Privacy Notice

This notice applies whether you are a customer, a prospect, an event guest, office visitor or a website visitor and covers ON2IT as controller. This notice does not apply to data that we process on behalf of our customers of our business offerings, where we are a processor. This is governed by our Data Processing Agreement/Addendum or the relevant service agreement.

If you apply for a job at ON2IT, our separate privacy notice for job applicants applies.

1. What we collect and why

Our guiding principle is to collect only what we need. The list below shows each activity, the personal data it uses and the legal basis.

Information you give us

• Contact and quote requests. When you contact us or ask for a quote, we collect contact information such as your name, work email, phone number, company and job title, so we can respond to you. Basis: our legitimate interest in responding, or the steps needed to enter a contract when you ask for a quote.
• Your account and our services/products. When you purchase a service or product, we collect account details to set you up, give you access and run the service or product. Basis: performance of our contract with you.
• Billing. We collect financial and billing details to invoice you and meet our tax duties. Basis: legal obligation and performance of a contract. Without them we cannot set up the service, invoice you or meet our tax duties, so we cannot enter or perform the contract.
• Support and correspondence. When you email us or open a support case, we keep that correspondence so we have a history if you reach out again. Basis: performance of a contract for customers, or our legitimate interest in giving good service and communication for prospects and other contacts.
• Newsletter and updates. When you sign up for a newsletter or mailing list, we use your name and email to send the updates you asked for. We may also send existing customers updates. Every email has an opt-out link. Basis: your consent or our legitimate interest for updates to existing customers.
• Event registration. When you sign up for an event or webinar, we collect your name, company and contact details to register you and run it. For a live event, we may also ask you for dietary or access needs. Basis: our legitimate interest in hosting the event.

Information we collect automatically

• Website use. When you visit our website, cookies collect data such as your IP address, device and browser type and the pages you view, so we can run, secure and improve our website. For the full list and your choices, see Cookies. Basis: your consent for non-essential cookies and our legitimate interest in keeping the site secure and reliable.
• Office visits. When you visit our office, we log your visit for safety and security. This can include a visitor record, building access logs and CCTV. Basis: our legitimate interest in safety and security.

Information we get from others

• Business contact data. We may receive limited business contact data from public professional profiles, partners or contact providers, to reach the right people for B2B sales. We tell you the source on request. Basis: our legitimate interest in B2B sales.

2. How long we keep your personal data

We consider the amount and sensitivity of the data, the risk of harm, the purpose, whether we can meet it another way and the law. We keep your data only as long as we need it for the purpose we collected it, then we delete or anonymize it. How long that is depends on the legal basis and our legal duties:

• Contract: while you are a customer, plus the period we need afterward for our records and to handle any claims or disputes.
• Legal obligation: for as long as the law requires.
• Consent: until you withdraw consent or the data is no longer needed.
• Legitimate interest: as long as the interest applies, such as while we run a sales relationship or protect our site and offices. Then we delete or anonymize it.
• Cookies: see Cookies.

3. When we share your personal data

We never sell your data. We share personal data only when we need to and only with parties that protect it well. We can share personal data with:

• Service providers that process data on our behalf under contract, such as email and newsletter delivery, website analytics, advertising measurement, customer chat and visitor registration.
• Professional advisers, auditors and lawyers, when needed.
• Authorities, when the law requires it.

4. International transfers

Some service providers can process data outside the EU/EEA. When we transfer data there, we use Standard Contractual Clauses, the EU-US Data Privacy Framework or an adequacy decision as safeguard.

5. How we protect it

As a cybersecurity company, we apply strong technical and organizational measures. These are regularly evaluated through independent audits such as ISO 27001 and SOC 2 Type 2. For our current certifications and security details, see our Trust Center.

6. Automated decisions

We do not make automated decisions that have legal or similar significant effects and we do not profile you in that way.

7. Your rights

You have the right to access, correct, delete, restrict or port your data, object to processing based on legitimate interest or to direct marketing and withdraw consent at any time.

To exercise a right, email privacy@on2it.net. We may confirm your identity first and we delete that check data afterward. We respond within one month and can extend by two months for complex requests. For marketing, use the unsubscribe link in any email.

In case of violation of your rights, you have the right to lodge a complaint to the competent supervisory authority.

8. Contact us

If you have any questions or comments about this privacy notice, you can contact us at privacy@on2it.net. Additionally, you can contact our Data Protection Officer (DPO) via dpo@on2it.net.

See the Contact page for our contact details.

9. Changes to this notice

We may update this notice from time to time when needed. You can always visit this page to check for any updates.