Skip to main content

Privacy Policy

Responsible​

The responsible party in terms of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:

ONE WARE GmbH
Annengasse 3
33034 Brakel
Germany
Phone: +49 1522 6837464
Email: info@one-ware.com
Website: https://one-ware.com
Managing Directors: Leon Alexander Beier, Ali Durmaz

Data Protection Officer​

We have appointed the following person as our Data Protection Officer:

Leon Beier
info@one-ware.com
Annengasse 3
33034 Brakel

Your rights​

In accordance with the EU General Data Protection Regulation (GDPR), you can exercise the following rights at any time using the contact details provided:

  • Information about your data stored by us and its processing (Art. 15 GDPR)
  • Correction of inaccurate personal data (Art. 16 GDPR)
  • Deletion of your data stored by us (Art. 17 GDPR)
  • Restriction of data processing if we are not yet permitted to delete your data due to legal obligations (Art. 18 GDPR)
  • Objection to the processing of your data by us (Art. 21 GDPR)
  • Data portability, provided that you have consented to data processing or have concluded a contract with us (Art. 20 GDPR)

If you have given us your consent, you can revoke it at any time with effect for the future.

You can lodge a complaint with a supervisory authority at any time, e.g. with the competent supervisory authority of the federal state in which you reside or with the authority responsible for us as the controller.

A list of supervisory authorities (for the non-public sector) with addresses can be found at:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

Processing activities​

Collection of general information when you visit our website​

Type and purpose of processing
When you access our website, i.e. when you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example:

  • Type of web browser
  • Operating system used
  • Domain name of your Internet service provider
  • Your IP address
  • Similar technical information

They are processed in particular for the following purposes:

  • Ensuring a smooth connection to the website
  • Ensuring smooth use of the website
  • Ensuring and evaluating system security and stability, in particular for the detection of misuse
  • Technically error-free presentation and optimization of the website

We do not use your data to draw conclusions about your person. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

Legal basis and legitimate interest
Processing is carried out in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website and ensuring system security and misuse detection.

Recipients
Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

Storage
Data is stored in server log files in a form that allows the identification of the data subjects for a maximum of 7 days, unless a security-related event occurs (e.g., a DDoS attack).
In the event of such an event, server log files will be stored until the security-related event has been eliminated and fully clarified.

Provision mandatory or required
The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed.

Objection
Please read the information about your right to object under Art. 21 GDPR below.

Contact​

Type and purpose of processing
Our website has a contact form that can be used to contact us electronically. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.

The following data is also stored when the message is sent:

  • Date and time of the request

You can contact us using the email addresses provided. In this case, the personal data transmitted with the email will be stored. This includes:

  • Date and time of the email
  • Email address
  • IP addresses
  • Information about the servers involved in the communication

You can also contact us using the telephone numbers provided. In this case, we collect log data that includes your telephone number and the duration of the call.

Regardless of the type of communication you choose, we collect the content of your request. Your data will be stored for the purpose of individual communication with you.

Legal basis
The processing of data is based on a legitimate interest (Art. 6 para. 1 lit. f GDPR).
Our legitimate interest in processing your data is to enable you to contact us easily.

If you contact us to request a quote, the data will be processed for the purpose of taking steps prior to entering into a contract (Art. 6 para. 1 lit. b GDPR).

Recipients
Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

Storage
Data will be deleted no later than six months after processing your contact request.

If a contractual relationship is established, we are subject to the statutory retention periods. These are generally 6 or 10 years for reasons of proper accounting and tax law requirements.

Provision mandatory or necessary
The provision of your personal data is voluntary. However, we can only process your request if you provide us with the necessary data and the reason for your request.

Objection
Please read the information about your right to object under Art. 21 GDPR below.

Provision of paid services​

Type and purpose of processing
We process the data you provide when placing an order for the purpose of executing and processing your order. This also includes the return or exchange of items and complaints about items.

Your personal data will only be used to the extent necessary for processing this order and delivering the requested products and services.

Legal basis
The processing of data required for the conclusion of the contract is based on Art. 6 para. 1 lit. b GDPR.

Recipients
Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.

For the purpose of fulfilling the contract, we will pass on your name and address to the shipping company responsible for delivery, insofar as this is necessary for the delivery of the goods ordered.

Depending on which payment service provider you select during the ordering process, we will pass on the payment data collected for this purpose to the credit institution responsible for the payment and, if applicable, to payment service providers commissioned by us.

Storage period
We store this data in our systems until the statutory retention periods have expired. These are generally 6 or 10 years for reasons of proper accounting and tax requirements.

Provision mandatory or required
The provision of your personal data is contractually required. Without the provision of your personal data, we cannot execute the order.

You can find more information in the terms of service

Creation of a customer account​

Type and purpose of processing
To use ONE AI in the OneWare Cloud (https://cloud.one-ware.com) and in OneWare Studio, you need a personal OneWare account. When you register, we process your first and last name, your e-mail address and your password (stored only as a salted hash). If you sign in with a third-party account (e.g. Google), we receive your name and e-mail address from that provider. We also store the time of registration and login, the IP address used for security purposes, and your settings (e.g. the active organization).

We use this data to provide secure access to the Software, to assign projects, organizations, credits and jobs to you and to prevent misuse.

Legal basis
The processing is necessary for the performance of the contract (Art. 6 para. 1 lit. b GDPR). Security logging is based on our legitimate interest in the secure operation of the Software (Art. 6 para. 1 lit. f GDPR).

Recipients
The recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website and Software. We send system e-mails (e.g. invitations, confirmations and notifications) via the e-mail service Postmark of ActiveCampaign, LLC, 1 North Dearborn St, 5th Floor, Chicago, IL 60602, USA, as processor; the transfer to the USA is based on Standard Contractual Clauses (Art. 46 GDPR). The owners and administrators of organizations you belong to can see your name, e-mail address and role (see "Organizations").

Storage period
We store your account data until you delete your account (see "Deletion of your account").

Provision mandatory or required
The creation of an account is required to use the Software.

Organizations​

Type and purpose of processing
Projects, plans, credits, licenses and invoices belong to an organization. When you register, we automatically create a personal organization for you. You can create further organizations and invite other people, or be invited to the organization of another customer.

  • Invitations: When an organization invites you, we store your e-mail address, the inviting person, the role and the time of the invitation, and send you an invitation e-mail. The invitation is accepted automatically when you register with this e-mail address.
  • Visible to the organization: Owners and administrators of an organization can see its members (name, e-mail address, role), the projects of the organization, and the usage of each member (in particular jobs, training time, credit consumption, OneWare Agents usage and budgets). Other members can see their own budget and usage.
  • Policies: Owners and administrators can restrict which models of OneWare Agents may be used and require that jobs run only on self-hosted workers.

Legal basis
Art. 6 para. 1 lit. b GDPR (performance of the contract) and Art. 6 para. 1 lit. f GDPR (legitimate interest of the organization in managing its members, costs and licenses). For members of a customer's organization, the customer is responsible for informing them about this processing.

Storage period
Membership data is stored as long as you are a member of the organization. Invitations are deleted when they are accepted, withdrawn or have expired. Billing-related usage data is retained in accordance with statutory retention periods (see "Deletion of your account").

Project files and file synchronization​

Type and purpose of processing
You can synchronize project files (in particular images, labels, project and model settings, trained models, exports and test results) from OneWare Studio to the OneWare Cloud. When you click Train or Sync to Cloud, OneWare Studio compares checksums (SHA-256) of your local files with the files in the cloud and only uploads files that changed. We store the uploaded files, a list of the files with their checksums and sizes, and the time and user of each change, so that changes made in the meantime by other members can be detected. All members of the organization that owns a project can access its files.

The files are stored on our servers in Osnabrück (Germany). Uploading personal data in training data is not intended (see the terms of service); you are responsible for the content you upload.

Legal basis
Art. 6 para. 1 lit. b GDPR (performance of the contract).

Storage period
Project files are stored until they are deleted by a member of the organization, the project is deleted or the organization is deleted. Projects may be deleted 90 days after the last activity, irrespective of the plan; we will inform you in advance. Deleted data may remain in backups for up to 30 days.

Self-hosted workers​

Type and purpose of processing
With a Pro plan, an organization can run the ONE AI worker on its own infrastructure. In this case, project files remain on your infrastructure and are not uploaded to the OneWare Cloud. The worker authenticates with the key of the organization and transmits to us the data required to coordinate and license the jobs: project and model settings, a statistical analysis of the data set that we use to generate the model architecture, progress information, logs, and the project file required for licensing exports. To download the worker image, we issue access data for our container registry (Microsoft Azure Container Registry) to the organization.

Legal basis
Art. 6 para. 1 lit. b GDPR (performance of the contract).

Storage period
Job data and logs are stored together with the project and deleted with it.

AI Assistant / AI Agent (OneWare Cloud website)​

Type and purpose of processing
We provide an AI-based assistance system (AI Agent) within the logged-in area of the OneWare Cloud website. This agent supports you in:

  • Answering product and function-related questions
  • Answering technical questions about ONE AI / ONE WARE
  • Creating technical proposals, configuration files, and parameterizations for ONE WARE products

To ensure that you can view past conversations and reuse configurations, the conversations including your inputs (prompts) and the agent's answers are stored permanently in your user account until you delete them.

Categories of data processed

  • Text inputs by the user (Prompts)
  • Answers generated by the AI Agent
  • Metadata (Timestamp, User/Account ID, Project or Context ID)

Important: The input of personal data into the AI Agent is not intended and prohibited. The processing is not aimed at identifying natural persons.

Legal basis

  • Art. 6 (1) lit. b GDPR (Performance of a contract – Feature of the platform)
  • Art. 6 (1) lit. f GDPR (Legitimate interest in user-friendliness, technical support, and documentation of configurations)

Recipients & Location of processing
The processing of AI requests is carried out by our sub-processor Microsoft Ireland Operations Limited. The processing takes place exclusively in data centers within the European Union (e.g., Sweden).
There is no transfer of data to third countries (outside the EU/EEA) for this purpose.

Storage period
Conversations are stored until you delete them or your user account is deleted.

  • User deletion: You can delete individual conversations effectively immediately in the user interface.
  • Account deletion: Upon deletion of the user account, all stored conversations are permanently deleted.
  • Backups: Deleted data may remain in secure backups for a limited time (e.g., max. 30 days) but is not used productively.

Automated decision-making
There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The AI outputs are non-binding technical suggestions and do not have any legal effect.

User Control
You have full control over your stored conversations. You can view them at any time in your history and delete them individually.

OneWare Agents​

Type and purpose of processing
With OneWare Agents, you can use AI language models of third-party providers in the chat of OneWare Studio via the OneWare Cloud. OneWare Studio sends your inputs (prompts) and, depending on your request, content of your local project (e.g. file contents, error messages and results of tools) through the OneWare Cloud to the provider of the selected model and receives the answer.

We do not store the content of prompts and answers in the OneWare Cloud. The chat history is stored locally on your computer by OneWare Studio. For billing, budgets and usage statistics, we store for each request: user, organization, model, number of input, cached and output tokens, credits charged, the request ID of the provider and the time.

Categories of data processed

  • Text inputs by the user (prompts) and project content included in the request (only transmitted, not stored by us)
  • Answers of the model (only transmitted, not stored by us)
  • Usage metadata (see above)

Important: The input of personal data into OneWare Agents is not intended and prohibited (see the terms of service).

Legal basis

  • Art. 6 (1) lit. b GDPR (performance of the contract – feature of the Software)
  • Art. 6 (1) lit. f GDPR (legitimate interest in the billing and the prevention of misuse)

Recipients & location of processing
The Software shows for each model where it is processed. Organizations can restrict their members to EU models or disable OneWare Agents.

  • Models marked "EU" (e.g. GPT models in the EU data zone) are processed by our sub-processor Microsoft Ireland Operations Limited exclusively in data centers within the European Union.
  • Models marked "Global" (e.g. Claude models) are provided via Microsoft Foundry and may be processed in data centers worldwide, including the USA. For Claude models, Anthropic, PBC (USA) processes the requests as provider of the model on our behalf as a further processor. The transfer to third countries is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and/or standard contractual clauses (Art. 46 para. 2 lit. c GDPR).

Information of the providers on data protection, storage periods and deletion:

Storage period
Usage metadata is stored as long as it is required for billing and statistics and in accordance with statutory retention periods; when your account is deleted, it is linked to a pseudonym instead of your person. The model providers may store requests for up to 30 days to detect and prevent misuse; they do not use them to train their models.

Automated decision-making
There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

Deletion of your account​

You can delete your account at any time in the account settings of the OneWare Cloud. The account page shows what still prevents the deletion: you must first transfer the ownership of organizations with other members, cancel running plans of organizations in which you are the only member, and wait for running jobs to finish.

When your account is deleted:

  • your personal data (name, e-mail address, login, settings and invitations) is deleted,
  • organizations in which you are the only member are deleted together with their projects, files and chat conversations of the AI assistant,
  • projects that you created in organizations with other members remain with the organization and are assigned to another member,
  • credit transactions and subscription data remain stored without reference to your person, as far as this is required for billing and statutory retention obligations (generally 6 or 10 years),
  • usage data (OneWare Agents usage, AI assistant usage and daily activity) is linked to a random pseudonym instead of your account, so that usage statistics remain consistent; the pseudonym contains no name or e-mail address and cannot be traced back to you.

Deleted data may remain in backups for up to 30 days.

Reach measurement​

Type and purpose of processing
Reach measurement is used to evaluate visitor flows to our online offering and may include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values.

With the help of reach analysis, we can, for example, identify at what times our online offering or its functions or content are used most frequently or invite reuse. We can also identify areas that require adjustment.

The tools we use for reach measurement can be found below.

Legal basis
The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest.

Recipients
We use technical service providers for the operation and maintenance of our website, who act as our processors.

Storage
Information on the storage period can be found in the information on the tools used below.

Provision mandatory or required
The provision of data is neither required by law nor contractually required.

Objection
Please read the information on your right to object under Art. 21 GDPR below.

Tools used for reach measurement
Access and usage of cloud.one-ware.com is logged.

Cookies​

A cookie is a small data file that is created when you visit a website and is temporarily stored on the website visitor's system. When the user of the website calls up the server of this website again, the browser of the website user sends the previously received cookie back to the server.

Cookies can make it easier to navigate a website.

Detailed information about cookies and which cookies are used on this website for which purpose can be found at any time in the cookie settings.

Deleting cookies
You can delete individual cookies or the entire cookie inventory. You will also find information and instructions on how to delete these cookies or prevent them from being stored in the first place.

Depending on your browser provider, you will find the necessary information under the following links:

In addition, you can prevent scripts from loading by default. NoScript allows JavaScript, Java, and other plugins to run only on trusted domains of your choice.

Information and instructions on how to edit this function can be obtained from your browser provider (e.g., for Mozilla Firefox: NoScript Addon).

Technically necessary cookies​

Type and purpose of processing
We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies.

We require cookies for the following applications:
(You can find an overview of the cookies used in our cookie consent tool.)

Legal basis and legitimate interest
Data processing is carried out solely on the basis of our legitimate interest in a user-friendly design of our website and in documenting consent in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with §25 para. 2 TDDDG.

Recipients
The recipients of the data are technical service providers who act as processors for the operation and maintenance of our website.

Storage
Please refer to the cookie consent tool for the respective storage period of the cookies.

Provision mandatory or required
The provision of the aforementioned personal data is neither required by law nor contractually required. However, without this data, the service and functionality of our website cannot be guaranteed.

Objection
Please read the information about your right to object under Art. 21 GDPR below.

Embedded YouTube Videos​

Type and purpose of processing
We embed YouTube videos on our website. The operator of the corresponding plugins is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google").

We use the "privacy-enhanced mode" (youtube-nocookie.com) and a "2-click solution" to protect your data. This means that:

  1. When you visit a page with an embedded video, a preview image is loaded. No connection to YouTube servers is established at this stage.
  2. A connection to YouTube servers is only established if you actively click on the video to play it.
  3. By clicking on the video, you give your consent to the data transfer to Google.

If you play a video, Google receives the information that you have accessed the corresponding page of our website. In addition, further data (e.g. IP address, browser information) is transmitted to Google. If you are logged in to your Google account, this data will be assigned directly to your account.

Legal basis
The legal basis for the integration of YouTube and the associated data transfer is your consent (Art. 6 para. 1 lit. a GDPR).

Recipients
The recipient of the data is Google Ireland Limited. It cannot be ruled out that Google also transfers data to servers in the USA.

Revocation of consent
You can revoke your consent at any time by reloading the page or not playing further videos. The revocation of consent does not affect the lawfulness of processing based on consent before its revocation.

Further information
Further information on data protection at YouTube can be found in the provider's privacy policy at: https://policies.google.com/privacy

Use of Google Analytics​

Type and purpose of processing We use Google Analytics on our website, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your device and that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, due to the activation of IP anonymization on this website, your IP address will be processed in shortened form by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator.

Legal basis The legal basis for the use of this service is your consent in accordance with Art. 6 Para. 1 lit. a GDPR.

Recipients The recipient of the data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland as a processor. We have concluded an order processing contract with Google for this purpose. Google Ireland Limited is a subsidiary of Google LLC based in the USA. It cannot be ruled out that your data will also be transmitted by Google to the USA.

Storage period The data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs will be automatically deleted after 14 months. The deletion of data whose retention period has been reached takes place automatically once a month.

Data transfer to third countries Google LLC is certified under the EU-US Data Privacy Framework and thus offers a guarantee of compliance with European data protection law.

Revocation of consent You can revoke your consent at any time with effect for the future by preventing the storage of cookies by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

Information about your right to object under Art. 21 GDPR​

Right to object in individual cases​

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) lit. f GDPR (data processing based on a balancing of interests); this also applies to profiling based on this provision within the meaning of Art. 4 No. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

Recipients of an objection

ONE WARE GmbH
Annengasse 3
33034 Brakel
Germany
Phone: +49 1522 6837464
Email: info@one-ware.com
Website: https://one-ware.com
Managing Directors: Leon Alexander Beier, Ali Durmaz

Changes to our privacy policy​

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

Questions about data protection​

If you have any questions about data protection, please send an email to the person responsible listed above.

This privacy policy was created with the help of activeMind AG – the experts for external data protection officers (version #2024-10-25).