Privacy statement.

This website stays quiet by default. It sets no cookies until you explicitly allow analytics, and declining keeps it fully cookieless. Personal data comes into play only when you contact us. This statement explains what we process, why, and which rights the GDPR gives you.

It covers this website only. Processing inside the OTRISK platform is governed by the agreement we conclude with each client.

Who we are

The controller for the processing described in this statement is:

What we process, and why

You can read everything on this site without an account and without giving us any data. Processing starts only in the situations below.

The demo form

When you submit the demo form, we process your name, your work email address, your company name and what you tell us about your situation. The message reaches us by email through Twilio SendGrid and is also stored in our HubSpot CRM, so your request is followed up properly and nothing gets lost.

We use that data to respond to your request and to take the steps you ask for ahead of a possible contract: scheduling the demo, scoping, pricing. The legal bases are article 6(1)(b) GDPR (pre-contractual steps at your request) and article 6(1)(f) GDPR (our legitimate interest in answering business enquiries). None of it is used for anything else.

Email and phone

If you email or call us, we process the contact details and the content you share, for the same purposes and on the same legal bases.

Technical server logs

Our hosting provider keeps standard access logs (IP address, requested page, timestamp) for a short period. They serve only to run and secure the site (article 6(1)(f) GDPR).

Cookies and analytics: your choice

By default this site sets no cookies at all. If you accept analytics in the cookie banner, we load two tools: Google Analytics 4 to see which pages help visitors, and the HubSpot tracking code, which sets cookies so that when you later request a demo we can see which pages you visited before. No advertising features and no ad networks in either tool; Google Ireland and HubSpot (EU data centre) process this data on our behalf under data processing agreements. Decline, and nothing loads. You can change your choice at any time via Cookie settings in the footer. There are no social media buttons either way.

Two technical details, named for completeness:

• Language choice. If you switch the site language, your choice is saved in your browser's localStorage (key otrisk_lang). It stays on your device; it is not a cookie and it is not sent to us. Your browser can remove it at any time.
• Fonts. All fonts are served from our own server; your browser makes no font requests to any third party.

Who receives your data

We do not sell personal data, we do not rent it, and we do not share it for marketing. The only parties that touch data from this site are service providers who process it on our instructions:

• RackNerd LLC (United States): hosting of this website. Form submissions pass through the server briefly and the access logs live there; we keep what this server sees to a minimum.
• Twilio SendGrid (United States): delivers demo-form messages to our mailbox, under Twilio's data processing addendum with the EU standard contractual clauses.
• Microsoft 365 (Microsoft Ireland): the mailbox environment where your messages arrive. HubSpot (EU data centre) is our CRM: it stores demo requests and, only if you accepted analytics, the pages you viewed on this site.

Google Ireland, for analytics with your consent, appears above under Cookies and analytics.

Most processing stays inside the EEA: HubSpot's EU data centre and Microsoft Ireland. Twilio SendGrid (United States) processes under Twilio's data processing addendum, which includes the European Commission's standard contractual clauses. For website hosting by RackNerd (United States) we keep personal data to a strict minimum (short-lived access logs and form data in transit) and are formalising equivalent safeguards for this transfer.

How long we keep your data

Demo-form submissions and email enquiries: as long as we are in contact about your request, and afterwards for 18 months after the last contact. If a contract follows, contract data moves to our administration and follows the legal retention periods that apply to it. After that, we delete the data.

Your rights

The GDPR gives you the right to ask us for:

• Access: a copy of the personal data we hold about you.
• Rectification: correction of data that is wrong or incomplete.
• Erasure: deletion of your data where no legal ground requires keeping it.
• Restriction: a temporary freeze on processing while a question is resolved.
• Objection: a stop on processing based on our legitimate interest, including any direct marketing.
• Portability: the data you gave us, in a machine-readable format.

Send your request to privacy@otrisk.io. We respond within one month, and we may ask you to verify your identity first. Using your rights is free.

Not satisfied with our answer? You can lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or with the authority of the EU country where you live or work.

No automated decision-making

We make no automated decisions about you and we build no profiles. Nothing on this site scores or categorises visitors, and nothing decides anything about you without a human.

Questions about privacy

Write to privacy@otrisk.io. You will get an answer from a person.

Changes to this statement

When our practices change, a new provider, a new cookie, a new purpose, this page changes first. The date below tells you when that last happened.