Privacy Policy

1. Preamble

This Privacy Policy applies to Users browsing the portals "portal.oodrive.com", "adbe.oodrive.com", "webcc.oodrive.com", "monitoringentreprise.adbackup.com", and "arjohuntleigh.adbackup.com" of Oodrive BE (hereinafter referred to as the "Sites") and aims to inform them about how their personal data may be collected and processed by Oodrive BE during their navigation.

Respect for privacy is a fundamental right and one of Oodrive BE's core values, since its founding. This is why we are committed to processing personal data in strict compliance with applicable data protection regulations, particularly the EU Regulation 2016/679 of the European Parliament and the Council of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC, known as the General Data Protection Regulation (GDPR).

Given the rise of personal data transfers and the significant risks to the fundamental rights and freedoms of European citizens, Oodrive BE ensures:

• to make respect for the principles of privacy by default and by design (Article 25 of the GDPR) a priority;
• to process personal data lawfully, fairly, and transparently for legitimate, specific, and determined purposes (Article 5 of the GDPR);
• to facilitate, at all times, the exercise of Users' rights through the email address privacy@oodrive.com.

Furthermore, Oodrive BE commits to:

• never monetizing your personal data: Oodrive BE prohibits the resale of your personal data to third parties for financial purposes. Such resale would be contrary to Oodrive BE's principles, which focus on offering secure file-sharing and backup services;
• carefully selecting its subcontractors and ensuring they have an adequate level of personal data protection through relevant organizational and technical measures, and that they hold the best certifications on the market (ISO27001, ISO27701, SecNumCloud,...) and the most secure authentication methods (SSO, ...);
• hosting data in the most secure manner possible, in accordance with the recommendations of the protection authorities, particularly the European Data Protection Board (EDPB). This is why Oodrive BE has chosen Atlas Edge and Colt to avoid any transfer to the United States, in light of the invalidation of the Privacy Shield by the "Schrems II" ruling.

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person within the meaning of Article 4 of the GDPR, particularly relating to you, including your name, surname, email address, and IP address.

Service: When referring to our Service, it denotes the software solution "Adbackup Enterprise".

Sites: When referring to the Sites, it denotes the portals "portal.oodrive.com", "adbe.oodrive.com", "webcc.oodrive.com", "monitoringentreprise.adbackup.com", and "arjohuntleigh.adbackup.com" of Oodrive BE, secured through the use of an SSL certificate, indicated by the padlock icon to the left of the URL. These sites allow you to configure, view, and manage your registered machines as part of the "Adbackup Enterprise" software solution.

3. Source of Personal Data

Oodrive BE may collect and process personal data when you subscribe to our Service.

What processing?
As the Data Controller, Oodrive BE is committed to keeping the transmitted personal data confidential, which is even more crucial given our business sector.

Categories of personal data	Purposes	Legal basis	Retention period
name, surname, email address, IP address	Configuration, viewing, and management of machines on the Sites	Execution of the contract (proper delivery of the Service)	Duration of the Service usage. Deletion upon client request.

Where is your data hosted?

Since the invalidation of the Privacy Shield by the "Schrems II" ruling, the transfer of personal data of European citizens must be subject to additional measures to ensure compliance with the GDPR, unless the U.S. subcontractor adheres to the Data Privacy Framework. To ensure sovereignty, Oodrive BE has chosen Atlas Edge and Colt as its hosts, with data centers located in France (Bessières, Ulis) and Belgium (Nossegem).

4. Subcontractors and Recipients of Personal Data

Internally, the departments necessary for the proper execution of the contract and delivery of our Service, such as support, sales, and IT departments, may process your personal data.

Who are our subcontractors?
Oodrive BE carefully selects its subcontractors to ensure they comply with the GDPR before entering into any contract, ensuring they are located within the European Union and follow the best practices for technical and organizational measures. If a subcontractor is not located within the EU, they must be in a country with an adequacy decision or in a country offering at least an equivalent level of protection as the EU, as guaranteed by the GDPR.

5. Security First: Technical and Organizational Measures

In accordance with Article 32 of the GDPR, Oodrive BE has implemented technical and organizational measures to secure access to its Sites and Service.

Our key measures are as follows:

• Cybersecurity Insurance: Oodrive BE maintains insurance covering cybersecurity and data protection risks;
• Data Encryption: All data is encrypted, both in transit and at rest, to prevent unauthorized access;
• Privacy by Design: We integrate privacy protection from the design stage of our services and solutions, in compliance with the principles of data protection by design and by default;
• Regular Penetration Tests: Regular penetration tests ("pentests") are performed to identify and subsequently correct potential security vulnerabilities in our systems;
• Data Anonymization: We apply data anonymization techniques to minimize the risks of identifying data subjects;
• Video Surveillance: We use video surveillance systems to protect our premises and critical infrastructure, in compliance with applicable privacy and data confidentiality laws;
• Awareness Training: We raise awareness among our employees, starting from onboarding, about the essential principles of the GDPR and regularly test their knowledge, including on measures taken to protect your personal data;
• Sovereign Hosting: Oodrive BE solutions are hosted in France and/or Belgium.

6. Exercising the Rights of Data Subjects

Contact Information for the Data Protection Officer

If you wish to file a complaint, the competent supervisory authority is the Belgian Data Protection Authority (APD BE), whose website is: www.autoriteprotectiondonnees.be

Oodrive BE has appointed a DPO in accordance with Article 37 of the GDPR. If you wish to contact our DPO to exercise your rights to access, rectification, erasure, or objection, you can submit your requests:

• To the following email address: privacy@oodrive.com.
• To the following postal address:

Oodrive SAS
Attn: DPO,
26 rue du Faubourg Poissonnière, 75010, Paris, France