Privacy policy
Last updated: 27.07.2026
At ONETEEM we take the protection of your personal data seriously. This policy explains what personal data we process when you visit our website, contact us, apply for a job or work with us as a customer, why we process it, how long we keep it, and what rights you have.
For how we protect data technically and organisationally, see our security page. For the service providers we use, see our subprocessors page. Everything a procurement or security review needs is collected in our trust centre.
Controller
ONE T.E.E.M. GmbH
Watzmannstraße 5
84503 Altötting
Germany
General enquiries: [email protected]
Privacy and data protection: [email protected]
Telephone: +49 8671 9287379
Company registration details are in our legal notice.
Data protection officer
We are not required to appoint a data protection officer under Article 37 GDPR or Section 38 BDSG, because we do not meet the thresholds that trigger the obligation. Responsibility for data protection sits with the Managing Director. Write to [email protected] with any question or request, and it will reach the right person.
What we process, why, and on what basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Responding to enquiries and providing pre sales information | Name, company, email, telephone, content of your message | Article 6(1)(b) where you are asking about a contract, otherwise Article 6(1)(f), our interest in responding to business enquiries | 12 months after our last contact, unless a contract follows |
| Delivering our services under a contract | Contact and role details of your staff, project documentation, system configuration, support correspondence | Article 6(1)(b) | For the term of the contract, then under the statutory periods below |
| Invoicing, accounting and tax | Billing contact, company details, payment and transaction data | Article 6(1)(c), our legal obligations under German commercial and tax law | Statutory periods, see data retention below |
| Operating and securing our website and IT systems | IP address, browser and device information, timestamps, pages requested | Article 6(1)(f), our interest in the security and availability of our systems | Server log files are deleted after 30 days |
| Optional cookies and website analytics | Cookie identifiers and usage data | Article 6(1)(a) consent, together with Section 25(1) TDDDG | Consent records are kept for 12 months, see cookies below |
| Handling job applications | Application documents, CV, qualifications, correspondence | Article 6(1)(b) and Section 26(1) BDSG | 6 months after the decision, or longer with your consent |
| Sending information you asked for by email | Name and email address | Article 6(1)(a) consent | Until you withdraw consent |
Website and server log files
Each time our website is accessed, our hosting and content delivery providers automatically record technical information, including the requesting IP address, the date and time, the page requested, the referring page, and browser and operating system details. This happens for every website and is necessary to deliver the page and to detect and defend against attacks. We do not use this data to identify individual visitors and we do not combine it with other data. Log files are deleted after 30 days, unless a specific security incident requires us to keep a copy for longer.
Our website is hosted by Odoo S.A. in Belgium, with domain and DNS services from IONOS SE in Germany and content delivery and attack protection from Cloudflare, Inc. Details are on our subprocessors page.
Cookies and similar technologies
Cookies are small files stored on your device. We distinguish two kinds:
Necessary cookies keep the website working. They handle things like your session, load balancing, security and remembering your cookie choice. These are set on the basis of Section 25(2) TDDDG and do not require consent, because the website cannot function without them.
Optional cookies cover analytics and anything that is not strictly necessary. These are only set after you have given consent through our cookie banner, on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG. Nothing optional is set before you choose.
You can withdraw your consent at any time, with effect for the future, by reopening the cookie settings from the link in our footer and changing your selection. You can also delete cookies already stored, or block them entirely, in your browser settings. Blocking necessary cookies may stop parts of the website working.
We keep a record of your consent choice for 12 months so that we can demonstrate compliance and so that you are not asked again on every visit.
Contacting us
If you write to us by email, use a contact form or call us, we process the details you give us in order to answer. Where your enquiry concerns a possible contract, the basis is Article 6(1)(b). Otherwise it is our legitimate interest in responding to business enquiries under Article 6(1)(f). We keep enquiry correspondence for 12 months after our last contact, unless it becomes part of a contract, in which case the statutory periods below apply.
Job applications
If you apply to us, whether through our careers page or by email, we process your application documents in order to assess your suitability and to run the selection process. The basis is Article 6(1)(b) GDPR together with Section 26(1) BDSG.
If we do not offer you a position, we delete your application six months after the decision. That period covers the limitation period for claims under the German General Equal Treatment Act. If we would like to keep your details on file for future openings, we ask you separately and only keep them with your consent, which you can withdraw at any time.
When we act as a processor for our customers
When we deliver services to a customer, the customer is normally the controller for the personal data in their systems and we act as processor on their instructions. That relationship is governed by a data processing agreement, not by this policy. This policy covers the personal data for which ONE T.E.E.M. GmbH is itself the controller, which is our website, our business operations and our own communications.
Our data processing agreement is available on request from [email protected] and forms part of our customer agreement. The controls we apply are described on our security page.
Service providers and subprocessors
We use a small set of established providers for hosting, collaboration, business operations and software development. Each is bound by a data processing agreement, may process data only on our instructions, and receives only what it needs.
The full list, with the purpose, location and transfer mechanism for each, is on our subprocessors page. We update that page whenever the list changes, and we notify customers at least 30 days before adding or replacing a subprocessor that handles personal data.
International data transfers
Some of our providers process data outside the European Economic Area, in the United States and in Tunisia.
For providers in the United States, we rely on the EU US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses approved by the European Commission.
For our collaboration with ONETEEM TUNISIA SUARL in Tunisia, we have concluded a data processing agreement and implemented the standard contractual clauses approved by the European Commission, supported by technical measures including encryption in transit and at rest and access limited to named personnel. Tunisia is not covered by an EU adequacy decision, which is why these safeguards are in place.
The mechanism that applies to each provider is shown on our subprocessors page. Customers who need processing restricted to the EEA can request that before contracting and we will record it in the agreement.
Data retention
We keep personal data only as long as we need it for the purposes described above, or as long as the law requires.
Statutory retention periods under German commercial and tax law, principally Section 257 HGB and Section 147 AO, generally run between six and ten years depending on the type of document, and start at the end of the calendar year in which the document was created. During that period we restrict the data to what the retention obligation requires and do not use it for any other purpose.
The specific periods for each purpose are in the table above. Where no statutory period applies, we delete data once the purpose has been fulfilled.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, under Article 15
- Have inaccurate data corrected, under Article 16
- Have your data deleted, under Article 17
- Restrict processing, under Article 18
- Receive your data in a portable format, under Article 20
- Object to processing based on our legitimate interests, under Article 21
- Withdraw any consent you have given, at any time and with effect for the future, under Article 7(3), without affecting the lawfulness of processing carried out before withdrawal
To exercise any of these, write to [email protected]. We respond within one month, and will tell you if we need longer because a request is complex.
Right to complain to a supervisory authority
If you believe we are handling your personal data unlawfully, you can complain to a data protection supervisory authority, under Article 77 GDPR. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany
You may also complain to the supervisory authority where you live or work.
Automated decision making
We do not use your personal data for automated decision making or profiling that produces legal effects for you or otherwise significantly affects you.
Data security
We use technical and organisational measures to protect your data against unauthorised access, loss and misuse, including encryption in transit and at rest, multi factor authentication, least privilege access and continuous vulnerability scanning. These measures are described in detail on our security page, including how to report a security issue to us.
Changes to this policy
We update this policy when our technology, our providers or the legal requirements change. The current version is always published on this page with its effective date at the top. Material changes are announced through our usual customer channels.
