Skip to content
OMBZ
Sign in

Privacy policy

Last updated: 18 Oct 2026

Who is responsible

This website and the OMBZ app are run by Server.Biz BV. Server.Biz BV is the controller for the personal data described in this policy, except for the website data described under "Data about websites". We have not appointed a data protection officer. For anything about your data, use the email address below.

Address
Van Vredenburchlaan 51, 2661 HE Bergschenhoek
Statutory seat
Bergschenhoek
Chamber of Commerce (KvK)
27306767
VAT number
NL818578403B01
Email
privacy@ombz.com
Phone
+31(0)703888649

This website

This website does not use cookies, analytics or tracking scripts, and it loads nothing from other parties. Like every web server, ours keeps standard server logs: IP address, date and time, the page requested, browser type and referring page. We use these logs only to keep the website secure and to fix problems, based on our legitimate interest in a secure website, and delete them after at most 30 days.

Requesting an invite

When you request an invite with the form on this website, your name, work email address, company, website and note are sent to us by email. The website keeps no copy of them. If the email cannot be delivered at once, the request waits in our mail queue and is deleted from it after about a week. We use these details only to reply to your request and, if there is a place, to send you an invite. This is based on our legitimate interest in answering requests, and on your request to take steps before an agreement. We delete the email when it is no longer needed, and at the latest 12 months after we receive it.

To stop misuse, the website counts the requests from each IP address (for IPv6, from its network) for one hour. The address is kept only as a keyed hash that cannot be turned back into the address, and the count is deleted within two hours.

The OMBZ app

The app is only open to people who have been invited. For them we store:

  • Your name and email address.
  • Your password, as a one-way hash. We never store or see the password itself.
  • The secret for two-factor authentication, which every user must set up, stored encrypted.
  • Your active sessions, including IP address and browser, to keep you signed in.
  • A security log of sign-ins and important actions, including the IP address they came from.

The app uses only cookies that are strictly necessary to keep you signed in and to protect forms against misuse. They are not used for tracking.

We process this data to provide the app and to keep it secure. Our agreement is with the business you work for, so for you as a user the legal basis is our legitimate interest, and that of your business, in providing a secure service to its users (Article 6(1)(f) GDPR). If you signed up for your own business as a sole trader, the basis is the performance of our agreement with you (Article 6(1)(b) GDPR). You need to give your name and email address to get an account; without them we cannot give you access.

Business customers in the closed beta also agree to our beta terms.

Signing up for the beta

When a business signs up for the closed beta with an invite code, we also store:

  • The company name, the country and the VAT number of the business.
  • The result of the VAT number check, with the company name and address the check returns.
  • Which versions of the beta terms and the data processing agreement you accepted, when, and (in the security log only) the IP address you accepted them from.

We check the VAT number with VIES, the service of the European Commission that confirms whether an EU VAT number is valid. For this we send the country and the VAT number to the European Commission. When the service cannot be reached, we try again once a day until the number is confirmed or rejected.

We use this data to make sure the beta is only used by businesses and to be able to prove that the beta terms were accepted. The legal basis is our legitimate interest in both (Article 6(1)(f) GDPR). Once we send invoices, we also keep the VAT check because tax law requires it (Article 6(1)(c) GDPR).

The company details and the result of the VAT check are kept as long as the workspace exists. The accepted terms version and the time of acceptance are kept with your account, and in a separate record for 5 years after the workspace ends, so that we can prove which terms applied. That record holds your name and email address, the company name, the documents and versions accepted and when, but no IP address. The IP address is recorded in the security log, which is kept for 12 months. When the workspace or your account is deleted, the other details are deleted with it, unless the law requires us to keep them longer.

Data about websites

For the websites added to it, the app collects data from Google APIs (Search Console, Analytics and PageSpeed Insights) and from DataForSEO, and checks the websites with our crawler, OmbzBot. This is data about websites, such as search statistics and technical issues. Analytics data is aggregated; the app does not receive data about individual visitors.

Some of this data can be personal data, for example a search query that contains a name. For this website data we act as a processor for the business that uses OMBZ, under our data processing agreement. That business decides which websites and Google accounts are connected. Questions about personal data in website data can be sent to that business or to us; we pass them on.

Read our data processing agreement

Connected Google accounts

An owner of a workspace in the app can connect a Google account to import the Search Console and Google Analytics data of that workspace's websites. For each workspace with a connected Google account we store:

  • The email address and the Google account ID of the connected account, to show which account is connected.
  • An OAuth refresh token, stored encrypted, and the permissions the account granted: read-only access to Search Console and Google Analytics, and the account's email address and ID.
  • Short-lived access tokens, stored encrypted for about an hour.

We process these details based on our legitimate interest, and that of the business, in importing the Google data the business asked for (Article 6(1)(f) GDPR).

The access is read-only. We use it only to show the search and traffic statistics of that workspace's websites in the app, and to check ownership of a website through Search Console. We do not sell data from Google and do not use it for advertising. We share it only where a feature you use needs it: if you track a Search Console query as a keyword, that keyword is sent to DataForSEO to check its ranking. It is stored only on our own servers in the Netherlands. We do not use data from Google to develop, improve or train artificial intelligence or machine learning models. Our staff do not look at data from Google, except when you ask us to for support, when needed to investigate security problems or abuse, or when the law requires it.

OMBZ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

An owner can end the access at any time with "Disconnect" on the Integrations page in the app. The Google account holder can also remove OMBZ's access at myaccount.google.com/permissions.

When Google is disconnected, the stored tokens are deleted at once. Imported Search Console and Analytics data stays available in the app until the website or workspace is deleted, so that your history is not lost. An owner of the workspace can ask us to delete it earlier by emailing us; we then delete it within 30 days, and from backups at most 14 days later. The security log, which records connecting and disconnecting Google, is kept for 12 months.

Who processes data for us

We share data only with parties that need it to run OMBZ:

  • Server.Biz BV itself hosts this website and the app on its own servers, in a data centre of We Dare BV in Amsterdam, the Netherlands. We Dare BV provides the space, power and network connection; it does not manage our servers and has no logical access to them or to the data.
  • Server.Biz BV sends email for OMBZ from its own mail server, and receives invite requests in its own mailbox on that server.
  • DataForSEO OÜ (Estonia) provides ranking and backlink data. It receives the keywords, websites and competitor domains to check. It uses sub-processors, some in the United States.
  • Google receives requests from the app to its Search Console, Analytics and PageSpeed Insights APIs. For PageSpeed it receives the addresses of public pages. Google is not our processor: it supplies the data under the Google account holder's own terms.
  • The European Commission receives the country and VAT number for the VIES check.

For the personal data in website data we are a processor; the parties we use for it are on our sub-processors page, with the date of every change.

Data outside the European Union

We store all data in the Netherlands and do not send personal data to countries outside the European Economic Area ourselves. Google LLC, which runs the Google APIs, is based in the United States and is certified under the EU-US Data Privacy Framework. DataForSEO OÜ is based in Estonia; some of its sub-processors are in the United States and rely on the same framework or on the European Commission's standard contractual clauses.

How long we keep data

  • Account data: as long as you have an account. Deleted with the account.
  • Sessions: until they expire.
  • Security log: 12 months.
  • Server logs: at most 30 days.
  • Invite request emails: at most 12 months.
  • Company details and VAT check: as long as the workspace exists.
  • Record of accepted terms: 5 years after the workspace ends.
  • Google tokens: until Google is disconnected.
  • Website data: until the website or workspace is deleted, or earlier on request.
  • Backups: at most 14 days.

Security

We protect your data with two-factor authentication for every user, encryption of secrets and Google tokens, strict separation between workspaces, and access for our staff only where needed.

Your rights

Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict its processing, and to receive it in a portable format. Send your request to the email address below; we answer within one month and may ask you to confirm your identity. We do not make decisions about you based solely on automated processing. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Right to object: where we process your data based on our legitimate interest, you can object to that processing at any time, for reasons relating to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish or defend legal claims.

Changes to this policy

We update this policy when our processing changes. The date at the top shows the latest version. We email workspace owners about important changes.

Contact

Questions about this policy or your data? Email us at privacy@ombz.com.