Ordemio

GDPR overview

The privacy policy, effective 1 June 2024, engages with the GDPR in concrete terms rather than in passing. It names its legal bases: Article 6(1)(b) for performance of the contract, 6(1)(f) for legitimate interest and 6(1)(a) for consent to certain cookies. It states that when Ordemio acts as a processor it complies with Article 28(3)(g) on deletion or return of data, with defined timeframes. EU Standard Contractual Clauses are signed with customers for transfers outside the EEA, the UK and Switzerland. Data subject rights are listed, including access, rectification, erasure, objection, restriction, portability and withdrawal of consent, together with the right to complain to a supervisory authority. Two gaps remain: no Article 27 EU representative is designated and no data protection officer is named. A separate section covers California residents under the CCPA and CPRA.

Who owns the data?

The terms are explicit that the customer keeps ownership: Ordemio states it claims no ownership rights in any user content, and describes itself as acting solely as the customer's processor, with the customer as controller. In exchange, the customer grants Ordemio a worldwide, irrevocable, perpetual, non-exclusive, transferable and sublicensable licence to use that content to operate and improve the service. Ordemio and its licensors own the AI functions themselves and all associated intellectual property. Because Ordemio has no direct relationship with the customer's own end users, the customer carries full responsibility for holding the permission and legal basis covering their data.

Reuse rights

Customers keep full freedom over their own content: the terms state that nothing in the agreement restricts whatever rights they already have to use and exploit it, so no permission is needed to reuse it elsewhere. On Ordemio's side the licence is broad. It covers processing, storing and using AI content to further train, develop, enhance and improve the services and the AI functions, and anonymised, aggregated usage data may be used for any business purpose. The privacy policy nevertheless states in capitals that personal data is not used to train large language models or other foundational models where it could be exposed to third parties, and third-party subprocessors are contractually barred from training their own models on customer content. No way to opt out of the service-improvement use is documented anywhere. Ordemio also states that it does not sell customer data.

Data retention & training

Hosting summary

Ordemio names no hosting region and no data centre. Its privacy policy says only that personal data may be stored and processed in any country where the company has facilities or engages service providers, including in the United States, a formulation that commits to nothing beyond that one country. Transfers out of the EEA, the UK and Switzerland are covered by EU Standard Contractual Clauses signed with customers, and the policy states that appropriate safeguards and supplementary measures apply. The product pages add that AI models run on Azure OpenAI and AWS Bedrock, and that data is encrypted with AES-256 at rest and in transit over TLS 1.3. For buyers who cannot accept that vagueness, Ordemio offers self-hosting on the customer's own servers or VPC, which moves the question entirely inside the customer's own infrastructure. Note that the server address resolved for the domain sits on an anycast network, so it says nothing about where data actually lives.