1.Who we are
This notice is given by Outturn ("Outturn", "we"). For privacy questions or to exercise your rights write to [email protected].
Outturn, Ireland. Company details are available on request at [email protected].
2.Our two roles
We are the controller for personal data we collect for our own purposes: visits to our website, enquiries and pilot requests, sign-ups and billing records, records of acceptance of our terms, and the security of our service.
We are a processor for personal data that customers upload to or connect with their Workspace (for example user accounts, operational records, transport documents and e-mails in connected department mailboxes). For that data the customer organisation is the controller, and our Data Processing Agreement applies. If you are an employee or counterparty of one of our customers, please address requests about that data to that organisation; we will help it respond.
3.Personal data we collect as controller
| Category | Examples | Source |
|---|---|---|
| Website visits | IP address, browser type, requested page and time, processed in technical server and network logs. We also count visits to our public pages on our own server, without cookies, tracking scripts or third parties: the IP address and browser type are used only at the moment of counting to tell one visitor from another for that day and are not stored; we keep only daily totals (pages, referring site, language, device type, campaign). We use no advertising tools. | Your browser |
| Service usage statistics | Per Workspace and day: number of sign-ins and how often each section of the service was opened. Not linked to individual users; no screen recording or keystroke tracking. | Our service |
| Pilot requests and enquiries | Company name, work e-mail, country, message, chosen plan, language; the content of e-mails you send to sales@ or [email protected] | You |
| Self-serve sign-up and billing | Company name, work e-mail, country, chosen plan, subscription and payment status. We never receive card details. | You; Lemon Squeezy (status only) |
| Free trial | Company name, work e-mail, country, trial start and end dates | You |
| Acceptance of terms | Accepted document versions, time, and a one-way hash of your IP address (never the IP address itself) | Our service |
| Account and security | Name, work e-mail, role, password hash (the password itself is never stored), two-factor settings, sign-in times, security events | You; your administrator; our service |
| Support requests | Your message, contact details and an optional screenshot | You |
We do not ask for special categories of personal data and do not send marketing newsletters.
4.Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Answering enquiries and preparing pilots and offers | (b) steps at your request before a contract; (f) our legitimate interest in replying to business enquiries |
| Creating and running your account and Workspace, service e-mails | (b) performance of the contract |
| Billing records and tax compliance | (c) legal obligation under Irish tax and company law |
| Proof of acceptance of our terms | (f) legitimate interest in being able to prove the contract |
| Security, abuse prevention and rate limiting | (f) legitimate interest in protecting the service and its users |
| Aggregated website visit and service usage statistics, to improve the site and help trial customers get started | (f) legitimate interest in understanding, in aggregate, how our site and service are used |
| Establishing or defending legal claims | (f) legitimate interest |
Where we rely on legitimate interests you can object at any time (see "Your rights").
5.Who receives personal data
We use a small number of service providers, each bound by a data processing agreement: Hetzner Online GmbH (hosting in Nuremberg, Germany), Cloudflare, Inc. (network, encrypted connection, attack protection and routing of e-mails sent to our addresses) and Brevo (delivery of service e-mails). The current list is on the Sub-processors page.
Self-serve Subscriptions are sold by Lemon Squeezy as merchant of record. Lemon Squeezy collects payment and billing details directly from the buyer as an independent controller under its own privacy notice and shares with us only the order and subscription status.
We disclose data to authorities only where the law requires it. We never sell personal data.
6.International transfers
Our servers, database and backups are in Germany (EU). Cloudflare operates a global network and Lemon Squeezy is based in the United States. Where personal data leaves the European Economic Area, the transfer relies on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses (GDPR Art. 45 and 46). You can ask us for a copy of the relevant safeguards at [email protected].
7.How long we keep data
| Data | Retention |
|---|---|
| Pilot requests and enquiries | As long as needed to handle the enquiry and any resulting contract discussion; deleted earlier on request |
| Accounts and Workspace data | While the Workspace exists. A confirmed deletion request takes effect after a 7-day cooling-off period. An unpaid Subscription becomes read-only after 7 days and is deleted 30 days later. |
| Free trial Workspaces | Read-only when the 14-day trial ends without a Subscription; deleted with all data 30 days later |
| Billing records | As long as Irish tax and company law requires |
| Records of acceptance of terms | Together with the Workspace they belong to, or with the billing record of the sign-up |
| Sign-in sessions | At most 12 hours; ended after 30 minutes of inactivity or on sign-out |
| Data export download links | 72 hours |
| Technical logs | Short, size-limited rotation on the server |
| Visit statistics | The daily visitor code and the random key used to make it: until the end of that day. Daily totals (no personal data): up to about 26 months |
| Backups | Encrypted backups: daily copies for 30 days and monthly copies for 12 months; yearly copies of the stored source files for up to 10 years. Deleted data disappears from backups when the copies that contain it expire. |
8.How we protect data
- hosting in the EU; the server accepts traffic only through an encrypted Cloudflare tunnel, and connections to the site use HTTPS;
- passwords stored only as Argon2id hashes; two-factor authentication available to every user and required for sensitive actions such as deleting a Workspace;
- sessions limited to 12 hours with a 30-minute idle timeout; protection against cross-site request forgery; sign-in rate limits and account lockout;
- strict separation of each customer's Workspace; role-based access; append-only audit log of significant actions;
- backups encrypted on the client side before they are stored, and tested by restoring them.
9.Your rights
You have the right to access your personal data, to have it rectified or erased, to restrict its processing, to data portability and to object to processing based on legitimate interests (GDPR Art. 15–21). Write to [email protected]. We answer within one month; this can be extended by two further months for complex requests, in which case we tell you why.
You may lodge a complaint with the Irish Data Protection Commission or with the supervisory authority where you live or work, for example the Lithuanian State Data Protection Inspectorate.
10.No automated decisions about you
We make no decisions about you based solely on automated processing that produce legal or similarly significant effects (GDPR Art. 22). The checks in the platform flag discrepancies in operational records for people to review; they do not assess or score individual employees.
12.Children
Outturn is a business service and is not directed to children.
13.Changes to this notice
The version id and effective date are shown at the top. We inform account holders of material changes in the platform or by e-mail before they take effect.