CROBenchmark

GDPR overview

GDPR is addressed concretely rather than in passing. Omniconvert SRL is established in Romania, inside the EU, so no Article 27 representative is required or named. A processing agreement based on Article 28 is published as Annex 1 to the terms and is also available inside the customer account. One subprocessor is named outright, Digital Ocean, USA, under signed Standard Contractual Clauses and running on servers in the Netherlands, and the terms guarantee that every subprocessor processes exclusively within the EU, the EEA, an adequate country or under SCCs. Data subject rights are listed in full, including objection to automated decisions and profiling, exercised by dated written request to contact@omniconvert.com. Breach notification, external compliance audits and deletion within 30 days of termination are covered. No SOC 2 or ISO 27001 certification is claimed.

Who owns the data?

Under Omniconvert's terms the customer remains the data controller and Omniconvert SRL acts as data processor, handling personal data only on documented instructions through an Article 28 agreement attached as Annex 1. The software itself, including code, images and algorithms, stays the publisher's property. One clause deserves attention: customers authorise Omniconvert to exploit statistical data drawn from their accounts to improve the service and to build benchmarks for internal use or public presentation, provided the output is aggregated beyond any link to an individual controller. Omniconvert may also display a customer's logo as a client reference unless the customer objects in writing.

Reuse rights

Audit results are delivered for the customer's own use, and nothing in the terms restricts acting on them internally or handing them to an agency. The published research is more explicit still: the 2026 benchmark report, its data tables, charts and press kit are free to cite with attribution, and the CRO Leaderboard is openly browsable. Reuse runs the other way too. Omniconvert reserves the right to draw on account data in aggregated, non-identifiable form for its own benchmarks and public presentations, which is how the 7,000-store report was assembled. No licence is granted over the product itself, whose code, images and algorithms remain the publisher's property, and the terms permit no resale or sub-licensing of the service.

Data retention & training

Hosting summary

Omniconvert SRL is established in Bucharest, Romania, and therefore operates inside the European Union. The terms name one IT subprocessor explicitly: Digital Ocean, USA, which has signed adequate Standard Contractual Clauses and runs the processing on servers located in the Netherlands. Beyond that named case, the agreement commits every present and future subprocessor to processing exclusively within an EU member state, within the EEA, in a country recognised as adequate by the European Commission, or under signed SCCs. Customers must be informed of any addition or replacement of a subprocessor and may object in writing within five business days. Two caveats are worth stating. The domain resolves to a Cloudflare anycast node, which reflects content delivery and says nothing about where personal data is stored. More importantly, these commitments come from Omniconvert's general product terms rather than documentation specific to CROBenchmark, so the arrangement for this particular product is inferred from the publisher's stated practice.