Introduction

Orq.ai is a Software-as-a-Service company that provides building blocks for software and product teams. The platform is provided by Orq.AI Holding B.V., chamber of commerce number 88882179, with its addresses at Herengracht 420 (“Orq.ai”), Orq.ai is the controller for the processing activities described in this Privacy Notice. Orq.ai is the controller for the processing activities described in this Privacy Notice.

This Privacy Notice is intended to provide you with information about what personal data Orq.ai collects about you and how it is used. We may update this Privacy Notice from time to time.

If you would like to exercise your privacy rights, please direct your query to Orq.aiʼs data privacy contact person, as follows: Willem Tibosch (willem@orq.ai).

How we collect and use (process) your personal information

Orq.ai collects personal information about its website visitors and customers. This information is limited to:

• name

• job title

• employer name

• work address

• work email

• work phone number

We use this information to provide prospects and customers with services. We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services.

We process personal data only where one of the following applies: (i) performance of a contract with you (Article 6(1)(b) GDPR); (ii) compliance with legal obligations (Article 6(1)(c)); (iii) our legitimate interests (Article 6(1)(f)), including operating, securing and improving our services and marketing to existing customers; or (iv) your consent (Article 6(1)(a)) where required.

In addition to information you provide, we may obtain business contact details from publicly available sources (e.g., LinkedIn) or service providers for lead enrichment, processed on the basis of our legitimate interest.  Where we rely on legitimate interests, we balance our interests against your rights and freedoms and apply safeguards (e.g., access controls, minimization, opt-outs).

We also collect technical data that, depending on the settings and configuration of your device and connection may be personal data, as explained in the next paragraph.

Use of the orq.ai website

As is true of most other websites, Orq.aiʼs website collects certain information automatically and stores it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other usage information about the use of Orq.aiʼs website, including a history of the pages you view. We use this information to help us design our site to better suit our usersʼ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.

Orq.ai has a legitimate interest in understanding how members, customers and potential customers use its website. This assists orq.ai with providing more relevant products and services, with communicating value to our sponsors and corporate members, and with providing appropriate staffing to meet member and customer needs.

Cookies and tracking technologies

Orq.ai makes available a comprehensive Cookie Notice that describes the cookies and tracking technologies used on Orq.ai website and provides information on how users can accept or reject them. We only place non-essential cookies with your consent, which you can withdraw at any time via our cookie settings (see our Cookie Notice for details).

Sharing information with third parties, subprocessors

We do not reveal your personal data to non-Orq.ai persons or businesses for their independent use unless: (1) you request or authorize it; (2) in connection with Orq.ai-hosted and Orq.ai co-sponsored conferences; (3) the information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (4) the information is provided to our agents, vendors or service providers who perform functions on our behalf; (5) necessary to address emergencies related to your own vital interests; or (6) to legal counsel or court functionaries to address disputes or claims (7) to persons demonstrating legal authority to act on your behalf.

We also engage service providers (processors) to host, support and operate our services (e.g., cloud hosting, analytics, email delivery, CRM). These providers act on our instructions under Article 28 GDPR in written data processing agreements. A current list of key service providers is available on request.

The Orq.ai website connects with third-party services such as LinkedIn, Twitter and others. If you choose to share information from the Orq.ai website through these services, you should review the privacy policy of that service. If you are a member of a third-party service, the aforementioned connections may allow that service to connect your visit to our site to your personal data.

Sharing information with third parties, subprocessors

Orq.ai has its headquarters in the Netherlands. Information we collect about you will be processed in the EEA. By using Orq.aiʼs services, you acknowledge that your personal information will be processed in the EEA.

Whenever we transfer your personal data outside the EEA, we do so in accordance with Chapter V of the General Data Protection Regulation (GDPR). In particular, we ensure that appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses (2021/914/EU), supplemented by additional technical and organizational measures where required. Where we rely on another lawful transfer mechanism—such as an adequacy decision or your explicit consent—we will inform you of that basis at the time of collection.

You can obtain more information about these safeguards, or request a copy of the applicable transfer mechanism, by contacting us at privacy@Orq.ai. Where we rely on the Standard Contractual Clauses, we perform transfer impact assessments and implement supplementary technical and organizational measures as appropriate.

Data Subject rights

The European Unionʼs General Data Protection Regulation (GDPR) and other countriesʼ privacy laws provide certain rights for data subjects. You can exercise your rights by contacting privacy@orq.ai.

Data Subject rights under GDPR include the following:

• Right to be informed

• Right of access

• Right to rectification

• Right to erasure

• Right to restrict processing

• Right of data portability

• Right to object

• Rights related to automated decision making including profiling

• Right to retract consent for consent based processing

If you wish to confirm that Orq.ai is processing your personal data, or to have access to the personal data Orq.ai may have about you, please contact us. You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Orq.ai might have received the data from Orq.ai; what the source of the information was (if you didnʼt provide it directly to Orq.ai); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by Orq.ai if it is inaccurate. You may request that Orq.ai erase that data or cease processing it, subject to certain exceptions. You may retract consent you have given for any processing based on consent. You may also request that Orq.ai cease using your data for direct marketing purposes.

We will respond within one month of receiving your request; this may be extended by up to two additional months where necessary due to complexity or number of requests, and we will inform you of any extension. Access is free of charge, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act as permitted by Article 12(5) GDPR. We may ask you for information needed to verify your identity before acting on a request.

You may object at any time to direct marketing, including profiling for such marketing, and we will honor that request.

Data Subject rights

We retain personal data only as long as necessary for the purposes described above or as required by law. When determining retention periods we consider the nature of the data, the risks of processing, our legal obligations, and operational needs; after expiry we delete or anonymize the data.

Your personal data is stored by the Orq.ai on its servers, and on the servers of the cloud based database management services the Orq.ai engages, located in the United States. Where storage occurs outside the EEA (e.g., the United States), it is covered by the International Transfers section above.

The Orq.ai retains service data for the duration of the customerʼs business relationship with the Orq.ai and for a period of time thereafter, at most three years, to analyze the data for Orq.aiʼs own operations, and for historical and archiving purposes associated with Orq.aiʼs services. Orq.ai retains prospect data until such time as it no longer has business value and is purged from Orq.ai systems, but at most for three years. All personal data that Orq.ai controls may be deleted upon verified request from Data Subjects or their authorized agents.

Security

We implement appropriate technical and organizational measures designed to protect personal data, taking into account the state of the art, costs of implementation, the nature, scope, context and purposes of processing, and the risks to individuals’ rights and freedoms (Article 32 GDPR). These measures include access controls, encryption in transit and at rest, logging and monitoring, data minimization, employee confidentiality and training, secure development practices, regular backups, and vendor due-diligence. For more information see our Security Page and Trust Center at https://trust.orq.ai.

Data Breach Notification

If a personal data breach occurs, we assess the risk to individuals. We notify the competent supervisory authority within 72 hours of becoming aware of a breach where required by Article 33 GDPR, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR). We also keep records of all personal data breaches.

Childrenʼs data

Our services are not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will delete it.

Questions, concerns or complaints

For questions or complaints concerning the processing of your personal data, you can email us at info@orq.ai.

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). Data storage and retention.