Privacy

Data Controller

Okra Ecosystem — Basel, Switzerland. For all data protection inquiries, contact our compliance team at compliancealerts@mail.weareokra.ch.

Information We Collect

We collect only the information you provide directly:

• Name and email address — when you subscribe to our newsletter (with your explicit consent).
• Name, email, and message content — when you contact us via our contact form.
• IP address and user agent — collected at the time of newsletter signup for fraud prevention and compliance auditing. Retained only as long as necessary for audit purposes.

We do not track, sell, or share your personal data with third parties. We do not use cookies for tracking or advertising purposes.

For details on the cookies we do use (mandatory and optional), see our Cookie Policy.

Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Art. 6):

• Consent (Art. 6(1)(a)) — for newsletter subscriptions. You give explicit consent via a checkbox, and we confirm via double opt-in email.
• Legitimate Interest (Art. 6(1)(f)) — for responding to contact inquiries and managing artist/event bookings.
• Legal Obligation (Art. 6(1)(c)) — for maintaining compliance audit logs as required by Swiss and EU data protection law.

Newsletter & Double Opt-In

Our newsletter subscription uses a verified double opt-in process:

1. You provide your name, email address, and explicit consent via checkbox.
2. We send a confirmation email with a unique verification link (valid for 48 hours).
3. Your subscription is activated only after you click the confirmation link.

Every marketing email includes a one-click unsubscribe link. You may withdraw your consent at any time by unsubscribing or emailing compliancealerts@mail.weareokra.ch.

Data Retention

• Newsletter subscriptions — retained until you unsubscribe or withdraw consent. Unconfirmed pending subscriptions are automatically deleted after 7 days.
• Compliance audit logs — retained for the duration required by applicable law. These are immutable records of consent actions.
• Contact inquiries — retained for the duration of the inquiry and up to 12 months thereafter, unless a longer retention is required by law.

Your Rights (GDPR)

You have the following rights under the General Data Protection Regulation:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — request correction of inaccurate data.
• Right to erasure (Art. 17) — request deletion of your personal data.
• Right to restriction (Art. 18) — request restriction of processing.
• Right to data portability (Art. 20) — request transfer of your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact our compliance team. We will respond within 30 days as required by GDPR.

Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted database storage
• HTTPS-only data transmission
• Access controls on administrative functions
• Regular security audits

Third-Party Processors

We use the following sub-processors who may process your personal data on our behalf:

• Cloudflare, Inc. — CDN and hosting (data centers in the EU).
• Namecheap, Inc. — email services for compliance alerts.

All sub-processors are bound by data processing agreements that comply with GDPR Art. 28.

Complaints

If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with your local data protection authority. In Switzerland, the relevant authority is the Federal Data Protection and Information Commissioner (FDPIC).

Contact

Okra Ecosystem — Basel, Switzerland.
Compliance inquiries: compliancealerts@mail.weareokra.ch
General inquiries: contact@mail.weareokra.ch