Website Privacy Policy

A.1 Controller

plusRS OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia. Registry code: 17182790 · VAT ID: EE103002866. Email: privacy@plusrs.com. We have not appointed, and are not required to appoint, a Data Protection Officer. This policy covers personal data processed via the opexone.io website. For the opexONE application, see the Data Processing Agreement, the Sub-processor List, and the opexONE App Privacy Policy (Part B).

A.2 No Tracking on This Website

The opexone.io marketing website uses no analytics, tracking, or advertising technologies and sets no tracking cookies. Fonts are self-hosted. Only strictly-necessary storage required to serve the site securely is used, so no cookie banner is required (ePrivacy Directive Art. 5(3)).

A.3 What We Process, and Why

a) Server logs. Our hosting provider (Amazon Web Services) processes technical data (IP address, timestamp, requested page, browser type) in server and application logs to deliver the site securely and detect abuse. Legal basis: legitimate interest in site security, IT integrity, and abuse detection (Art. 6(1)(f) GDPR, Recital 49). Hosting and application logs under our control are retained for a maximum of 30 days, then deleted automatically.

b) Trial signup. When you sign up for a trial, we process the data you provide (company name, your name, work email, optional phone, selected plan) to respond, verify, and set up your workspace. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). No payment or card data is collected on this website. A phone number you provide is used only to contact you about your trial and account — never for marketing without separate prior consent. If a trial does not convert, signup data is deleted within 6 months.

c) Contact form. Messages (name, email, company, message) are processed solely to handle your enquiry and are received in our Microsoft 365 mailbox. Legal basis: Art. 6(1)(b) and (f) GDPR. Correspondence is kept as long as needed for the enquiry and any statutory retention.

d) Spam and abuse prevention. A hidden honeypot field and IP-based rate-limiting briefly process the submitting IP address. Legal basis: Art. 6(1)(f) GDPR, Recital 49.

e) Billing. For paid subscriptions, we process billing contact and invoicing data of customer representatives (name, business email, billing address, VAT ID) for contract execution, invoicing, and statutory bookkeeping. Recipients: Stripe Payments Europe, Ltd. (payment processing — card data goes directly to Stripe and never reaches us) and Envoice (Estonian accounting service used for our statutory bookkeeping). Legal bases: Art. 6(1)(f) GDPR (our legitimate interest in concluding and performing our contract with the customer) and Art. 6(1)(c) GDPR (statutory bookkeeping). Accounting records are retained 7 years per the Estonian Accounting Act.

f) No automated decision-making within the meaning of Art. 22 GDPR takes place on this website. Rate-limiting is a purely technical measure.

A.4 Recipients and Transfers

Processors for this website: Amazon Web Services (hosting via Amazon CloudFront, AWS Lambda and Amazon S3; outbound email via Amazon SES) and Microsoft 365 (Microsoft Ireland Operations Limited / Microsoft Corporation — receiving and storing our email correspondence). For billing: Stripe and Envoice per A.3(e). Transfers outside the EEA are safeguarded by the EU–US Data Privacy Framework (AWS under the Amazon.com, Inc. certification; Microsoft Corporation certified) with EU Standard Contractual Clauses as fallback. We use no analytics, advertising, or tracking providers and do not sell personal data. The opexONE application's full processor list: opexone.io/subprocessors.

A.5 Your Rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection to legitimate-interest processing (Art. 21) — via privacy@plusrs.com. You may lodge a complaint with a supervisory authority; our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, +372 627 4135, info@aki.ee — or the authority of your residence or workplace.

A.6 Security and Changes

The website is served exclusively over TLS. Platform security measures are described in the DPA (Annex II). We update this policy as the website or legal requirements change; every content change bumps the version and date shown on this page.