Privacy Policy

1. Who we are

Omni Visual and OMNI are registered trade names (handelsnamen) of Junovy, a Dutch eenmanszaak registered in Amsterdam, The Netherlands under Chamber of Commerce (KvK) number 71813977. Under Dutch law a handelsnaam is not a legal person, so Junovy is the legal entity behind this site and the data controller for personal data processed through it under the General Data Protection Regulation (GDPR).

Registered address: [protected], The Netherlands
KvK number: 71813977
Privacy contact: [protected email]

This policy covers omnivisual.art and its album sites. If you are a Junovy hosting or Business Suite customer, the processing attached to those services is described in the Junovy privacy policy, which covers the same controller.

2. Information we collect

2.1 What you send us

The contact form on this site collects:

• Your name
• Your email address
• The kind of work you are asking about
• Your message
• The name you type as a signature, and the fact and time of your consent

If you open the live chat and send a message, we receive whatever you write there, along with any name or email address you choose to give.

2.2 What is collected automatically

• IP address
• Browser type and version
• Device information
• Pages visited and time spent on them
• Referring website
• Date and time of visit

This is standard web server logging. There is no analytics product behind it, no advertising network, and no third-party tracker of any kind on this site.

3. Legal basis for processing

Under GDPR we rely on the following grounds:

• Consent (Article 6(1)(a)): when you submit the contact form, and when you switch on the live chat in the cookie preferences.
• Legitimate interests (Article 6(1)(f)): to reply to you, to keep the site and the infrastructure behind it secure, and to understand how the site is holding up.
• Contractual necessity (Article 6(1)(b)): where processing is needed to agree or carry out a commissioned piece of work.
• Legal obligation (Article 6(1)(c)): where the law requires it, for example tax and accounting records.

4. How we use your data

• To read and answer what you send through the contact form or the chat
• To discuss, quote for and deliver commissioned work
• To keep the site and its infrastructure secure and available
• To comply with legal obligations

We do not send marketing email from this site, and there is no mailing list to join.

5. Cookies and local storage

This site sets nothing in your browser until you answer the consent banner. The banner offers Decline All, Manage Preferences (per-category toggles) and Accept All, and records your choice in localStorage under the key site_cookie_consent.

If you accept the Functional category, we load our self-hosted Chatwoot live chat, which sets one first-party cookie (cw_conversation) so your conversation survives a page reload. Decline it and Chatwoot is never loaded at all.

There are no analytics, marketing or advertising cookies on this site, and no third-party tracking technology. Typefaces are served from Junovy's own font mirror rather than Google Fonts, so no request leaves for a third party when the page loads. The full breakdown is in the Cookie Declaration.

You can change your mind at any time by clearing your browser storage for this site and reloading the page; the consent banner will reappear.

6. Data sharing and third parties

We do not sell your personal data. We share it only with the processors who make this site and its contact routes work, each under a Data Processing Agreement where one applies.

6.1 Third-party processors

• Hetzner Online GmbH (Gunzenhausen, Germany) — cloud infrastructure and DNS. The site, the form store and the chat all run on Hetzner servers inside the EU. A Data Processing Agreement is in place under Article 28 GDPR.
• Mailjet SAS (Sinch Group) (Paris, France) — delivers the notification email that tells us a form has been submitted. It processes the recipient address and the message content. A Data Processing Agreement is in place under Article 28 GDPR.
• Internet Security Research Group (ISRG) (San Francisco, USA) — issues the SSL/TLS certificate via Let's Encrypt. It processes domain names only; no personal data is shared.

6.2 Self-hosted services

The contact form API and the Chatwoot live chat (served from ask.junovy.com) both run on Junovy's own infrastructure. They are not third-party processors: nothing you send through them is passed to another company, beyond the notification email described above. Chatwoot loads only after you affirmatively accept functional cookies.

7. International data transfers

Your personal data is stored and processed within the European Economic Area (EEA). Where data does leave the EEA, we rely on appropriate safeguards:

• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Data processing agreements with GDPR-compliant providers

8. Data retention

• Contact form submissions: kept for 2 years after our last contact, unless a working relationship is established.
• Chat conversations: kept for 2 years after the conversation ends, on the same basis as a form submission.
• Project correspondence: kept for the duration of the project plus 7 years, for legal and accounting purposes.
• Server logs: kept for 90 days, for security and troubleshooting.

9. Your rights under GDPR

As a data subject in the EU/EEA you have the following rights:

• Right of access (Article 15): ask for a copy of the personal data we hold about you.
• Right to rectification (Article 16): ask us to correct data that is wrong or incomplete.
• Right to erasure (Article 17): ask us to delete your personal data.
• Right to restrict processing (Article 18): ask us to limit how we use it.
• Right to data portability (Article 20): ask for your data in a structured, machine-readable format.
• Right to object (Article 21): object to processing based on legitimate interests.
• Right to withdraw consent: withdraw it at any time where processing rests on consent.
• Right to lodge a complaint: complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

To exercise any of these, write to [protected email] . We respond within 30 days. For a plain-language version, see Your Rights.

10. Data security and privacy by design

Privacy by design and by default (Article 25 GDPR) is built in rather than bolted on. All personal data is held inside the European Union; there are no third-party analytics, advertising or tracking vendors on this site at all; typefaces are self-hosted; and consent-gated services such as the live chat load only after you act. These are architectural choices, not settings, so they apply to every visitor automatically.

We also apply the measures required by Article 32 GDPR, including:

• TLS 1.2+ encryption for all traffic to and from this site.
• Secure server infrastructure with regular security updates.
• Role-based access control and least privilege for administrative access.
• Encrypted credential storage, managed via HashiCorp Vault.
• Automatic dependency scanning and regular security updates.
• Encrypted backups stored in EU-based object storage.
• A documented incident response plan.

No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.

11. Data breach notification

If a personal data breach occurs we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of it, under Article 33 GDPR. Where a breach is likely to result in a high risk to your rights and freedoms we will also tell you directly and without undue delay, in plain language, under Article 34 GDPR.

If you think you have found a security vulnerability in this site, please report it to [protected email] . We appreciate responsible disclosure and will acknowledge your report within one business day.

12. Data Protection Officer (Article 37 GDPR)

Junovy is a small Dutch business and is not required to appoint a Data Protection Officer under Article 37 GDPR: we carry out no large-scale systematic monitoring of individuals, and we process no special categories of personal data on a large scale. Privacy questions, data subject requests and breach reports all go to the privacy contact above, which is handled directly by the person responsible for Junovy.

13. Children's privacy

This site is not directed to anyone under the age of 16, and we do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

14. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. Significant changes are published on this page along with a new "Last updated" date.

15. Contact

Junovy, trading as Omni Visual and OMNI
[protected]
The Netherlands

KvK: 71813977
Privacy enquiries: [protected email]
Everything else: the contact form