Privacy policy

Data controller

OKTRI SRL, established in Las Terrenas, Samaná province, Dominican Republic, determines the purposes and means of the processing described below.

Any question about your data can be sent to contact@oktri.io.

Application of the European regulation

Oktri is established outside the European Union but offers its services to organisations located within the Union. Regulation (EU) 2016/679 (GDPR) therefore applies to the processing described here, pursuant to its Article 3(2).

Representative in the Union (Article 27): [À COMPLÉTER]. In principle, a controller established outside the Union designates in writing a representative established in a Member State where the data subjects are. An exemption exists for occasional processing that does not involve special categories of data on a large scale and is unlikely to result in a risk; the continuous operation of a website with a client area is unlikely to qualify.

Data processed, purposes and legal bases

Contact form

Data: name, email address, company (optional), message content, language of the enquiry.

Purpose: handling and answering your enquiry.

Legal basis: legitimate interest (Article 6(1)(f)) in responding to a professional enquiry addressed to us.

Retention: three years from the last exchange, then deletion.

Client area

Data: company name, contact name, email address, password hash, sign-in timestamps, deliverables made available.

Purpose: providing access to documents produced during our engagements.

Legal basis: performance of a contract (Article 6(1)(b)).

Retention: for the duration of the contractual relationship, then five years for accounting and evidential obligations.

Analytics

Tool: Plausible Analytics, installed on our own servers. No data is sent to any third party, no cookie is set, and no individual profile is built. Measurements are aggregated.

Legal basis: consent (Article 6(1)(a)). The analytics script is loaded only after your explicit acceptance, and no request is made to the analytics domain before that choice.

Retention: aggregated, non-identifying data kept for twenty-four months.

Technical logs

Data: IP address, timestamp, requested resource, user agent.

Purpose: service security, abuse detection and form rate limiting.

Legal basis: legitimate interest (Article 6(1)(f)) in preserving the integrity and availability of the service.

Retention: twelve months at most.

Recipients

Your data is neither sold, rented nor transferred. It is accessible only to those within Oktri who need it, and to the following technical providers acting as processors:

Hostinger International Ltd: hosting of the site, the application and the databases. Servers located in the United Kingdom.

Resend: delivery of transactional emails, such as client area password resets. Provider established in the United States. [À COMPLÉTER]: state the transfer mechanism relied upon, applicable adequacy decision or standard contractual clauses.

Transfers outside the European Union

United Kingdom, where the servers are located: the European Commission renewed its adequacy decision on 19 December 2025, in force until 27 December 2031. Transfers to that country therefore require no additional safeguard.

Dominican Republic, where the controller is established: that country is not covered by any adequacy decision. Access to data from that territory is governed by [À COMPLÉTER]: the Commission's standard contractual clauses, or a duly justified Article 49 derogation.

Your rights

You have the rights of access, rectification, erasure, restriction of processing, objection and portability, as well as the right to withdraw your consent at any time where processing relies on it.

These rights can be exercised at contact@oktri.io. You will receive a reply within one month, extendable by two months for complex requests.

You may lodge a complaint with the supervisory authority of your Member State of residence, place of work, or the place where the alleged infringement occurred.

Cookies and trackers

This site sets no advertising cookie and embeds no third-party tracker.

A session cookie is used in the client area, strictly necessary for authentication. As such, it is exempt from consent.

Your choice regarding analytics is stored in your browser's local storage. That information never leaves your device and is sent to no server.

Security

Exchanges with this site are encrypted in transit. Passwords are stored as hashes and are never kept in clear text.

Client area deliverables are stored outside any publicly accessible directory: downloading them is subject to the same access control as displaying them, so one client cannot reach another's documents, even knowing a file's address.

Changes

This policy may be updated to reflect changes in processing or in the regulatory framework. The date of the last update appears at the top of this page.