Privacy notice for ore

This notice applies to the use of the ore platform, that is, to firms, companies, their employees, clients and third parties who are contacted via ore. Visits to our website are governed by the privacy policy of the website.

1. Who is responsible

For the content: your firm or company

The content held in ore, such as audit files, documents, financial statement data and information about clients, is processed by us on behalf of the firm or company that uses ore. The controller within the meaning of the GDPR is then that firm or company. We are a processor under Art. 28 GDPR and act only on instructions, on the basis of a data processing agreement. Please direct questions about this content to the firm or company with which you work via ore.

For the operation: Oreamnos GmbH

For the data we need to provide, secure and bill ore, we are the controller ourselves. That is what the following sections are about.

Oreamnos GmbH, represented by the managing directors Andreas Schmitz and Dmitri Steinbach
Dürener Straße 334-336, 50935 Köln, Germany
Phone: +49 221 466 791, e-mail: info@oreamnos.de

Where the duration of storage cannot be specified more precisely, the following applies: we delete personal data as soon as the purpose ceases to apply and no retention obligation stands in the way.

2. Provision of the platform

Which data

• IP address
• date and time of access
• address accessed and HTTP status code
• browser, browser version and operating system

Purpose and legal basis

We need this data to deliver ore, to fix errors and to detect attacks or misuse. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Retention period

The log files are deleted after 14 days. Entries we need to investigate a security incident are kept until the incident has been resolved.

3. User account

Which data

• first and last name, e-mail address
• password, stored only as an irreversible hash value
• membership of firm, company and engagements, as well as your roles and permissions
• time of registration and of the last sign-in
• language setting and other settings you make yourself

Purpose and legal basis

The account is a prerequisite for using ore and ensures that each person sees only what they are authorised to see. The legal basis is the user agreement (Art. 6(1)(b) GDPR). If you received the account through your employer or a firm, the processing is additionally based on their legitimate interest in orderly collaboration (Art. 6(1)(f) GDPR).

Retention period

Until the account is deleted or the user agreement ends, and thereafter only insofar as statutory retention obligations exist. Your firm or company can have your account deactivated or deleted at any time.

Do you have to provide the data?

We need your name and e-mail address to create an account. Without them, you cannot use ore. All other settings are voluntary.

4. Billing

Which data

• name and address of the firm or company, contact person and e-mail address for invoices
• booked plan, term, invoices and payment status
• payment method; for cards, only the card brand and the last four digits

You enter card and bank account details directly with our payment service provider Stripe. They do not reach our servers.

Purpose and legal basis

We need the data to bill the user agreement (Art. 6(1)(b) GDPR). We retain invoices and accounting records because commercial and tax law require it (Art. 6(1)(c) GDPR in conjunction with § 257 HGB, German Commercial Code, and § 147 AO, German Fiscal Code).

Retention period

Until the end of the contract, and thereafter for as long as the statutory retention periods run. For invoices and accounting records these are currently eight years, for commercial and business letters six years.

Do you have to provide the data?

Yes, without invoicing and payment details we cannot conclude a paid contract.

5. E-mails from the platform

Which data

Name and e-mail address of the recipients, content of the message, time of sending and the delivery status (delivered, rejected, reported as unwanted). For replies to ore, additionally the incoming e-mail with attachments.

Purpose and legal basis

ore sends invitations, notifications, reminders and requests to third parties and assigns replies to the correct file. Messages concerning your account, such as the invitation or the password reset, are based on the user agreement (Art. 6(1)(b) GDPR). Messages concerning the content of a file are sent by us on behalf of the firm or company, see section 1. We evaluate the delivery status so that messages arrive and our sender address is not blocked (Art. 6(1)(f) GDPR).

Retention period

We store the delivery status with the respective message. It is kept for as long as the message itself. Incoming e-mails belong to the file and are kept for as long as the file.

6. Error analysis

Which data

If a technical error occurs in ore, we record the error message, the affected function and page, time, browser and operating system. We do not send name, e-mail address, cookies, form content or query parameters in addresses; identifiers in addresses are removed before sending. We do not make screen recordings.

Purpose and legal basis

We want to detect and fix errors before they affect many users. The legal basis is our legitimate interest in an error-free platform (Art. 6(1)(f) GDPR). The service provider is Sentry, see Recipients.

Retention period

Error reports are deleted after 90 days.

7. Protection of registration and sign-in

Which data

During registration and sign-in, Cloudflare Turnstile checks whether a human or an automated program is accessing the platform. For this, IP address, browser identifier, TLS fingerprint and technical characteristics of the browser are evaluated. To do so, Turnstile reads information from your browser.

Purpose and legal basis

We protect accounts against automated sign-in attempts and mass registrations. The legal basis is our legitimate interest in the security of the platform (Art. 6(1)(f) GDPR). Reading information from your browser is strictly necessary for the secure sign-in you have requested and is therefore permitted without consent (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act).

Retention period

We ourselves store only the result of the check. How long Cloudflare stores the data under its own responsibility is governed by Cloudflare's privacy policy.

8. Logging in the file

Which data

ore records who did what and when in a file: changes, approvals, comments, uploaded documents, queries and invitations.

Purpose and legal basis

Audit and financial statement work must be traceable; professional law and auditing standards require this. The logging is therefore part of the service we provide for your firm or company and is carried out on their behalf.

Retention period

The logs belong to the file and are kept for as long as the file. The periods are determined by the firm or company, for German public auditors (Wirtschaftsprüfer) for example under § 51b WPO (German Public Accountant Act).

9. Client portal and requests to third parties

Via ore, clients submit documents, and third parties such as banks, lawyers or business partners answer confirmation requests. For this we process the name, contact details and the replies of the persons contacted. Third parties do not need an account; they receive a personal link. This processing, too, is carried out on behalf of the firm that makes the request.

10. AI functions

Which AI works in ore is decided by your firm or company: one of the providers listed below, via our key or your own, or a local model on your own infrastructure. Only the content necessary for the respective function is sent to the selected provider. A data processing agreement is in place with every provider we offer; training with your data is contractually excluded. AI results are suggestions on which humans decide. No automated decision within the meaning of Art. 22 GDPR takes place.

11. Recipients

To operate ore, we use the following service providers, each with a data processing agreement under Art. 28 GDPR. Where a service provider is itself the controller for part of the processing, this is stated alongside.

• Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen

  Purpose

  Servers for operating the platform

  Place of processing

  Germany (Nuremberg, Falkenstein)

  Safeguard for third-country transfers

  no third-country transfer

• Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513

  Purpose

  Database, sign-in, file storage

  Place of processing

  Frankfurt am Main (Amazon Web Services data centre, region eu-central-1)

  Safeguard for third-country transfers

  Standard contractual clauses of the EU Commission as part of the data processing agreement, for access from outside the EU, for example in support

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg

  Purpose

  Sending and receiving e-mails from the platform (Amazon SES), storage of incoming e-mails

  Place of processing

  Frankfurt am Main (region eu-central-1); AWS does not transfer the data out of the selected region, except for services initiated by the customer or by legal order

  Safeguard for third-country transfers

  Standard contractual clauses of the EU Commission as part of the AWS Data Processing Addendum, for transfers to third countries

• Deutsche Post E-POST Solutions GmbH and Deutsche Post AG, Bonn (E-POST)

  Purpose

  Digital submission, printing and dispatch of letters, for example confirmation requests to third parties

  Place of processing

  Data centres within the EU

  Safeguard for third-country transfers

  no third-country transfer

• Functional Software, Inc. (Sentry), 45 Fremont Street, San Francisco, CA 94105, USA

  Purpose

  Detection and analysis of technical errors

  Place of processing

  Sentry's EU data region in Germany, access from the USA possible

  Safeguard for third-country transfers

  EU-US Data Privacy Framework, additionally standard contractual clauses (Data Processing Addendum 5.1.0)

• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (Turnstile)

  Purpose

  Protection of registration and sign-in against automated access. IP address, TLS fingerprint and browser identifier are processed. For the purpose of improving bot detection, Cloudflare is itself the controller.

  Place of processing

  Cloudflare's global network, transfer to the USA

  Safeguard for third-country transfers

  EU-US Data Privacy Framework (Cloudflare Data Processing Addendum 6.4)

• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland

  Purpose

  Payment processing. For part of this, for example fraud prevention and statutory obligations as a payment service provider, Stripe is itself the controller.

  Place of processing

  EU, transfer to the USA possible

  Safeguard for third-country transfers

  EU-US Data Privacy Framework, additionally standard contractual clauses (Stripe Data Processing Agreement)

AI providers, depending on the choice of the firm or company:

• Anthropic Ireland, Limited, Dublin, Ireland (Claude)

  Purpose

  AI functions, if selected by the firm or company

  Place of processing

  USA

  Safeguard for third-country transfers

  Standard contractual clauses of the EU Commission under Irish law as part of the Anthropic Data Processing Addendum (24 February 2025)

• OpenAI Ireland Ltd., Dublin, Ireland (ChatGPT)

  Purpose

  AI functions, if selected by the firm or company

  Place of processing

  Transfer to OpenAI affiliates and to sub-processors outside the EU possible, in particular to the USA

  Safeguard for third-country transfers

  Standard contractual clauses of the EU Commission or adequacy decision under Art. 45 GDPR as part of the OpenAI Data Processing Addendum (version v.010126, signed on 29 October 2026)

12. Your rights

You have the following rights towards us:

• confirmation as to whether we process data about you, and access including a copy (Art. 15 GDPR)
• rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
• erasure, insofar as there is no obligation to retain the data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• receipt of your data in a commonly used, machine-readable format (Art. 20 GDPR)
• objection to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• complaint to a data protection supervisory authority (Art. 77 GDPR)

For data for which we are the controller, please contact info@oreamnos.de. For content we process on behalf of others, your firm or company is the right point of contact; we support them in this. The supervisory authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

13. Changes

If we develop ore further or the legal situation changes, we will adapt this notice. The version published here applies in each case.