GDPR Compliance

Last updated: November 2026

Overview

OmniColor is committed to compliance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — which governs how personal data of individuals in the European Economic Area (EEA) is handled. This page explains how we meet our GDPR obligations and what rights you have as an EU/EEA resident.

For the full picture of what data we collect and how we use it, see our Privacy Policy. This page focuses specifically on GDPR principles and requirements.

Data Controller

The data controller for OmniColor is the OmniColor project. For data protection matters, contact:

Data Protection Contact: privacy@omnicolor.pages.dev

We do not have an EU representative under Article 27 because we do not meet the thresholds requiring one — we are a small, non-commercial-oriented project with limited data processing activities.

Our GDPR Principles

We process personal data according to the seven GDPR principles:

1. Lawfulness, Fairness, Transparency

We process data only with a lawful basis and disclose our practices clearly (this page and our Privacy Policy). We do not use dark patterns, deceptive consent mechanisms, or pre-checked boxes.

2. Purpose Limitation

We collect data only for specific, explicit purposes:

  • Essential cookies: For site functionality (saved colors, cookie consent)
  • Analytics (opt-in): For understanding aggregate site usage
  • Advertising (opt-in): For serving relevant advertisements
  • Contact form: For responding to inquiries

We do not repurpose data for other purposes without fresh consent.

3. Data Minimization

We collect the minimum data necessary for each purpose. For example:

  • We do not require email signup to use tools
  • We do not collect names unless you contact us
  • We do not track your tool usage beyond aggregate analytics
  • We process images entirely client-side — never receiving them on our servers

4. Accuracy

We do not maintain persistent profiles, so accuracy concerns rarely apply. If you contact us and your information is incorrect, you can ask us to correct it.

5. Storage Limitation

We retain data only as long as necessary:

  • Server logs: Maximum 30 days
  • Contact form messages: Until inquiry resolved, then deleted
  • Analytics data: Aggregated, no individual retention
  • Local storage in your browser: Persists until you clear it

6. Integrity and Confidentiality

We protect data with:

  • HTTPS encryption for all connections
  • No storage of sensitive personal data
  • Access controls on any administrative systems
  • Regular security reviews

7. Accountability

We take responsibility for GDPR compliance. This page, our Privacy Policy, and our internal practices demonstrate our commitment. We do not outsource accountability to third parties.

Legal Bases for Processing

Under Article 6 of the GDPR, we rely on the following legal bases:

Consent (Article 6(1)(a))

For:

  • Analytics cookies
  • Advertising cookies
  • Personalized advertising
  • Marketing emails (we do not currently send any)

Consent is freely given, specific, informed, and unambiguous. You may withdraw consent at any time.

Legitimate Interest (Article 6(1)(f))

For:

  • Security (detecting and preventing abuse)
  • Basic site analytics for site improvement (aggregated only)
  • Responding to inquiries you initiate

We have conducted a legitimate interest assessment (LIA) for these uses and believe they do not override your rights and freedoms.

Contract (Article 6(1)(b))

For:

  • Responding to support inquiries when you have requested our service

Your GDPR Rights

As an EU/EEA resident, you have the following rights:

Right to be Informed (Article 13-14)

You have the right to know what data we collect, why, and how long we keep it. Our Privacy Policy and this page provide that information.

Right of Access (Article 15)

You can request a copy of any personal data we hold about you. Given our minimal data collection, most users have no data on our servers — only localStorage in your own browser.

Right to Rectification (Article 16)

You can request correction of inaccurate personal data. Contact us if any data we hold is incorrect.

Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your personal data. Common ways to exercise this:

  • Clear your browser localStorage for omnicolor.pages.dev to delete locally-stored preferences
  • Contact us to delete any server-held data (contact form messages, etc.)
  • Opt out of ad networks via their own tools to remove advertising data

Right to Restrict Processing (Article 18)

You can request that we restrict processing of your data while we investigate a concern. Contact privacy@omnicolor.pages.dev.

Right to Data Portability (Article 20)

You can request any personal data we hold in a machine-readable format (JSON or CSV). Since we hold almost no personal data, this is rarely relevant, but we will comply on request.

Right to Object (Article 21)

You can object to processing based on legitimate interest. We will stop processing unless we have compelling legitimate grounds that override your rights.

Rights Related to Automated Decision-Making (Article 22)

We do not make automated decisions that have legal or significant effects on you. Advertising targeting is done by ad networks, not by us.

Right to Withdraw Consent (Article 7(3))

You can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of prior processing. Clear your browser's site data for omnicolor.pages.dev to reset cookie consent.

Right to Lodge a Complaint (Article 77)

You have the right to complain to a supervisory authority in your EU/EEA country of residence. A list of supervisory authorities is available from the European Data Protection Board: edpb.europa.eu.

Exercising Your Rights

To exercise any of the above rights, email privacy@omnicolor.pages.dev with:

  • The specific right you are exercising
  • Any details needed to identify your data
  • Your contact information for our response

We respond to all valid requests within 30 days (as required by Article 12(3)). If we need more time (for complex requests), we will inform you within 30 days and explain the extension.

There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

Data Processors and Transfers

We work with the following data processors:

  • Cloudflare: Hosting and CDN. Data processing agreement in place. Standard Contractual Clauses apply for EU-US transfers.
  • Adsterra: Advertising. See their DPA and privacy policy.
  • Google AdSense: Advertising (if enabled). Google is GDPR-certified under the EU-US Data Privacy Framework.

Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

International Data Transfers

Because our infrastructure is distributed globally, some data processing may occur outside the EEA. We ensure all transfers have appropriate safeguards:

  • SCCs with Cloudflare and advertising networks
  • EU-US Data Privacy Framework for certified US companies
  • No transfers to countries without adequate protection

Cookies and ePrivacy

Our use of cookies complies with the ePrivacy Directive (2002/58/EC as amended):

  • Essential cookies load without consent (legitimate interest)
  • Non-essential cookies (analytics, advertising) require explicit opt-in consent
  • Consent is granular — you can accept analytics without accepting advertising, or vice versa
  • Rejecting is as easy as accepting (no dark patterns)

See our Cookie Policy for details.

Children's Data

OmniColor is not directed at children. We do not knowingly process data of children under 16 without parental consent (as required by Article 8 of GDPR). If we become aware we have collected such data, we will delete it promptly. Contact privacy@omnicolor.pages.dev if you believe we hold data on a child.

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority within 72 hours of becoming aware (Article 33)
  • Notify affected individuals without undue delay (Article 34), if the breach is likely to result in high risk
  • Publish a summary on our trust center

Given our minimal data collection, the risk profile of any breach is inherently low.

Privacy by Design

OmniColor is built with privacy by design (Article 25):

  • All tools process data locally — client-side, not server-side
  • No account system means no credential handling
  • No persistent user tracking
  • No third-party scripts loaded without consent
  • No data retention beyond what is necessary

Changes to This Page

We may update this page to reflect changes in our practices or evolving GDPR interpretation. The "last updated" date reflects the most recent change.

Contact

For GDPR-related questions or requests:

Email: privacy@omnicolor.pages.dev

For all other inquiries, see our Contact page.