Optioryx

GDPR overview

Implementation is concrete and documented. Optioryx BV is established in Belgium, so the GDPR applies directly and no Article 27 representative is required or appointed. The privacy policy, last updated 05.06.2026, separates the controller and processor roles, names a DPO reachable at info@optioryx.com, and lists the full set of rights, including complaint to a supervisory authority. Article 15 of the terms and conditions is presented as the data processing agreement under Article 28: Annex 1 carries the Article 28 information, Annex 2 the technical and organisational measures, and the article covers confidentiality, subprocessors, assistance with rights requests and DPIAs, breach notification, and destruction or return of personal data at the end of the contract. No transfer outside the EEA without prior written consent or adequacy safeguards. The Belgian Data Protection Authority is named as the supervisory authority. ISO 27001 is claimed.

Who owns the data?

The terms and conditions are explicit: performing the agreement changes nothing about who owns what (art. 14.1). The client keeps ownership of Client Data, Optioryx keeps ownership of Optioryx Data (art. 14.2), and the client remains responsible for the accuracy and legality of its data and for any third-party permissions attached to it (art. 14.3). For personal data the client is the controller and Optioryx the processor (art. 15.2); the privacy policy adds that Optioryx is controller only for its own website and account data, and processor for whatever customers capture through Flux. If Optioryx were to discontinue, the client obtains access to its data, passwords and encryption keys (art. 19.4).

Reuse rights

Client Data stays the client's, so it can be reused freely: Flux centralizes what is captured, exports it to Excel and shares it through the API without asking anyone. On termination Optioryx hands over the last backup of Client Data, but in a format Optioryx chooses and subject to payment of outstanding amounts plus retrieval fees (art. 20.2 iii). What the client cannot reuse is the software itself: art. 6 and art. 8 grant a licence to use, not to copy, modify, decompile, republish or distribute, and art. 8.2 and art. 22 forbid derivative works without prior written consent. On its side Optioryx may use and disclose Client Data to perform the contract, and in aggregated, non-identifiable form for internal usage statistics, service improvement and communication (art. 14.4 ii); art. 15.6 bars any other processing for its own or a third party's purposes. Clients are told not to send special categories of data or anything not strictly necessary (art. 15.5). Website visitors keep the full set of GDPR rights: access, rectification, erasure, portability, objection and restriction.

Data retention & training

Hosting summary

No hosting country or region is published. Article 10.1 of the terms and conditions commits Optioryx to hosting the software either on its own servers or with a professional third-party provider; article 10.2 states that the current third-party hosting provider is listed in Annex 3 to the agreement, an annex that never appears on the site, and that Optioryx may change provider at any time by notifying the client. Article 14.4 (iii) is equally open, allowing Client Data to be transferred or stored within and/or outside the European Economic Area under applicable law, so no region is actually committed to. The safeguards are contractual: article 15.7 forbids any transfer of personal data outside the EEA without the client's prior written consent or without an adequacy decision, binding corporate rules or standard contractual clauses, and the privacy policy repeats that transfers only go to countries judged adequate by the European Commission or under agreements guaranteeing an adequate level. Technical and organisational measures sit in Annex 2, also unpublished. ISO 27001 is claimed, with a trust center whose contents could not be read. The site's IP address is a Cloudflare anycast node and says nothing about where customer data lives.