period is generally at most six months after completion of the request. Contract-related communication and business records may differ.
6. Contract Conclusion, Customer Administration and Billing
When you request or commission services from Operos, we process the data necessary for contract initiation, conclusion and performance.
This may include:
- Name and, if applicable, company name
- Address and contact details
- Contract and service information
- Booked products and services
- Invoice and payment information
- Support and communication history
- Technical details for setting up the agreed services
The data is used in particular for providing the booked services, customer communication, invoicing, payment administration and compliance with legal obligations.
Legal bases:
- Art. 6(1)(b) GDPR for performance of the contract and pre-contractual measures.
- Art. 6(1)(c) GDPR for statutory retention and documentation obligations.
- Art. 6(1)(f) GDPR for legitimate interests, for example handling contract questions and asserting or defending legal claims.
We store contract and invoice documents in accordance with the applicable statutory retention periods. Other customer data is deleted once it is no longer required for the stated purposes and no statutory or other lawful grounds for further storage exist.
7. Provision of Hosting, Email, Cloud and Software Services
When you use our services, further personal data may be processed depending on the product booked.
This includes in particular:
- User accounts and login data
- Email addresses and communication data
- Uploaded files and documents
- Calendar, appointment and booking data
- Time tracking and administration data
- Technical logs and usage data
- Configuration and support information
The scope of processing depends on the specific application used and the respective contractual relationship.
We process this data to the extent necessary for the provision, administration, maintenance, security and support of the booked services.
Legal basis: Art. 6(1)(b) GDPR for contractually required processing and, where applicable, Art. 6(1)(f) GDPR for necessary security and operational measures.
Content of our customers
For hosting, cloud and software services, customers may store their own content and personal data of their employees, customers or other contacts.
The customer is generally responsible for the lawfulness of the processing they initiate to the extent they decide on its purposes and essential means.
Where Operos processes such personal data exclusively on behalf of the customer, this is done on the basis of a separate data processing agreement pursuant to Art. 28 GDPR, where required.
In these cases, the processing and associated obligations are governed by the respective contract, the documented instructions of the customer and applicable data protection provisions.
8. Email Sending and Email Relay
For sending and delivering emails we use the service provider Brevo (Sendinblue SAS, France) as our technical email relay.
In the context of email delivery, the following data may in particular be processed:
- Sender and recipient addresses
- Subject and content of the message, to the extent technically necessary
- Time of sending and delivery status
- Technical log data
- Information about failed deliveries
Processing takes place to send emails reliably, detect delivery problems and prevent misuse.
Legal basis: Art. 6(1)(b) GDPR for contract-related messages and Art. 6(1)(f) GDPR for secure technical operation.
Where the relay provider acts as a processor, we conclude a corresponding data processing agreement where legally required.
Provider: Brevo (Sendinblue SAS), based in France (EU). A data processing agreement exists with Brevo.
9. Cookies and Comparable Technologies
Our website may use cookies or comparable technologies. Cookies are small pieces of information that can be stored on or read from your device.
We distinguish between technically necessary technologies and those used, for example, for statistics, marketing or additional functions.
Technically necessary cookies
Technically necessary cookies serve, for example, to:
- provide basic functions of the website
- store your cookie settings
- enable secure sessions
- maintain certain settings during use
To the extent these technologies are strictly necessary to provide a digital service expressly requested by you, their use is based on § 25(2) TDDDG. The processing of personal data is additionally governed by the relevant legal basis of the GDPR.
Statistics and marketing technologies
Statistics and marketing cookies or comparable technologies are used only if the necessary consent is given.
Legal basis: § 25(1) TDDDG for storing information on the device or accessing it, and Art. 6(1)(a) GDPR for the subsequent processing of personal data to the extent consent is required.
You can revoke your consent at any time with effect for the future or change your selection via the “Cookie settings” link in the footer.
The lawfulness of processing up to the revocation remains unaffected.
10. Overview of Cookies Used
The following entries describe the currently intended cookie categories. They must be reconciled with the cookies actually set and their real durations before publication.
| Cookie | Purpose | Category | Intended duration |
|---|---|---|---|
| oc_consent | Stores the cookie selection | Necessary | 6 months |
| wp-settings-* | Stores WordPress user and display settings, if used | Functional / depending on use | Depends on the specific WordPress configuration |
| _pk_id.*, _pk_ses.* | Matomo analytics – only after consent to “Statistics” | Statistics | up to 13 months |
The actual storage duration may depend on the respective configuration and the service used.
If additional statistics, marketing or third-party cookies are used, they will be added with their name, purpose, provider and actual storage duration.
11. Documentation of Consents
Where our website uses consent management, information about users’ choices may be stored in order to be able to trace consent granted or refused.
This may include:
- Time of selection
- Selected consent categories
- Version of the consent declaration
- Technical identifier of the consent process
- Where applicable, a pseudonymized or hashed IP address
Processing serves to document consent and comply with data protection documentation obligations.
Legal basis: Art. 6(1)(c) GDPR to the extent a statutory documentation obligation exists, and where applicable Art. 6(1)(f) GDPR for documentation and defense of legal claims.
A hash value of an IP address may still be personal data if assignment to a person is possible. It is therefore not automatically treated as anonymous information.
The intended storage duration is at most twelve months, unless longer storage is required and remains legally permissible. The actual duration depends on the consent management used and legal requirements.
12. Recipients and Categories of Service Providers
For operating our website and providing our services we may use external service providers.
These may include in particular:
- Hosting and server providers
- Data center operators
- Email relay and email service providers
- DNS and CDN providers
- Providers of SSL/TLS certificates
- Software and maintenance service providers
- Consent management providers
- Payment and billing service providers, if used
- IT security and support service providers
Specifically, we currently use in particular: Hosting/server: own server, located in Mannheim (Germany). Email relay: Brevo (Sendinblue SAS, France/EU). DNS and CDN: Cloudflare. SSL/TLS certificates: Let’s Encrypt. Consent management and analytics: self-hosted (our own solution and Matomo at matomo.operos.de).
Personal data is disclosed only to the extent necessary for the respective purpose and legally permissible.
Where a service provider processes personal data on our behalf, we conclude a data processing agreement pursuant to Art. 28 GDPR where required.
Such an agreement alone does not replace the assessment of whether the processing is otherwise lawful.
The providers actually used and their functions are specified in the relevant sections of this privacy policy.
13. Transfers to Third Countries
A transfer of personal data to countries outside the European Union or the European Economic Area takes place only if there is a data protection basis for it.
If such a transfer takes place, we comply with the requirements of Art. 44 et seq. GDPR.
Depending on the specific case, this may require in particular an adequacy decision of the European Commission, appropriate safeguards such as standard contractual clauses or other legally provided transfer bases.
Where necessary, additional safeguards are taken into account.
Whether a transfer to a third country takes place depends on the service providers actually used, their sub-processors and the respective processing operations.
14. Data Backup and Backups
To secure the operation of our own systems and, where applicable, within the framework of booked customer services, backups may be created.
These may contain the data present on the respective system at the time of backup.
The intended retention periods for the backups recorded are generally up to 30 days, unless otherwise agreed for the specific service.
The actual storage locations, backup intervals and retention periods depend on the infrastructure used and the respective scope of services.
After the retention period expires, the backups are deleted or overwritten as part of the regular backup cycle, unless legal grounds for longer retention exist.
Where data is backed up on behalf of a customer, the data processing agreements and the agreed service conditions additionally apply.
15. Data Security and SSL/TLS Encryption
We take appropriate technical and organizational measures to protect personal data against loss, destruction, unauthorized access, unlawful alteration and unauthorized disclosure.
These may include in particular:
- Encrypted data transmission using TLS
- Access restrictions and authorization concepts
- Technical security updates
- Protective measures against unauthorized access
- Data backups to the agreed extent
- Logging of security-relevant events
Our website uses TLS encryption to the extent it is set up for the respective connection. You can usually recognize an encrypted connection by “https://” in your browser’s address bar.
The security measures are adapted according to technical possibilities, the risks and legal requirements.
16. Storage Duration and Deletion
We store personal data only as long as necessary for the respective purposes or as long as statutory retention obligations exist.
The following intended periods generally apply to the individual processing operations:
| Data type | Intended storage duration |
|---|---|
| Server log files | 7 to 14 days |
| General contact requests | Generally up to 6 months after completion |
| Contract and invoice documents | According to the applicable statutory retention periods |
| Technical backups | Generally up to 30 days, depending on the service |
| Consent records | Intended up to 12 months, to the extent legally permissible and required |
| Customer accounts and contract data | For the contract duration and beyond, to the extent legally required |
The stated periods are guidelines and not a guarantee that all data is automatically fully deleted after expiry.
Longer storage may be necessary in particular if statutory retention obligations exist, data is needed to assert or defend legal claims or a specific security incident must be investigated.
After the respective purpose ceases and relevant retention periods expire, the data is deleted or, where possible, anonymized.
17. Your Rights as a Data Subject
Within the framework of statutory requirements, you have in particular the following rights:
Right of access under Art. 15 GDPR: You may request information about whether and which personal data we process about you.
Rectification under Art. 16 GDPR: You may request the rectification of inaccurate or the completion of incomplete data.
Erasure under Art. 17 GDPR: You may, under the statutory requirements, request the erasure of your personal data.
Restriction of processing under Art. 18 GDPR: You may, in the cases provided by law, request a restriction of processing.
Data portability under Art. 20 GDPR: You may, under the statutory requirements, request to receive the data you provided in a structured, commonly used and machine-readable format or to have it transmitted to another controller.
Objection under Art. 21 GDPR: You may object, for reasons arising from your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR. There is a special right to object to direct marketing.
Revocation of consents: If processing is based on your consent, you may revoke it at any time with effect for the future. The lawfulness of processing up to the revocation remains unaffected.
To exercise your rights, you can contact us at info@operos.de. Where necessary, we must verify your identity in an appropriate manner to protect your data from unauthorized disclosure.
18. Right to Lodge a Complaint with a Data Protection Authority
You have the right, under Art. 77 GDPR, to lodge a complaint with a data protection authority, in particular with the authority of your habitual residence, your place of work or the place of the alleged infringement.
For matters in Baden-Württemberg, the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg is responsible in particular.
Exercising this right is possible independently of other administrative or judicial remedies.
19. Automated Decisions and Profiling
We generally do not make decisions based solely on automated processing via our website that produce legal effects concerning you or similarly significantly affect you, unless such processing is expressly pointed out and the statutory requirements are met.
Profiling for such purposes does not generally take place in the context of the general website use described here.
20. External Links and Third-Party Services
Our website may contain links to external websites or services.
When you click an external link, you leave our website. The respective operator is generally responsible for the processing of personal data on the website subsequently accessed.
Where external content or services are directly integrated into our website, personal data may already be transmitted to the respective provider upon access, depending on the technical implementation.
Such integrations are activated, where required, only after your consent. The specific services and their data processing are explained in the relevant sections of this privacy policy.
21. Data Protection for Minors
Our website is generally not specifically aimed at children.
If we become aware that personal data of a child has been processed in violation of applicable legal requirements, we review the matter and take the necessary measures.
Additional legal requirements may apply to special services or offers.
22. Changes to this Privacy Policy
We reserve the right to adapt this privacy policy if our services, the technical systems used or the legal requirements change.
The version published on our website at the respective time applies.
In the event of material changes requiring separate information or consent, we comply with the statutory requirements.
Controller: Noor Aldeen Wisam Kareem, trading as Operos
Address: Otto-Siffling-Straße 16, 68305 Mannheim, Germany
Email: info@operos.de
Phone: +49 160 8309306
As of: October 2026