Privacy Policy - When Ombea is the Controller

Last updated 12 December 2023

At Ombea we take your privacy seriously and, to that end, we are committed to safeguarding and preserving the privacy of all our customers, users and visitors. This Privacy Policy applies to the personal information that we obtain when you use Ombea's products and services or when you otherwise interact with us. Ombea complies with the standards, procedures and requirements of the General Data Protection Regulation (GDPR) to ensure that personal information is kept secure and processed fairly and lawfully. No personal information is publicly accessible.

We do update this Policy occasionally so please ensure you review this regularly. If we make any material changes, we'll notify you of such changes by email or other appropriate means of communication.

We welcome any questions, comments or suggestions you may have about this Privacy Policy. Please send your questions, comments or suggestions to privacy@ombea.com.

Collection of Information

Information You Provide

We collect information about you and your company when you: register for our services; modify your user profile; and make purchases through, use, access, or interact with, any Ombea Products or Services (including, but not limited to, when you download, view, or share content).

Information we collect includes:

• Contact and user information, such as name and email address
• Billing information, such as credit card details and billing address
• Profile information, such as a username, name and e-mail address
• Preferences information, such as notification and marketing preferences; you can opt-out from receiving direct marketing by following the unsubscribe link or emailing unsubscribe@ombea.com at any time.

You may provide this information directly when you enter it in via an Ombea service. You may also refuse to not enter the information asked, but please note that by limiting the information you provide us, we can only provide you limited services.

In some cases, another user (such as a system administrator) may create an account on your behalf and may provide your information, including personal data (most commonly when your company requests that you use our products). We collect such information under the direction of our customers and often have no direct relationship with the individuals whose personal data we process. If you are an employee of one of our customers and would no longer like us to process your information, please contact your employer. If you are providing information (including personal data) about someone else, we assume that you have the authority to act on their behalf. Please let us know if this is not the case.

Other submissions

We collect other data that you submit to our websites, or as you participate in any interactive features of Ombea Services, participate in surveys, promotions, activities or events, request customer support, communicate with us via third party social media sites, or otherwise communicate with us. For example, you can submit information regarding a problem you are experiencing with an Ombea product.

Information we collect from use of Ombea Products and Services

Information Collected Using Cookies

We collect certain information through the use of cookies, which are small text files that are saved by your browser when you access our Services. We use both session cookies and persistent cookies to identify that you've logged in to the Services and to tell us how and when you interact with our Services. We also use cookies to monitor aggregate usage and web traffic routing on our Services and to customize and improve our Services. Unlike persistent cookies, session cookies are deleted when you log off from the Services and close your browser. Although most browsers automatically accept cookies, you can change your browser options to stop automatically accepting cookies or to prompt you before accepting cookies. Please note, however, that if you don't accept cookies, you may not be able to access all portions or features of the Services. Some third-party service providers that we engage may also place their own cookies on your browser. Note that this Privacy Policy covers only our use of cookies and does not include the use of cookies by third parties.

This type of data can also be collected from individuals, who are currently not Ombea customers and may only be interested in buying Services from us or are interested in working with us.

Web Logs

We gather certain information and store it in log files when you interact with our Websites and Products. This information includes, but is not limited to, internet protocol (IP) addresses as well as browser type, internet service provider, URLs of referring/exit pages, operating system, date/time stamp, information you search for, locale and language preferences, identification numbers associated with your Devices, your mobile carrier, and system configuration information. This type of data can also be collected from individuals, who are currently not Ombea customers and may only be interested in buying Services from us or are interested in working with us.

Purpose and Legal Basis for Processing Your Personal Data

We use the information that we collect from you for a variety of purposes:

Service provision and managing your customer relationship:

• Provide, operate and maintain Ombea Products and Services;
• Process and complete transactions, and send you related information,
• including order confirmations and invoices;
• Send transactional messages, including responding to your questions and requests; providing customer service and support; and sending you technical notices, updates, security alerts, and support and administrative messages;

Our processing of personal data for these purposes is based on the contract between you/the company you represent and us.

Service development and information security:

• Monitor and analyze trends, usage, and activities in connection with Ombea Products and Services;
• Improve the quality of Products and Services and to develop new features. This means for example using analytics information (including log and configuration data) to understand how our products are being configured and used and how they can be improved for the benefit of all of our users;
• Ensure the security of the Services; and
• Investigate and prevent fraudulent transactions, unauthorized access to Ombea Services, and other illegal activities;

The legal basis for these purposes of processing is our legitimate interest to ensure that our Products and Services have an adequate level of data security, that the Services are used according to the Terms and Conditions or any other Terms of Use that may apply to the Services and applicable laws, and that we have sufficient and relevant information at hand to develop our Service.

Marketing:

• unsubscribe@ombea.com

  Where we have the needed permissions, send you promotional communications, such as information about services, features, surveys, newsletters, offers, promotions, contests, events and providing other news or information about us and our select partners. You always have the ability to opt out of receiving any of these communications by using the "unsubscribe link" within the e-mail or by emailing
• Personalize Ombea Services, including by providing content, features, or advertisements that match your interests and preferences;

Our processing of personal data for these purposes is based on our legitimate interest to provide you relevant information as part of the Services and to promote Products and Services to you.

When the legal basis for our processing of your personal data is legitimate interest, we have done a so-called balancing test as required by data protection legislation to ensure that it is alright to use this legal basis.

What Information Do We Share With Third Parties?

We will not share your personal data except as described below:

Affiliates

Ombea has a number of Authorized Resellers and a subsidiary (collectively, "Affiliates"). We share your personal data with these Affiliates, when it is required to do so in order to provide the service to you, in which case we require our Affiliates to abide by the requirements within this Privacy Policy.

Mergers and acquisitions

If another company acquires our company or our assets (for example in connection with a merger, acquisition or bankruptcy), that company may acquire also the personal data collected by us and in this case will assume the rights and obligations regarding your personal data as described in this Privacy Policy.

Information shared with third party service providers

Ombea may share your information with third party service providers to provide you the Services, to facilitate your use of our Services, to process any financial transactions you make through our Services, or to provide technical support. This means for example third party vendors who provide the necessary software, networking, storage and other similar technology that are required to provide the Services. Except as set forth in this Policy, these third party service providers must only use your information to provide the services requested by Ombea.

Disclosing personal data to competent authorities or for safety reasons

We may share your personal data to comply with requests from competent authorities or related to legal proceedings when this is permitted or required by law, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Information we disclose with your consent or at your request

If you have expressly requested that we do so, we may share your personal data with (i) third-party sites or platforms, such as social networking sites; and/or (ii) third-party application developers.

Third-Party Sites, Applications and Services

Our Services may contain links to other websites and services, and some of our Services may be accessed through third-party applications or services. Any information that you provide on or to a third-party website, application, or service ("Third-Party Services") is provided directly to the owner or operator of such Third-Party Services and is subject to that party's privacy policy. Even if such Third-Party Services are accessible through our Services, our Privacy Policy does not apply to such Third-Party Services and we shall not be held responsible for the content, privacy, or security practices and policies of such Third-Party Services. To protect your information, we recommend that you carefully review the privacy policies of other Third-Party Service that you access or use.

Transferring your personal data outside the EU/EEA

Some of our Affiliates and third-party service providers process personal data outside the European Economic Area (EEA):

• For example some of the personal data is stored on cloud-based servers which can be geographically located outside the EEA, such as in the United States
• Ombea has employees located outside of the EEA, who in some cases may have access to the personal data of EU residents
• Our resellers are located all over the world; the resellers mostly process personal data of their local contacts, but they may also in some situations have access to the personal data of EU residents.

If personal data of EU residents is in any way transferred or processed outside the EEA, we take all necessary steps to ensure that such personal data continues to be adequately protected. Usually we use EU Commission's Standard Contractual Clauses (as required by Article 46.2 of the EU General Data Protection Regulation), which means that we have a contract in place with our affiliates or service providers, requiring these parties to process personal data in a secure manner.

Retention of personal data

Your personal data will be retained only for as long as necessary to fulfil the purposes defined in this Privacy Policy.

Most of your personal data will be retained during the course of your customer relationship with Ombea. Some personal data might be retained after your customer relationship with us has ended, if required or allowed by applicable laws; for example, applicable tax and accounting legislation requires us to keep some information for six years and in some cases even longer. When your personal data is no longer required by law or rights or obligations by either party, we will delete your personal data.

Personal data which is not necessary for the customer relationship will be deleted or anonymized as soon as possible after the collection of such personal data and at latest within 12 months.

Your rights

You have a right to access personal data we process about you. You may access, correct, update, change or remove your personal data at any time. However, please note that certain information is strictly necessary in order to fulfil the purposes defined in this Policy and may also be required by law. Thus, you may not remove such personal data.

You have a right to object for certain processing. To the extent required by applicable data protection law, you have a right to restrict data processing.

You have a right to data portability, i.e. right to receive your personal data in a structured, commonly used machine-readable format and transmit your personal data to another data controller, to the extent required by applicable law.

If you wish to access your personal data, wish to have your personal data removed or want to use any of the other rights mentioned above, please contact privacy@ombea.com.

Security of your information

We take reasonable measures to protect the information that we collect from or about you from unauthorized access, use, or disclosure. Our Services have security measures in place to help protect against the loss, misuse, and alteration of the Data under our control. When our Services are accessed using a supported browser, Secure Socket Layer (SSL) technology protects information using both server authentication and data encryption to help ensure that data are safe, secure, and available only to you. Ombea hosts the website in a server environment designed to be secure and that uses a firewall and other technology designed to prevent interference or access from outside intruders. Ombea provides unique user names and passwords that must be entered each time a customer logs in to our Services. These safeguards help prevent unauthorized access, maintain data accuracy, and ensure the appropriate use of personal data.

Sensitive Information

Our purposes of processing your personal data (as described above) do not necessitate collecting and processing of any sensitive information (e.g. information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or sexuality). We kindly ask you to not send any sensitive information on or through our Services or via any other means as this poses unnecessary risks to your privacy.

Contacting Us

If you have any questions regarding this Privacy Policy or require any further information please email privacy@ombea.com.