Last Updated: November 23, 2022 Notice of Changes to our Privacy Policy November 23, 2022 <p>We value your privacy and respect your choices.
We have updated our Privacy Policy to provide more specifics about the categories of personal information we collect, how long we retain personal information, and our marketing practices.
If you want to update your preferences, please click our cookie icon in the bottom left-hand corner of our website.
</p> July 20, 2021 <p>We have updated our Privacy Policy to address new product features we have introduced, or will be introducing, to our platform.
We have not changed how we treat information from our website visitors and we have not changed our commitment to respecting individual data privacy.
Our biggest new feature is Data Discovery and you can learn more about it here</p> A Brief Summary of Our Privacy Policy <p>Our Privacy Policy applies to your use of the Osano website and platform.
This Privacy Policy applies to all visitors to the Osano website and customers and users of the Osano platform.</p> Who We Are <p>Osano, Inc., A Public Benefit Corporation (“Osano”), creates software products and platforms that enable businesses to manage their own risk regarding data governance and compliance.</p> About Our Privacy Policy <p>When you access this website and use our platform, information is created.
Because we know your privacy is important, we’ve created this Privacy Policy to explain how we collect, use and protect that information.
For your convenience, we’ve provided a brief summary below, written in simple, easy to understand text.
If you’d like to read our full Privacy Policy, please click here.</p> What information do we collect? <ul>
<li>
<strong>Customer provided</strong>: Contact information (name, email, phone number, job title, company name, payment information, and other information provided by the user) to request a demo or trial or to sign up for a customer account or subscription, and to access our platform and use our services.
Additional information is collected as customers use our different features.
To find a description of that information and our processing activities, please click here.</li>
<li>
<strong>Automatically collected</strong>: IP Address, user agent, and the referring URL.
When you visit our website we automatically receive your IP address and information such as the user-agent of your web browser.
This information is provided to us and every other website that you visit on the Internet by your web browser.</li>
</ul> What information do we know about you? <p>We don’t request or require you to provide personal information to access our website.
As noted above, we may receive your IP address and user agent automatically.
If you optionally elect to use our chat feature or fill out our contact form, we will receive your Name, Email, Phone number, and Company name, as well as your stated interest in our products and any other additional information that you elect to provide.
If you sign up for a user account or subscription, we will collect your contact information (name, email, phone number, job title, company name, payment information, and other information provided by the user).</p> What about cookies? <p>The Osano website and platform may place cookies on your browser in order to identify you when you return to our website or log in to our platform.
Osano’s cookie policy can be found here.</p> How do we use the information we collect? <ul>
<li>We use aggregate information to understand how many total users have visited our web site and the types of devices on which they are using it.</li>
<li>We use information you choose to provide in our web forms to sell software and/or services</li>
<li>We use information you provide to us when signing up for and using our services to provide services and to correspond with you about those services.</li>
<li>We use information gathered through our platform solely to provide the services requested by customers.</li>
</ul> Do we sell or share any of the personal information collected by the Osano web site? <p>We don’t sell or rent personal information to any third parties in exchange for money.
However, we may use information in a way that falls within the definition of “sale” under California’s CCPA to support our marketing efforts.
More detail is provided below, but If you would like to opt out of this use of personal information, please let us know here.</p> Do we sell or share customers' personal information? <p>We do not sell or rent customers’ personal information or data.
We may share data with our vendors and service providers to perform tasks on our behalf to deliver our services. </p> What’s the difference between personal information and de-identified information? <p>Personal information is information that can be used to identify a particular individual, generally understood to be information such as your name, physical address, email address and phone number.
De-identified information is not considered personal information and can’t be used to identify you.</p> Do we collect email addresses? <p>We do not require you to submit your email address, or any other personal information, to us in order to use the Osano web site.
If you use the information provided on the Osano.com website to contact us directly, we will receive your contact information, but will only use it in order to respond to your inquiry.
If you fill out a web form on our web site we receive your email and may store that email and associated contact information for up to 12 months.
Our platform collects personal information, including email addresses, that is used solely to provide our services.</p>
<p>For more detailed information, please click the links below to visit sections of our full Privacy Policy:</p> Privacy Policy <p>
<strong>Table of Contents:</strong>
</p>
<ul>
<li>Introduction</li>
<li>What Information We Collect and How We Collect It</li>
<li>How We Collect Information</li>
<li>How We Use the Information We Collect</li>
<li>Cookies</li>
<li>With Whom We Share Information</li>
<li>Security</li>
<li>Encryption</li>
<li>Physical Security</li>
<li>Access Control </li>
<li>Employees</li>
<li>Vulnerability Management</li>
<li>Incident Management</li>
<li>Data Retention</li>
<li>Data Storage &.
Data Transfer</li>
<li>Children's Privacy </li>
<li>"Do Not Track" and Global Privacy Control</li>
<li>Your Rights</li>
<li>California Privacy Rights under the CCPA</li>
<li>Additional information for residents of Brazil</li>
<li>EU-US &.
Swiss-US Privacy Shield</li>
<li>How to Contact Us</li>
<li>Changes to this Privacy Policy</li>
</ul> Introduction <p>This Privacy Policy covers how Osano collects, uses, discloses and stores information about you when you use our website or platform.
Learn more about Osano software. </p> What Information We Collect and How We Collect It <p>To provide our services to you and to ensure that our software and platform operate correctly, we collect various types of information, including information that identifies or may identify individuals (“personal information”).
When you use our website, sign up for our services, and use our software or platform, we collect the following categories of information:</p>
<p>Information you provide to us:</p>
<ul>
<li>If you use the contact information provided on the Osano.com website to contact us directly, you agree to allow Osano to store and process your contact information.
We will receive your contact information which could include, depending on how you contact us, your email address, name, company name, job title, the reason for contacting, and postal address.</li>
<li>We receive and store the information you provide directly to us when you sign up for and use our services and platform.
The types of information we may collect directly from our customers and users include name, email address, mailing address, phone number, job title, payment and billing information, and any other information provided by the user (including a user-submitted photograph if a user chooses to provide one with respect to our data subject access request feature).</li>
</ul>
<p>When you use our website or platform, we automatically collect the following information:</p>
<ul>
<li>Internet Protocol Address (“IP address”).
IP addresses are assigned by your Internet service provider (e.g., Comcast/Xfinity, AT&T, Time Warner, Verizon, Charter, etc.) to the modem used to access the Internet for connected devices in your home and/or work-place.
Any devices using the modem to access the Internet may broadcast the same IP address.
At home, connected devices could include one or more laptop/desktop computers, tablets, mobile phones, smart/connected TVs and gaming consoles.
At work, connected devices could include one (or all) floor(s) in an office building.
Our website receives your IP address from your Internet browser each time you request a file or web page.</li>
<li>User-Agent.
Due to the nature of how the Internet works, we may receive information (known as “User-Agent”) automatically sent by your web browser, such as data associated with the source device’s Internet browser/content delivery software (e.g., Microsoft Explorer, Mozilla Firefox or Google Chrome).
The User-Agent information we receive may also include information such as device type (e.g., computer, tablet, mobile device), and/or date/time of visit.
Similar to the collection of IP addresses, our website also receives User-Agent information associated with your browser and type of device.</li>
<li>Information collected by cookies and other similar technologies.
We use various technologies to collect information which may include saving cookies to users’ computers.
These tools help us understand and improve the performance of the Osano website and platform. .
Our cookie policy can be found here.</li>
</ul>
<p>We do not collect sensitive personal information other than as may be necessary to collect payment from our customers for our products and services.
Unless we specifically request such sensitive information from you, we ask that you not send it to us or disclose any sensitive personal information to us.</p> How We Collect Information <p>This section details the information we collect automatically when you visit our website.
For details regarding the information collected and processed through our platform, please click here.</p>
<ul>
<li>IP address.
Our website receives an IP address from your Internet browser (e.g., Microsoft Explorer, Mozilla Firefox, Google Chrome) each time you request a file or web page.</li>
<li>User-Agent.
Similar to the collection of IP addresses, our website also receives User-Agent information associated with your browser (e.g., Microsoft Explorer, Mozilla Firefox, Google Chrome, etc.) and type of device (e.g., whether the device is running a Windows or Apple operating system.)</li>
<li>If you choose to contact us directly with an inquiry (by email, chat, or postal mail) using the contact information available to you on the Osano.com website, we will receive your contact information and use it to provide you with a response.</li>
<li>We may collect information from third parties, such as social networks, that help us identify prospective businesses or customers that might be interested in our products and services.</li>
</ul> How We Use the Information We Collect <ul>
<li>
<strong>Services</strong>.
We may use the information we collect in connection with the services we provide. .
We may use the information we collect to set up user accounts.
provide, operate, and maintain services.
process and complete transactions.
provide customer service and support and respond to inquiries.
send communications.
prevent fraudulent activity.
for any other purpose based on our legitimate interest.</li>
<li>
<strong>Website</strong>
<i>.
</i>We may use the information we collect to administer and improve the Osano website and platform. </li>
<li>
<strong>Promotional Communications</strong>.
We may use your personal information to contact you with newsletters, marketing or promotional materials, and other information that may interest you.
You may opt out of receiving any, or all, of these communications from us by following the instructions provided in any email we send or by following the unsubscribe link in those emails.</li>
<li>
<strong>Marketing.
</strong> We may use the information we obtain from you, your interactions with us and our website, as well as from third parties who help us with our marketing efforts, to provide you with marketing and promotional content, to deliver targeted and relevant advertising and marketing to you, to determine the effectiveness of our marketing campaigns and to better understand our website visitors’ preferences.
You can view and change your preferences concerning this use of information through your cookie settings or by submitting a data subject request to us. </li>
<li>
<strong>Analytics</strong>
<i>.
</i>We may use de-identified information collected to understand general information and trends related to our website, such as how many users have visited our website during a given period of time and the types of devices the visitors use.
The information can’t be used to identify an individual and is used by us to help improve consumers' solutions.</li>
<li>
<strong>IP addresses – Fraud Prevention</strong>
<i>.
</i>Our use of IP addresses is limited to helping identify and combat potentially fraudulent activity.
IP addresses are stored in our log files and are deleted after 30 days.</li>
<li>
<strong>Respond to Inquiries</strong>
<i>.
</i>If you choose to contact us directly (by email, form, or postal mail) using the contact information we provide on the Osano website, we will use your contact information to respond to your inquiry.</li>
</ul> Cookies <p>The Osano website and platform may place cookies on your browser in order to identify you when you return to our website or log in to our software.
Osano’s cookie policy can be found here.</p> With Whom We Share Information <p>We may share and disclose information (including personal information) in the following instances:</p>
<ul>
<li>Vendors and Service Providers.
We may share your information with vendors and service providers we engage to perform tasks on our behalf, for example, to help us deliver our services, bill our customers, and respond to support tickets.
More details about these vendors and service providers can be found in our GDPR statement.</li>
<li>We may share your information with service providers and advertising networks as reasonably necessary for marketing our products and services.</li>
<li>If Osano is acquired or merged with another company, we will transfer the collected information to the acquiring company.</li>
<li>Under certain circumstances, we may be required to disclose personal information if necessary to comply with a subpoena or court order, to establish or exercise our legal rights or defend against legal claims, or to cooperate with government and/or law enforcement officials.</li>
</ul>
<p>We may share de-identified information (i.e., information that cannot be used to identify an individual) for a variety of reasons, including under the following circumstances:</p>
<ul>
<li>To make our products better and foster transparency.</li>
<li>If Osano is acquired or merged with another company, we will transfer aggregate information to the acquiring company.</li>
<li>We may share de-identified information if necessary to comply with a subpoena or court order, to establish or exercise our legal rights or defend against legal claims, or to cooperate with government and/or law enforcement officials.</li>
<li>For any lawful basis.</li>
</ul> Security <p>We take security very seriously.
Ensuring that the information collected by our website and platform is secure and protected is very important to us.
Consistent with industry standards and applicable law, Osano has established appropriate technical and organizational measures to help prevent unauthorized access to, disclosure, alteration or misuse of information collected by the Osano website and platform (“Collected Data”). </p>
<p>We use Amazon Web Services to store all Collected Data.
Amazon employs a robust physical and network architecture security program with multiple certifications.
For more information on Amazon’s security processes, please visit https://aws.amazon.com/security/. </p> Encryption <p>All data transmitted between visitors to the Osano website and users of the Osano platform is encrypted in transit.</p>
<p>All data received and stored by Osano servers is encrypted at rest.</p> Physical Security <p>Osano’s technical infrastructure is hosted on Amazon Web Services SOC 2 accredited data centers.
Physical security controls at AWS data centers include 24x7 monitoring, cameras, visitor logs, and entry requirements.</p> Access Control <p>All services related to operations and infrastructure are accessible only through secure connectivity (e.g., SSL, SSH).
All systems require multi-factor authentication.
Our back-office, service, and infrastructure password policies require minimum lengths, complexity, lockout, and disallow reuse.
Osano grants access to staff and contractors based on least privilege rules, reviews permissions monthly, and revokes access immediately after employee termination.</p> Employees <p>All employees of Osano undergo national background checks, are required to sign non-disclosure agreements, and complete privacy and security training.</p> Vulnerability Management <p>All systems and applications undergo security review for vulnerabilities prior to production deployment.
All application dependencies are monitored for vulnerabilities using third party dependency scanning tools.</p> Incident Management <p>Osano maintains industry standard security incident response policies and procedures.</p> Data Retention <p>If you provide information to us to request a demo, we will keep that information for up to twelve months after your last communication with us.
Other information collected during your use of our website will be kept until you withdraw consent or your information is no longer needed for marketing or analytical purposes.</p>
<p>We will keep personal information collected by our platform or provided by customers for up to three months after the end of our business relationship and subject to our agreement with our customers.
All payment information will be deleted three months after the processing unless we are required by law to keep it longer.</p>
<p>If you contact us directly using the contact information provided on the Osano website, we will retain your contact information for up to three months after we respond to your inquiry.
After that, the communications will be deleted from our system unless we are required by law to retain them longer.</p> Data Storage &.
Data Transfer <p>IP addresses are an essential component of the Internet.
Every request made to a server includes the IP address of the visitor.</p>
<p>For visitor-facing components of Osano, such as the Osano Consent Management platform, all personal data are stored exclusively in Dublin, Ireland, in compliance with GDPR.</p> Children's Privacy <p>The Osano website and platform were not developed or intended for individuals under the age of 18 and we do not knowingly collect information from children under the age of 18 years old.
If you provide your information to us through a request form or any part of our platform you represent to us that you are at least 18 years old.
If you learn that your child has provided us with personal information without your consent, you may alert us at legal@osano.com, and we will promptly take steps to delete such information.</p> "Do Not Track" and Global Privacy Control <p>Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers.
DNT is a way for users to inform websites and services that they do not want certain information about their webpage visits collected over time and across websites or online services.
Please note that we do not respond to or honor DNT signals.</p>
<p>Global Privacy Control is a browser setting that allows you to notify websites you visit about your privacy preferences.
We honor website visitors’ Global Privacy Control signals.
</p> Your Rights <ul>
<li>You can opt out of receiving certain marketing or promotional communications from Osano at any time by using the unsubscribe link in the email communications we send. </li>
<li>You can also manage your privacy preferences with us anytime by clicking the cookie icon on our website.</li>
<li>If you would like to request access, review, update, rectify, or delete any personal information we have about you, you can contact us here.
Our privacy team will respond as soon as possible.
Rights available under the GDPR are described in our GDPR statement. </li>
<li>California residents have the rights described below.
California residents can exercise this right by submitting a written request here.</li>
</ul> California Privacy Rights under the CCPA <p>The California Consumer Privacy Act of 2018 (“CCPA”) took effect on January 1, 2020, and provides California consumers with certain rights regarding their personal information. </p>
<p>The section “What Information We Collect and How We Collect It” explains the specific details of the personal information Osano collects.
The CCPA also requires listing categories of personal information collected.
As defined by the CCPA, we collect, or have collected in the past 12 months, the following categories of personal information:</p>
<ul>
<li>Identifiers (such as name, email address, postal address, phone number, and IP address)</li>
<li>Personal information categories listed in the California Customer Records statute (Cal.
Civ.
Code § 1798.80(e)) (such as name, contact information, employment)</li>
<li>Commercial information (such as transaction information, purchase history, payment information)</li>
<li>Internet or other electronic network activity information (such as browsing history, search history, online behavior)</li>
<li>Professional or employment-related information (such as job title and your business contact information)</li>
<li>Inference data about you (such as additional features we think would be of interest to you)</li>
</ul>
<p>Personal information, as defined by the CCPA, does not include publicly available information from government records and de-identified or aggregated consumer information.</p>
<p>We use and disclose the categories of personal information we collect from, and about you consistent with the business purposes discussed in the section “How We Use the Information We Collect”. </p>
<p>The CCPA also sets forth obligations for businesses that “sell” personal information to third parties, as that term is construed under the CCPA.
We do not exchange personal information with any third parties for money, and we have not “sold” (as construed by the CCPA) any personal information in the past 12 months.
Going forward, we may "sell" or exchange personal information in a manner that constitutes a "sale" under CCPA to support our marketing efforts.</p>
<p>California residents have the ability to opt out of such sales as described below.
If you are a California resident, you may have the following consumer rights under the CCPA:</p>
<ol>
<li>Right to know about the personal information collected, used, disclosed, or sold.
You have the right to request that we disclose to you the categories of personal information we collect or disclose (or have collected or disclosed in the past 12 months) about you, the categories of sources of such information, the business or commercial purpose for collecting your personal information, and the categories of third parties with whom we share/disclose personal information. .
This information is also explained throughout this Privacy Policy. </li>
<li>Right to request deletion of personal information.
You have the right to request the deletion of your personal information we have collected from you, subject to certain conditions and limitations under the law.</li>
<li>Right to Opt-Out of the sale of personal information.
The CCPA provides consumers with the right to opt out of the sale of their personal information.
We may share personal Information with third parties in a manner that constitutes a “sale” as defined by the CCPA.
You have the right to opt out of such a "sale".</li>
<li>Right to non-discrimination for exercising consumer privacy right.
We will not discriminate against you for exercising your rights under the CCPA. </li>
</ol>
<p>To exercise any of your rights as set out above, please contact us by submitting a request at https://www.osano.com/legal/dsar or by contacting us at Osano, Inc., 3800 North Lamar Blvd, Suite 200, Austin, TX 78756.
You will need to verify your identity before we can fulfill your request. .
You can designate an authorized agent to request on your behalf.
To do so, you will need to provide a written authorization or power of attorney signed by you for the agent to act on your behalf.
You will still need to verify your identity with us.
Note that consumers may only make a personal information request twice in a 12-month period under the CCPA.
We will work to respond to your verifiable request within 45 days of receipt.
Certain information may be exempt from requests under applicable law. </p> Additional information for residents of Brazil <p>This section provides additional information required by Federal Law No.
13,709/2018 - General Data Protection Law of Brazil ("LGPD").
These provisions apply to residents of Brazil when the LGPD applies and supplement Osano’s Privacy Policy and GDPR statement. </p>
<p>When Osano acts as data controller with respect to collecting and processing personal data under LGPD, you may have the right to make the following requests:</p>
<ul>
<li>The right to confirmation of the existence of processing;</li>
<li>The right to access the data</li>
<li>The right to correct incomplete, inaccurate, or out-of-date data;</li>
<li>The right to anonymize, block, or delete unnecessary or excessive data or data that is not being processed in compliance with the LGPD:</li>
<li>The right to the portability of data to another service or product provider by means of an express request;</li>
<li>The right to delete personal data processed with the consent of the data subject;</li>
<li>The right to information about public and private entities with which the controller has shared data;</li>
<li>The right to information about the possibility of denying consent and the consequences of such denial;</li>
<li>The right to revoke consent</li>
</ul>
<p>To exercise any of these rights, please contact us by submitting a request here or by contacting us at Osano, Inc., 3800 North Lamar Blvd., Suite 200, Austin, TX 78756.
You must provide your first name, last name, email address, and country of residence to submit a request.
You will also be required to verify your identity before we can fulfill your request.</p>
<p>If you are located in Brazil, when you visit the Osano website or platform, we may transfer your personal data outside of Brazil.
When we do, we will ensure that an adequate level of protection is provided for the transfer.</p> EU-US &.
Swiss-US Privacy Shield <p>Although Osano relies on the Standard Contractual Clauses as a valid transfer mechanism, Osano also complies with the EU-U.S.
Privacy Shield Framework and Swiss-U.S.
Privacy Shield Framework as set forth by the U.S.
Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland to the United States.
Osano has certified to the Department of Commerce that it adheres to the Privacy Shield Principles.
If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.
To learn more about the Privacy Shield program and to view our certification, please visit https://www.privacyshield.gov/.</p>
<p>Our accountability for the personal information we receive under the Privacy Shield and subsequently transfer to a third party is described in the Privacy Shield Principles.
We may use third parties to process data on our behalf as described in this Privacy Policy.
We remain liable if they do so in a manner inconsistent with the Privacy Shield Principles unless we prove that we are not responsible for the event giving rise to the damage.</p>
<p>In compliance with the Privacy Shield Principles, Osano commits to resolve complaints about our collection or use of your personal information.
EU, UK, and Swiss individuals with inquiries or complaints regarding our Privacy Shield policy should first contact Osano at:</p>
<p>Osano, Inc., a Public Benefit Corporation<br>Attn: Legal<br>3800 N Lamar Blvd<br>Ste 200<br>Austin, TX 78756</p>
<p>Osano has further committed to refer unresolved Privacy Shield complaints to JAMS, an alternative dispute resolution provider in the United States.
If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/file-an-eu-us-privacy-shield-claim claim for more information or to file a complaint.
The services of JAMS are provided at no cost to you.</p>
<p>If JAMS doesn’t address your concern, you may be entitled to binding arbitration under the Privacy Shield Principles.
For purposes of enforcing compliance with the Privacy Shield, Osano is subject to the investigatory and enforcement authority of the U.S.
Federal Trade Commission.</p> How to Contact Us <p>If you have any questions about this Privacy Policy or its implementation, you may contact us here or you can send correspondence to the following address:</p>
<p>Osano, Inc., a Public Benefit Corporation<br>3800 North Lamar Blvd<br>Suite 200<br>Austin, TX 78756</p> Changes to this Privacy Policy <p>We may update this Privacy Policy from time to time based on changes to applicable laws and regulations or other requirements applicable to us, changes in technology, or changes to our business.</p>
<p>Any changes we make to the Privacy Policy in the future will be posted on this page, so you should review it periodically.</p>
<p>If there are significant changes to our information practices, specifically how we process personal information, you will be provided with appropriate online notice.
We will also post a notice on our home page if our Privacy Policy has changed.</p>