Privacy Policy
This policy explains what personal data we process on this website, why, and on what legal basis. It follows the General Data Protection Regulation (GDPR).
In short: this site loads no measurement services on its own. On your first visit we ask whether we may measure use of the site and enquiries produced by our advertising. Say no, or say nothing, and nothing is loaded or measured. Otherwise personal data arises here only when you write to us yourself.
1. Controller
The controller for data processing on this website is:
ARO Digital Group LLC, Limited Liability Company (Kosovo), Behar Begolli 2, 10000 Prishtinë, Kosovo. Represented by Arion Osmani.
Email: hello@ossma.de.
2. What we process
- Contact form: Your name, company, phone number, email address and the text of your message. Name, email address and message are required; company and phone number are optional. Submitting the form from a service page also records which service it concerns.
- Package enquiry on the pricing page: Your name, company, email address, your message, the package you chose and your answers in the package finder.
- Documents you upload: As a client you get a personal link for uploading photographs and documents for your project. We process the files, their names and an optional message. Photographs are re-encoded on arrival, which discards the embedded metadata — including any GPS coordinates — so it is never stored. Using the link is optional; you can send us the same things by email.
- Server logs: When you open the site, our host automatically processes technical access data including your IP address, the date and time, the address requested, the referring link and browser and system details. This is technically necessary to serve the page.
- Spam protection: To stop repeated automated submissions, your IP address is hashed (SHA-256) when you submit the form and held in memory for at most fifteen minutes. The address itself is never stored and cannot be recovered from the hash.
We collect nothing beyond this. There is no newsletter, no registration and no user account.
3. Measurement only with your consent
This site uses no re-targeting and no social media plugins. If you agreed on your first visit, we use Microsoft Clarity for audience measurement. Clarity records page views and click and scroll behaviour and stores data in your browser to do so. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, which involves a transfer to the United States.
After your consent we also load Google Ads conversion tracking. This lets us measure whether someone arriving through our advertising successfully submits an enquiry form. The page visited, technical browser data and an advertising-click identifier may be sent to Google and stored in your browser. Signals for personalised advertising are disabled. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing in the United States may occur.
The legal basis for both measurement services is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw it at any time, with effect from the moment you do.
The typefaces (Inter and Poppins) are not fetched from Google. They are downloaded when the site is built and served from our own domain.
4. Purpose and legal basis
- Answering your enquiry: We process what you send in order to answer you and to quote for the work. The legal basis is Art. 6(1)(b) GDPR (steps prior to a contract) and, where no contract is yet in prospect, Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).
- Filing it in our client system: Your enquiry is also stored in our internal client system so that we can follow it up and run the engagement. The legal basis is Art. 6(1)(b) and (f) GDPR.
- Confirmation of receipt: You receive an automatic confirmation at the address you gave. The legal basis is Art. 6(1)(b) and (f) GDPR.
- Running and securing the site: Server logs and spam protection serve the secure and uninterrupted operation of the site. The legal basis is Art. 6(1)(f) GDPR.
- Invoicing and retention: For billed projects we process the data needed to invoice. The legal basis is Art. 6(1)(b) and (c) GDPR together with the applicable retention obligations.
5. Recipients and processors
We do not sell personal data. To run the site and handle your enquiry we use the following providers as processors under Art. 28 GDPR:
- Hosting and delivery: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA
- Database and file storage: Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992
- Email delivery: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA
6. Transfers to third countries
We are based in Kosovo, and the providers above process data in the United States among other places. Neither is covered by an adequacy decision of the European Commission.
Transfers therefore rely on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. Eine Kopie der Garantien erhalten Sie unter hello@ossma.de.
7. How long we keep it
- Enquiries that do not become work: Deleted once the enquiry has been dealt with, unless a retention obligation applies.
- Enquiries that become work: Kept for the duration of the engagement and afterwards for as long as needed to complete it and to meet statutory retention periods.
- Uploaded documents: Kept for the duration of the project and the care that follows it. Deleted sooner on request, at any time.
- Server logs: Held only briefly by our host to keep the site running.
- Spam-protection hashes: Fifteen minutes at most, never written to storage.
8. Your rights
You have the right of access to the data held about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21 GDPR).
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence or of the alleged infringement.
9. Whether you have to provide data
Providing your data is neither a statutory nor a contractual requirement. Without a name, an email address and a message, however, we cannot answer your enquiry.
10. No automated decision-making
We use no automated decision-making and no profiling within the meaning of Art. 22 GDPR.
11. Changes to this policy
We update this policy when the processing changes. The version published here applies; the date above shows when it was last revised.
12. Contact
Questions about this policy or about your data can be sent to: