Privacy Notice

Pre-Launch Waitlist · Expression of Interest

Last updated: 28 April 2026

1. Who is responsible for your data

Ooni is currently a pre-launch project run jointly by its founders, pending the incorporation of the dedicated operating company that will succeed them (the “Future Company”).

During this pre-launch phase, the founders act as joint Data Controllers within the meaning of Article 26 of Regulation (EU) 2016/679 (GDPR). They are jointly responsible for deciding why and how your personal data is processed in connection with the Ooni Waitlist, and they act through the project name “Ooni”.

Public contact point: privacy@ooni.com — for any privacy-related question, request or right under GDPR. This mailbox is monitored regularly and is the single point of contact for data subjects.

As a data subject you have the right to know the identity of the natural persons acting as joint Data Controllers. The full identification details of the founders (name, ID number, contact address) are available to you on written request to privacy@ooni.com and will be provided promptly. From the date of incorporation of the Future Company, that company will become the sole Data Controller and its full identification details (legal name, NIF, registered office, contact details) will be published in this Notice — see Section 9.

Data Protection Officer: Ooni has not appointed a Data Protection Officer. Appointment is not required under Article 37 GDPR for the scope and volume of data processed by the Waitlist (no large-scale systematic monitoring and no large-scale processing of special-category data). For all privacy matters, please use the public contact point above.

2. What this Notice covers

This Notice explains how Ooni collects and uses your personal data when you submit the expression-of-interest form on the Ooni website (the “Waitlist Form”) to register your interest in becoming an Ooner — that is, a current student or recent alumnus of an educational institution who would share their academic and life experience with prospective students once Ooni is launched.

This Notice is provided in compliance with Articles 13 and 14 of the GDPR and the Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

3. What personal data we collect

Through the Waitlist Form, Ooni collects only the information you voluntarily provide. This typically includes:

• Identification data: full name and, where you choose to provide it, surname;
• Contact data: email address and, optionally, phone number;
• Academic data: country of study, educational institution, programme, year of study or graduation;
• Background data: country of origin, country of residence, languages spoken;
• Profile signals: optional links you choose to share (e.g., LinkedIn or other public profiles), short text describing why you are interested in becoming an Ooner;
• Technical data automatically generated when you visit the website: IP address, browser type, device type, approximate location, referring page, and similar log data.

Ooni does not knowingly collect special categories of data (health, religion, ethnicity, political views, sexual orientation, etc.) through the Waitlist Form. Please do not include such information in free-text fields.

The Waitlist Form is intended only for adults aged 18 or over. Ooni does not knowingly collect data from minors during the pre-launch phase.

4. Why we use your data and on what legal basis

Your personal data is used for the following purposes, on the legal bases set out below:

4.1 Managing your expression of interest. Recording your sign-up, evaluating your potential fit as a future Ooner, and contacting you about Ooni’s launch and onboarding. Legal basis: your consent (Art. 6.1.a GDPR) and pre-contractual measures taken at your request (Art. 6.1.b GDPR).

4.2 Pre-launch communications. Sending you news, updates and information about the Ooni project, the launch timeline and the Ooner application process. Legal basis: your consent (Art. 6.1.a GDPR), where you have ticked the corresponding optional consent on the Waitlist Form.

4.3 Security, fraud prevention and quality. Protecting the website against abuse, spam, scraping or fraudulent sign-ups, and maintaining basic logs. Legal basis: Ooni’s legitimate interest in keeping the service safe (Art. 6.1.f GDPR).

4.4 Legal compliance. Responding to lawful requests from competent authorities and complying with applicable laws. Legal basis: legal obligation (Art. 6.1.c GDPR).

4.5 Statistical and analytical purposes. Analysing aggregated and anonymised data to understand the audience’s interest, plan the launch and improve the website. Legal basis: legitimate interest (Art. 6.1.f GDPR).

Providing your data is voluntary. However, if you do not provide the minimum information requested (typically email and country of study), we will not be able to register your expression of interest.

No automated decision-making. Ooni does not use automated decision-making or profiling within the meaning of Article 22 GDPR — that is, decisions producing legal or similarly significant effects on you and taken solely on automated grounds. Any review of Waitlist sign-ups is carried out by the founders themselves.

5. Who has access to your data

Your personal data is accessed and processed only by the Ooni founders and a limited number of carefully selected service providers acting as data processors (Art. 28 GDPR), under written agreements that require them to protect your data and use it only on Ooni’s instructions. The current sub-processors are:

• Vercel Inc. (United States) — website hosting, edge delivery and serverless functions that receive Waitlist Form submissions. Transfers outside the EEA are covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses, as applicable;
• Resend (Resend Inc.) (United States) — transactional email delivery: confirmation emails to applicants and notification emails to the founders. Transfers covered by EU Standard Contractual Clauses;
• IT support, security and backup providers, where engaged.

Founders’ mailboxes. Notifications of new Waitlist submissions are delivered to hi@ooni.education and, as a deliverability fallback during the pre-launch phase, to a founder’s personal Gmail account hosted by Google Ireland Limited. This fallback will be migrated to an @ooni.education mailbox once the corporate domain is fully provisioned. The personal Gmail account is access-restricted to the founder concerned and is used solely to receive these notifications, never for marketing or onward sharing.

Ooni does not currently install website analytics, advertising or third-party tracking. If that changes in the future, the new processor and its purpose will be added to this Section and to the Cookie Policy before activation.

Ooni does not sell your data and does not share it with third parties for their own marketing purposes.

Your data may also be disclosed to competent authorities (police, judicial authorities, data-protection authorities) where required by law, and to the Future Company once it is incorporated, as described in Section 9.

6. International transfers

Some of the service providers used by Ooni (for example, email or website-analytics tools) may be based outside the European Economic Area (EEA), in particular in the United States. Where this is the case, Ooni relies on the safeguards provided by Articles 44–49 GDPR, including:

• Adequacy decisions issued by the European Commission (e.g., the EU-US Data Privacy Framework, where applicable);
• EU Standard Contractual Clauses signed with the relevant provider;
• Where required, additional technical and organisational measures.

You may request more information about these safeguards by writing to privacy@ooni.com.

7. How long we keep your data

Your personal data is kept only for as long as necessary for the purposes for which it was collected:

• Waitlist sign-ups are retained until Ooni is officially launched and for a reasonable transition period afterwards, in order to invite you to apply as an Ooner;
• If you withdraw your consent or ask to be removed from the Waitlist before launch, your data will be deleted within thirty (30) days, except for a minimal record kept to evidence your deletion request and to prevent re-contact;
• Aggregated and anonymised statistical data may be retained indefinitely, as it no longer allows you to be identified;
• Data may also be retained for longer where this is necessary to comply with legal obligations or to defend against potential legal claims, in accordance with applicable limitation periods.

8. Your rights under GDPR

As a data subject, you have the following rights:

• Right of access: to obtain confirmation as to whether your personal data is being processed and, if so, to access that data;
• Right to rectification: to have inaccurate or incomplete data corrected;
• Right to erasure (right to be forgotten): to have your data deleted in the cases provided by law;
• Right to restriction of processing: to limit how your data is used in certain circumstances;
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller;
• Right to object: to object, on grounds relating to your particular situation, to processing based on legitimate interests, including profiling;
• Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Right not to be subject to automated decisions: including profiling, where these produce legal or similarly significant effects on you;
• Right to know the identity of the joint Data Controllers: full identification details of the founders are available on written request to privacy@ooni.com;
• Right to lodge a complaint: with the Spanish Data Protection Agency (AEPD), at C/ Jorge Juan 6, 28001 Madrid, or at www.aepd.es.

To exercise any of these rights, please write to privacy@ooni.com, indicating which right you wish to exercise. We may ask you for reasonable proof of identity to protect your data. We will respond within one (1) month from receipt of your request, which may be extended by two further months in complex cases.

9. Transfer to the Future Company

You expressly acknowledge and accept that, upon incorporation of the Future Company, the Ooni founders may transfer your personal data and your expression of interest to the Future Company, which will succeed them as Data Controller. From the date of such transfer:

• All references in this Notice to “Ooni” acting as Data Controller shall be read as references to the Future Company;
• The full identification details of the Future Company (legal name, NIF, registered office, contact details) will be published in an updated version of this Notice and communicated to you by email;
• You will continue to enjoy the same GDPR rights and may, if you wish, withdraw your consent or ask to be removed from the Waitlist;
• This transfer does not require you to renew your consent on the Waitlist Form.

Until this transfer takes place, the Ooni founders remain personally responsible, as joint Data Controllers, for the processing of your data.

10. Cookies and similar technologies

The Ooni website may use cookies and similar technologies to ensure correct functioning of the site, remember your preferences, and (where applicable) measure audience and performance. Strictly necessary cookies do not require consent. Any analytics, advertising or third-party cookies are only activated where you give your specific consent through the cookie banner displayed when you first visit the site.

You can change your cookie preferences at any time through the “Cookie settings” link in the footer of every page on this site. Detailed information on the specific entries we set is available in our Cookie Policy.

11. Security

Ooni implements reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure, including secure connections (HTTPS), restricted internal access, regular backups and trusted service providers. No system can be guaranteed 100% secure, but in the event of a personal data breach affecting your rights and freedoms, Ooni will inform the AEPD and, where required, you, in accordance with Articles 33 and 34 GDPR.

12. Changes to this Notice

This Notice may be updated to reflect changes in the law, in the Ooni project (in particular when the Future Company takes over), or in the way data is processed. The “Last updated” date at the top of the document indicates the most recent version. Material changes will be communicated to you by email or through the website. Continued use of the website after the effective date constitutes acknowledgement of the updated Notice; this does not, however, replace the consent we obtained from you on the Waitlist Form, which can always be withdrawn.

13. Contact

For any question or request regarding this Notice or your personal data, please contact: privacy@ooni.com.

For general (non-privacy) queries about Ooni, you can also reach us at hi@ooni.education.