Version 1.5 | 25 October 2026 | English translation of the German contract version | Review draft, not yet in force
1. Controller
Acunomic GmbH, Leutschenbachstrasse 95, 8050 Zürich, Switzerland, UID CHE-274.507.729. Data protection concerns can be sent in writing to this address or through the contact page. This version is for review; the actual recipients, countries and retention periods are to be completed before the public market launch.
2. Scope
This policy covers the website and Acunomic's own contract administration. Customer data that Acunomic processes on behalf of customers is governed by the data processing agreement. The specific activity determines the role; support or telemetry data is not automatically excluded from processing on behalf of customers.
3. Data and purposes
When pages are requested, the IP address, time, requested address, browser information and technical logs may arise for technical provision and security. For an enquiry, the contact, company and content data entered are used to handle the enquiry. When a contract is concluded, the necessary business, billing and communication data are added. Sensitive documents are to be sent only through an agreed channel.
In the client area, the following are also processed: the account, name and company of the signed-in person, the acceptance of the client area terms of use with version and time, and the views of the detail pages with their time. The purpose is to protect the confidential content and to investigate misuse; for this, name, company and date appear as a watermark in these views. The view logs are deleted after twelve months; the proof of acceptance is kept for as long as claims arising from it can be asserted. The basis is Acunomic's overriding interest (Art. 31(1) FADP) or the legitimate interest under Art. 6(1)(f) GDPR.
Where Acunomic provides ACURATE, Acunomic's evaluation method, in the client area, the details the company enters there for its ERP evaluation are also processed: company profile, goals, requirements, weightings, dates, the persons responsible for each step, and the name and email address of the contact person for the vendors, and where applicable an uploaded Office design. The purpose is to prepare the evaluation documents and to accompany the evaluation; the basis is the contractual relationship with the company or its initiation.
Where a signed-in person asks a question on the process architecture pages, the question, the context it refers to (process, step, line type, platform, chart of accounts and recording method), the account, name and company of the person, and Acunomic's answers are processed. The purpose is to answer the question. The question and the answers are visible in the client area to the person and to the users of their company. The basis is the contractual relationship with the company or its initiation.
The FADP and, where applicable, the GDPR govern. Where the GDPR applies, the possible legal bases for each specific processing are pre-contractual or contractual necessity, legal obligations, legitimate interests in secure operation following a balancing of interests, or voluntary consent. Blanket consent by visiting the website is not assumed.
4. Recipients and transfers abroad
Hosting, platform, communication and security services may receive necessary data. Different operating models are used for the review environments: self-hosted Odoo Community and Odoo.sh Enterprise. The actual legal entities providing services, infrastructure locations, remote access, subcontractors and transfer mechanisms must be reviewed against the provider contracts and the current configuration and published specifically before the market launch. This version claims neither exclusively Swiss storage nor the absence of further recipients.
5. Cookies and optional services
The cookie notice applies. Statistics, marketing, newsletters and external embeds may be activated only on a reviewed legal basis and, where required, with prior consent. Bot protection such as Turnstile may be operated only with transparent information about the provider actually used, the purpose and the data flow. The installation of a module alone does not prove an active service.
6. Retention
Data is kept only for as long as the purpose concerned or legal obligations require, and is then deleted or anonymised. Specific periods for logs and enquiries, backup rotation and statutory retention of accounting records must be set in the record of processing activities before the market launch and taken over into this policy. Unlimited storage of all enquiries is not intended.
An ACURATE evaluation in the client area remains readable and downloadable for 90 days after the agreed term ends. 30 days before deletion, the company's users of the client area receive an email. After that, the evaluation, its details, the uploaded Office design and the messages about it are deleted, at the earliest 30 days after that email. If Acunomic extends the evaluation, the period starts again. Notes about it in Acunomic's customer management follow that system's retention.
Questions on the process architecture pages are deleted with their answers two years after the last message about them.
7. Rights
Under applicable law, there are in particular rights of access, rectification, erasure, restriction, data release or portability, and objection. Consent can be withdrawn with effect for the future. Identity may be verified to the extent necessary. Mandatory retention obligations are reserved. Complaints can be lodged with the FDPIC or a supervisory authority competent under the GDPR.
8. Security and changes
Protective measures appropriate to the risk are provided for; no transmission is described as absolutely secure. Material changes are published with a new version date. Legal bases and rights are not changed retroactively by publication.
Change note
Version 1.5: questions on the process architecture pages: the details processed, who sees them, and their deletion two years after the last message.
Version 1.4: ACURATE in the client area: the details processed and their deletion 90 days after the evaluation ends, announced 30 days in advance.
Version 1.3: processing in the client area (acceptance of the terms of use, view logs, watermark).
To be completed before approval
Direct data protection contact; actual list of recipients and countries; specific retention periods; cookie and network inventory; active spam protection, statistics and embeds; any representative or data protection officer required. This review draft does not claim that the operational review has already been completed.