Skip to Content

Privacy Notice 

Effective Date: 18 October 2026
Version: UK-v1.1



 

1. Who is the Data Controller?2. Legal Basis and Definitions3. What Data Do We Process, For What Purpose, Under What Legal Basis, and For How Long?4. Recipients and Data Processors5. Data Transfer Outside the UK and the EU/EEA (Third Countries)6. Security7. Data Subject Rights8. Right to Complain and Judicial Remedies9. Special Notes10. Changes and Availability

1. Who is the Data Controller?

Name: Krisztian Eyssen (self-employed individual / sole trader), trading as eYssen
Address: Flat D, 129–131 Sutherland Avenue, London W9 2QJ, United Kingdom
Email: [email protected]
Phone: +44 7770 635936 (Primary contact for the service)
Website: https://www.eyssen.com

This Notice applies to data processing activities related to the website https://www.eyssen.com and the eYssen/Odoo based services ( “System”).

Roles in Brief

  • We act as a  Data Controller when processing personal data for our own customer relationship management, invoicing, contractual, and website operation purposes (e.g., contact persons' details).
  • We act as a  Data Processor when operating the eYssen/Odoo instances on behalf of our Clients, and processing the Client’s own business data stored within those instances (e.g., customer/supplier/employee/user data). In this case, the Data Processing Agreement (DPA) in Appendix M3 of our Terms and Conditions applies, which is concluded upon their acceptance.

2. Legal Basis and Definitions

Data processing is governed particularly by the  UK General Data Protection Regulation (UK GDPR) and the  Data Protection Act 2018. Where we process personal data of individuals in the EU/EEA (e.g., contact persons of our EU Clients), the EU General Data Protection Regulation (EU) 2016/679 (EU GDPR) also applies. References to the GDPR mean the UK GDPR and the EU GDPR, as applicable. Definitions should be interpreted according to the GDPR.

3. What Data Do We Process, For What Purpose, Under What Legal Basis, and For How Long?

Category Data Processed Purpose Legal Basis Retention Period
3.1 Client Relationship & Contract (B2B) Name, job title/position, company, email, phone, communication history. Contacting, offering services, contract execution and performance. UK GDPR Art. 6(1)(b) (Contract performance or pre-contractual steps); additionally,  Art. 6(1)(f) (Legitimate Interest – B2B communication). 6 years from termination of the legal relationship (limitation period under the Limitation Act 1980); accounting records as set out in 3.4.
3.2 System Access & User Account Name, email/username, password (strong cryptographic hash only), role, log data (login/out, IP/timestamp), access events. Service provision, access management, IT security, audit. Art. 6(1)(b)(Contract performance) and  Art. 6(1)(f)(Legitimate Interest – information security). Account termination + 12 months (audit and security logs); if litigation: until closure of the case.
3.3 Customer Service / Support / Ticketing Contact details, ticket content, logs, attachments. Troubleshooting, documentation of support. Art. 6(1)(b) and  Art. 6(1)(f)(Legitimate Interest – quality assurance). 3 years from ticket closure; if litigation: until closure of the case.
3.4 Invoicing and Finance Billing name/address, VAT number, transaction data, payment status. Invoice issuance, accounting, fulfilment of tax obligations. Art. 6(1)(c) (Legal Obligation – accounting/tax law, specifically the UK tax laws). At least 5 years after the 31 January online filing deadline of the relevant tax year (HMRC record-keeping requirements), i.e. approximately 6 years.
3.5 Communication & Marketing (Optional) Name, email, preferences. Newsletter, event, and product information. Art. 6(1)(a)Consent. Until withdrawal; after unsubscribing, the fact and time of consent are retained for 1 year for evidential purposes.
3.6 Website Logs & Cookies Log data (IP, timestamp, URL, user-agent), functional and – with consent – analytical/marketing cookies. Website operation, information security; optionally analytics/marketing. Art. 6(1)(f)(Legitimate Interest – security, troubleshooting); for analytics/marketing:  Art. 6(1)(a)(Consent). Operational logs 90 days; cookies according to the cookie table. Note: details in separate Cookie Notice and consent interface.
3.7 Data Processor Role – Client Data in the System Personal data stored in the Client’s own instance (e.g., customers, employees, users) are managed by the Client as the Controller; we process them as a Processor according to the contract and the DPA. The purpose/duration of processing is defined by the Client; deletion is subject to the Client's instructions. N/A (Client is Controller) Art. 28 (Processor obligations) As per Client instructions.
3.8 Installation reports from the eYssen Odoo fork About once a week, a copy of the eYssen Odoo fork sends a report, without a separate login, to https://pw.eyssen.io. The report contains the database identifier (dbuuid), database name, database creation date, company name, company email, company phone, public address (web.base.url), Odoo version, language, user counts (all users, users active in the last 15 days, and external users), the technical names of installed modules, and the optional eyssen_code. It does not include each module's own version. pw.eyssen.io also records the IP address from which the report was received. This applies to any installation of the fork, not only to installations operated by eYssen for a client. To know which installations of the fork are in use, which modules they run, and how many users they have. Art. 6(1)(f) (Legitimate interest in operating and understanding use of the published fork). Each raw report is deleted after 24 months. The latest known state of an installation is kept after the individual reports expire. An installation can stop further reports by disabling the scheduled action "Publisher: Update Notification" or by changing the publisher_warranty_url setting.

4. Recipients and Data Processors

Personal data may be accessed – to the extent necessary – by:

  • Hosting/Infrastructure: Oracle Cloud Infrastructure – our own systems in Frankfurt, Germany (eu-frankfurt); Client instances in the region selected by the Client (by default in the EU/EEA). Backblaze (off-site backup; EU region or – if necessary – utilizing SCCs).
  • Network protection: Cloudflare (content delivery network, DDoS and WAF protection).
  • Source code management: GitHub (source code of eYssen, custom modules and configurations; no Client business data).
  • Installation reports: Oracle Cloud Infrastructure, Frankfurt, Germany (eu-frankfurt), served at pw.eyssen.io.
  • Payment Provider/Bank, Accountant, Legal Counsel/Auditor (for legal/accounting obligations in the UK and internationally).
  • Ticketing/Communication Tools (for support purposes).

The current list of sub-processors acting for our Clients’ data is set out in Appendix M3 (Data Processing Agreement) of our Terms and Conditions; we have GDPR-compliant contracts with all processors.

5. Data Transfer Outside the UK and the EU/EEA (Third Countries)

We are established in the United Kingdom; transfers of personal data from the EU/EEA to us are based on the European Commission’s adequacy decision for the United Kingdom. Data is primarily stored within the EU/EEA. If transfer to a third country is necessary, it is performed only on the basis of:

  • an adequacy decision (of the European Commission or the UK Secretary of State, including the EU–US Data Privacy Framework and its UK Extension, where applicable); or
  • the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, and – if required – additional technical/legal safeguards.
  • We will provide separate notification regarding such transfers.

6. Security

  • Encryption during transmission (TLS) and – where possible – during storage.
  • Access controls based on the principle of  'least privilege', Admin MFA, logging.
  • Segregated storage of backups and regular restoration tests (upon Client request).
  • Notification and reporting procedures in case of data processing incidents, as required by the  UK GDPR.

7. Data Subject Rights

You are entitled to the following rights under the UK GDPR:

  • Right of access (Art. 15).
  • Right to rectification (Art. 16).
  • Right to erasure ( ‘Right to be forgotten’, Art. 17) – subject to exceptions for legal retention obligations.
  • Right to restriction of processing (Art. 18).
  • Right to data portability (Art. 20 – where the legal basis is contract or consent).
  • Right to object (Art. 21 – legitimate interest/marketing).
  • Right to withdraw consent (where the legal basis is consent).
  • Non-subject to automated decision-making/profiling – we do not perform such activities.

Response Deadline: Maximum 1 month (plus 2 months in justified cases). Requests are accepted at the contact details provided above.

8. Right to Complain and Judicial Remedies

Primarily, please notify us ([email protected]). Furthermore, you are entitled to file a complaint with the Information Commissioner's Office (ICO) or initiate judicial remedies before a competent court. If you are located in the EU/EEA, you may also lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement (e.g., the AEPD in Spain or the NAIH in Hungary).

UK Supervisory Authority Details
Name Information Commissioner’s Office (ICO)
Address Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline 0303 123 1113
Website https://ico.org.uk

9. Special Notes

  • Children: Our services are not aimed at persons under 16 years of age.
  • Contractual Obligation: Provision of certain data is necessary for the provision of the service; without it, the service cannot be provided.
  • DPA: When we process personal data in the System on your behalf, the details of the processing are stipulated in the Data Processing Agreement (DPA) in Appendix M3 of our Terms and Conditions.
  • Source of data: Where we do not collect personal data directly from you (e.g., contact persons named by our Client, or users created in the System by the Client), we receive it from the Client or from publicly available business sources (e.g., company registers or the company’s website).

10. Changes and Availability

This Notice may be updated from time to time; the effective version is available on the website https://www.eyssen.com.

Versions:
UK-v1.0: 1 January 2025 - 17 October 2026
UK-v1.1: 18 October 2026 -