Back to ORG

Legal · Privacy

Privacy policy.

This policy explains what personal data ORG collects, why we collect it, how it is processed, and the rights you have under the EU General Data Protection Regulation (GDPR).

Last updated · 2026-04-26

Who we are

ORG is an AI-first transformation practice operating from Berlin and Lisbon. We act as data controller for the personal data described in this policy.

What we collect

  • Booking data — name, work email, company, and meeting notes you submit when scheduling a session.
  • Calendar metadata — chosen time slot, timezone, and the resulting Google Calendar event.
  • Communications — emails you send us and our replies.
  • Technical data — IP address, browser type, pages visited (for security and aggregate analytics only — we do not run advertising trackers).

Why we use it

  • Contract performance — to deliver the session you booked and the engagement that follows.
  • Legitimate interests — to operate, secure, and improve our website.
  • Consent — for any optional marketing communications, which you can withdraw at any time.

Subprocessors

  • Google Workspace — calendar, email infrastructure (EU/US, EU SCCs in place).
  • Cloudflare Workers / D1 — application hosting and database (global edge network with EU-region affinity for relevant data).
  • Attio — customer relationship management for engagement intake and follow-up.
  • Anthropic — the AI infrastructure underpinning the engagements we deliver. No site visitor data is sent to Anthropic without explicit consent within an engagement.

Retention

  • Booking records — kept for 7 years to satisfy commercial and tax obligations under EU and member-state law.
  • Marketing communications — until you unsubscribe.
  • Server logs — 30 days.

Your rights under the GDPR

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request erasure (where no overriding legal basis applies).
  • Restrict or object to processing.
  • Receive your data in a portable format.
  • Lodge a complaint with your local data-protection authority.

International transfers

Where personal data leaves the EEA — typically to US-based service providers — we rely on EU Standard Contractual Clauses and additional safeguards required by the European Data Protection Board.

Changes to this policy

We may update this policy as our service evolves. Material changes will be flagged on this page with a new “last updated” date.

Questions?

For privacy-specific requests — access, correction, erasure, portability — write to mail@orgops.net. We respond within 30 days.