Privacy & Cookie Policy

Last updated: 27 July 2026

Sensorama™ is a product of The Origin Institute B.V. (KvK 97905682 · VAT NL868283496B01), Wageningen, the Netherlands. We are committed to protecting your privacy and being transparent about how we handle data.

This page is a plain-language summary. The full legal documents are here: Terms of Service · Privacy Policy · Cookie Policy · Data Processing Agreement · Acceptable Use Policy. If anything on this page differs from those documents, the full documents prevail.

1. What Data We Collect

Contact Form

When you submit the contact form on our website, we collect:

First name, last name
Email address
Phone number (optional)
Company / organisation (optional)
Your message

This data is stored in our local database and used solely to respond to your inquiry. It is never sold or shared for marketing purposes; it is processed only by the infrastructure providers listed in Section 3.

Job Applications

When you apply via our jobs page, we collect your name, contact details, and the application materials you submit (CV, links, motivation). We use them only to evaluate your application. Unless you ask us to delete them sooner, we keep applications for up to 12 months after the application process concludes — so we can consider you for future openings — and then delete them. You can request earlier deletion at any time (see Section 5).

Platform Usage (Analyst Dashboard, Panel Portal, Booth)

When you use the Sensorama platform, we store:

Account information (name, email, login code)
Sensory evaluation responses and session data
Project configurations and study designs

All data belongs to your organisation. We do not access, analyse, or share your sensory data unless explicitly requested for support purposes.

2. Cookies

Sensorama uses essential cookies only. We do not use tracking cookies, advertising cookies, or any cookie-based analytics. (Our site statistics come from Cloudflare Web Analytics, which is cookie-less — see Section 3.)

Cookie	Purpose	Type	Duration
`_streamlit_xsrf`	Cross-site request forgery protection for the analyst dashboard and booth	Essential	Session
`__cf_bm`	Cloudflare bot management - protects against automated attacks	Essential (third-party)	30 minutes
`sensorama_cookie_ok`	Remembers that you acknowledged this cookie notice	Preference (localStorage)	Persistent

No consent is required for strictly necessary cookies under GDPR Article 6(1)(f) and the ePrivacy Directive. We inform you about them as a transparency measure.

3. Third-Party Services

Service	Purpose	Data Shared
Cloudflare	CDN, DDoS protection, SSL termination	IP address (processed, not stored by us)
Cloudflare Web Analytics	Aggregate site statistics (page views, visit counts)	None — cookie-less, no personal data, no individual visitor tracking
Google LLC (Gmail/SMTP)	Transactional email (invitations, notifications, replies)	Email address and message content of emails we send you

We do not use Google Analytics, Facebook Pixel, Hotjar, or any other tracking or advertising service. Our only analytics is the privacy-preserving, cookie-less Cloudflare Web Analytics described above — full details in the Cookie Policy.

Our own web server additionally keeps aggregate visit statistics (page viewed, country code, referring site) for the pages of this website. It does not store IP addresses or any identifier that could follow a visitor across days.

4. Data Storage & Security

Your application data is primarily stored and processed on infrastructure within the European Economic Area (EEA). Limited technical data (such as IP addresses and email traffic) may transit Cloudflare and Google infrastructure outside the EEA; both are certified under the EU-US Data Privacy Framework, with Standard Contractual Clauses as an additional safeguard — see the Privacy Policy and DPA
Passwords are hashed with PBKDF2-SHA256 (260,000 iterations, 256-bit salt)
All connections are encrypted via HTTPS (TLS 1.3)
Session tokens use HMAC-SHA256 signatures
We never store passwords in plaintext

5. Your Rights (GDPR)

As a data subject in the EU, you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data (“right to be forgotten”)
Port your data to another service
Object to processing
Withdraw consent at any time

To exercise any of these rights, contact us at the address below.

6. Data Retention

Contact form submissions: retained until inquiry is resolved, then archived
Job applications: retained for up to 12 months after the application process concludes, then deleted (earlier on request)
Platform accounts: retained while the account is active
Sensory data: retained while the organisation’s subscription is active. Exported on request upon cancellation
Customer research data is never deleted without explicit request - we archive instead. Personal data from the contact and job-application forms follows the retention periods above

7. Children

Sensorama is a professional B2B platform for sensory science. We do not knowingly collect data from children under 16.

8. Changes to This Policy

We may update this policy from time to time. The “last updated” date at the top reflects the most recent revision. Continued use of the platform after changes constitutes acceptance.

9. Contact

The Origin Institute B.V.
Wageningen, the Netherlands
KvK (Chamber of Commerce): 97905682
VAT: NL868283496B01
Email: [email protected]
Website: www.sensoramaai.com