Privacy Policy

‍To make a Personal Data Request, please visit our Ontop Privacy Center.

‍

1. Privacy Policy Overview 🪂🔐

Welcome to Ontop’s Privacy Policy! 

‍Ontop Holdings Inc., a Delaware corporation with its principal place of business at 66 W Flagler St, Ste 900, Miami, FL 33130, United States (“Ontop”, “we”, “us”, and “our” and collectively and together with its subsidiaries and/or Affiliates the “Ontop Group”) each operates the www.getontop.com website (the “Website”), the app (the “App”),  the Ontop Platform, the Ontop Card, and the Ontop Wallet, as well as any other Ontop Services offering from any Ontop entity

At Ontop, we are committed to the protection and adequate management of your personal data and the information you share with us.

‍ Read through this Policy to understand our data protection and privacy practices, the types of information that we collect and use from you or that you may provide when you engage with the Ontop Services our practices for collecting, using, maintaining, protecting, disclosing and deleting that information. 

‍ This Privacy Policy applies only to information we collect in the App, Website, email, text, WhatsApp, and other electronic communications sent through or in connection with the App, Website, and/or Ontop Services.

‍ This Privacy Policy DOES NOT apply to information that you provide to or is collected by any third party, including but not limited to Business Partners and Service Providers; or other systems that you may interact with and are embedded in our Website, App or Platform. We encourage you to read any third party privacy policy before providing information on or through them.

‍This Privacy Policy forms part of our Worker Terms and Conditions as well as our Client General Terms and Conditions (“Ontop Platform Terms”). Capitalized terms not defined in this Privacy Policy shall have the meaning given to them by the Ontop Platform Terms. If you are a Client, Service Provider, or Business Partner, Ontop Group may refer you to this Privacy Policy as part of any agreement entered between your applicable entity and Ontop to ensure the protection of personal data.

In any case, please remember that providing sensitive personal data and data concerning minors will always be optional in accordance with the applicable regulations.

‍

2. Who or What is That? 🙋

“Affiliate” means, with respect to a party, any Person directly or indirectly Controlling, Controlled by, or under common Control with such party. 

Artificial Intelligence” or (“AI”): refers to the simulation of human intelligence in machines that are programmed to think and learn like humans. It's a broad field of computer science that involves creating intelligent machines capable of performing tasks that typically require human intelligence, such as visual perception, speech recognition, decision-making, and language translation.

“Business Partners” means any person or entity that has entered into an agreement with Ontop for any other legal relationship than the provision of Services.

‍“Control” of a Person means (i) the direct or indirect ownership of more than 50% of the total voting securities or other evidence of ownership interest of such Person or (ii) the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a Person, whether through the ownership of voting securities, by contract or otherwise.

“‍Cookies” are small text files that are placed on your device (computer, smartphone, or other digital devices) when you visit a website. They are widely used to ensure websites function properly, enhance user experience, and provide information to website owners. Cookies can perform various functions, such as remembering your preferences, enabling secure logins, tracking site performance, and delivering personalized content or advertising. Some cookies are session-based and are deleted when you close your browser, while others are persistent and remain on your device until they expire or are deleted. Ontop uses Necessary Cookies, Marketing Cookies, Preferences Cookies and Statistics Cookies. Learn more about our cookies in our cookie declaration here.

“Controller” means a person or entity that, alone or jointly with others, determines the purposes (i.e., “why”) and means (i.e., “how”) of the Processing of Personal Data.

‍“Data Subject” means any individual or natural person, including without limitation those listed in Section 3 - “Scope of Application.”

‍“Necessary Cookies” are small text files sent to your computer for record-keeping purposes, and this information is stored in a file on your computer’s hard drive. Necessary Cookies are essential for the website to function properly. These cookies enable core functionalities such as security, network management, and accessibility. They are typically set in response to actions made by you that amount to a request for services, such as setting your privacy preferences, logging in, or filling out forms. These cookies do not collect any personal data that could be used for marketing or tracking your browsing activity on other websites. As these cookies are essential for the website's operation, they cannot be disabled through our cookie preference settings.

‍“Client” means any individual or legal entity that engages Ontop in order to contract, onboard, make payments to, and/or manage its relationships with local and international independent contractors or full time employees.

‍“Ontop Platform” or the “Platform” means the software as a service (SaaS) platform available via login through the Ontop Website, as well as through mobile apps available on Apple iOS and Android, among others.

‍“Ontop Services” or the “Services” are the services available to users of the Ontop Platform, including but not limited to contracting, onboarding, making payments to, and/or managing relationships with local and international independent contractors.

‍“Person” means a natural person, partnership (whether general or limited), limited liability company, trust, estate, association, corporation, custodian, nominee, or any other individual or entity in its own or any representative capacity.

‍

“Personal Data” means any information relating to an identified or identifiable natural person.

‍“Process” and “Processing” means any operation or set of operations which are performed on Personal Data, whether or not by automated means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure or dissemination, erasure, deletion or destruction. 

‍“Processor” means a person or organization that engages in Processing.

‍“Representative” means an individual who (i) acts on behalf of, or is employed by, a Customer, including a Customer’s employees, agents, and representatives, (ii) acts on behalf of a Service Provider (as defined below), including a Service Provider’s employees, agents, and representatives, (iii) acts on behalf of a business partner, including a business partner’s employees, agents and representatives or (iv) otherwise interacts with us in any manner, for example through our Website, Ontop Platform or uses our Services (all as defined below), in any manner whatsoever.

‍“Service Provider” means a supplier, subcontractor, vendor, or other third party who provides services to us.

‍“Sensitive Data” is a category of personal information that requires extra protection because it could have a bigger impact on a person’s privacy, if misused, disclosed or improperly accessed At Ontop, this includes: (i) Biometric data, such as fingerprints or facial recognition, which may be used for identity verification; (ii) Health data, such as medical certificates or information about a disability, which may be needed for compliance with employment or legal requirements; (iii) government-issued identification, such as social security numbers, passports or other forms of identification. We only collect and use sensitive data when it is absolutely necessary and when we have a legal reason to do so, such as your explicit permission or a legal obligation. We apply strict security measures to keep this data safe.

“Web Beacons” means pages of the App, Website, and/or our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Ontop, for example, to count users who have visited those pages, or opened an email, and for other related app and/or website statistics (for example, recording the popularity of certain app content and verifying system and server integrity).

‍

3. Scope of Application🔭

For the purposes of this Policy, Ontop is the Controller for user and visitor data related to the use and access of the Website and related domains. Additionally, Ontop will be responsible for the personal data collected for all applicable purposes outlined in the Policy.

This Privacy Policy addresses the privacy rights of individuals who:

‍● Individuals who visit and/or engage our Website and with whom we do not have a contractual relationship;
● Clients who use our Services and their Representatives, points of contact, ultimate beneficial owners, Controlling Persons, or any individual acting on behalf of a Client;
● Contractors or Employees hired through any of the Ontop Services;
● Individuals who are no longer Contractors or Employees but are still users of our Ontop Platform, Ontop Wallet, and Ontop Card, and all other users of any Ontop Service;
● Service Providers, their Representatives, points of contact, ultimate beneficial owners, Controlling Persons, or any individual acting on behalf of a Service Provider;
● Candidates who apply to work with Ontop;
● Our Business Partners, their representatives, and any individual acting on behalf of a Business Partner;
● Commercial prospects;
● Individuals who receive marketing communications from us; and/or
● Individuals who interact with us by registering for, attending, and/or otherwise taking part in our trade events, webinars, or conferences or who communicate with us via email, social media, WhatsApp, phone, in person, or any other electronic communication.

‍ By using our Website, App, Platform, or Services, you acknowledge that your personal data will be processed in accordance with this Privacy Policy. We process personal data based on various legal bases, including the performance of a contract, compliance with legal obligations, and our legitimate business interests.  

‍ Please read this Privacy Policy carefully to understand how we collect, use, and protect your personal data. If you do not agree with our policies and practices, you should not use the Platform, App, and/or Website. By downloading, registering with, and/or using the Platform, App, Website, and/our services, you acknowledge and agree with this Privacy Policy and that we may process your personal data under various legal bases, including fulfilling a contract, complying with legal obligations, and pursuing our legitimate interests. Where required by law, we will request your explicit consent before processing certain types of data.

We may update this Privacy Policy from time to time. If we make significant changes that affect how we process your personal data, we will notify you. By continuing to access or use the Service after those changes become effective, you acknowledge and agree to the revised Privacy Policy.

4. Personal Data We Collect 🧺

We collect and Process information from and about users of our App, Platform, and/or  Website (i) directly from you when you provide it to us; and (ii) automatically when you use the Website, Platform, and/or App. We also collect and process the following categories of Personal Data from the Persons listed in 3 - “Scope of Application.”

‍
Contact and Account Data. These are the personal details provided when users sign up for our Service. We may collect information about your mobile device and internet connection, including the device's unique device identifier, IP address, operating system, browser type, mobile network information, and the device's telephone number, user's name, e-mail address, telephone number, address, social security number, IP address, real-time information about the location of your device, job title and password, organization (if a legal entity), and other ways for us to contact you.

‍
Information about user transactions. These are details about the transactions you carry out and the payments to and from your accounts with us.

‍
Payment Information. If payment for our Services is made or transfer is requested via credit card, this may include the card number, expiration date, security code, and billing address. If payment is used or requested via (international) wire transfer, this may include the name and bank code, branch name and number, account number, IBAN, and/or SWIFT code, among others. If payment is made or a transfer is requested via eWallet services, including but not limited to PayPal, Payoneer, etc., this may include the account username, e-mail address, or any other information, including but not limited to financial data, that identifies the relevant user account, digital wallet, prepaid card, or any other funds transfer or payment. If the payment is made or a transfer is requested via crypto payment, this may include the address of your crypto wallet. If payments to us are made via third-party payment processing platforms, these third parties will collect your Personal Data related to such payments, and we will not retain this information. In such cases, the third party’s privacy policy will also apply.

‍
Data and Information Provided in IM Chats. To serve our users better, we make instant messaging (IM) tools available to our users. Any Personal Data or information provided via this medium will be collected and stored.

‍
Biographical and Identification Data. Details about you are stored in documents in different formats, or copies of them. This could include things like (without limitation) data contained in your passport, postal address, email address national ID, social security, or any other identification documents the Website, Platform, and/or the App collects that is defined as personal or personally identifiable information under an applicable law and any other identified by which you may be contacted online or offline. For the purposes of background checks, third parties may collect selfie photos and/or videos that run facial recognition software for identity verification.

Personal Data Provided by Customer Support Channels. We may have customer service agents available to speak with our Customers. Conversations may be recorded, and any Personal Data and/or information provided over the telephone, including payment information, will be collected and stored.

Other Data and/or Information. We collect any other Personal Data and/or information you choose to provide to us through any and all available channels, participating in user/customer surveys, or otherwise visiting and interacting with our Website, Platform, and/or Ontop Platform on and for a lawful basis and purposes.

On-Platform Behavior: We collect certain information about how users interact with our platform, referred to as Behavioral Data. This data includes non-personally identifiable information, such as the actions taken by users while navigating our platform, including clicks, scrolling behavior, page visits, and interaction with specific features or tools. Importantly, this data does not capture any sensitive personal information, such as the content entered into fields or other private user information, as these elements are automatically blurred or otherwise anonymized to protect your privacy.

Behavioral Data is limited to your actions within the platform and does not extend to monitoring your broader online activities or other screen interactions, such as activities in other browser tabs or desktop applications.

Other-purposes:  Information that you provide by filling in forms in the App, Platform, and/or the Website. This includes information provided at the time of registering to use the App, and/or the Website, subscribing to our Service, and requesting further services. We may also ask you for information when you enter a contest or promotion sponsored by us, and when you report a problem with the App, Platform, and/or the Website. Records and copies of your correspondence (including email addresses and phone numbers) if you contact us. Your responses to surveys that we might ask you to complete for research purposes. Details of transactions you carry out through the App, Website, Card, Wallet, and/or Platform and of the fulfillment of your orders. You may be required to provide financial information before placing an order through the App, Platform, and/or the Website. Your search queries on the App.

User Contributions: You may also provide information on public areas of the app or websites you access through the App, Platform, and/or Website (collectively, "User Contributions"). Your User Contributions are posted and transmitted to others at your own risk. Additionally, we cannot control the actions of third parties with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

If you do not want us to collect this information do not use the Website, Platform, and/or download and use the App or delete it from your device. If you wish to make any request about the processing of your personal information, please visit https://ontop.privacy.saymine.io/Ontop-privacy.

‍

5. Non-Personal Information 📢

We may also collect information that is related to you, but that does not personally identify you. Non-personal Information also includes data that could personally identify you in its original form but that we have modified (e.g., by aggregating, anonymizing, or de-identifying such information) in order to remove or hide any characteristics that may lead to your identification. Non-Personal Information may also include information regarding your financial transactions and incoming and outgoing payments, among others. 

‍

6. How We Use Personal Data 📊

The collection and processing of your personal data and other information enables us to provide you with excellent service that is better tailored to your needs. We use Personal Data in the following cases:

• For our business transactions, including but not limited to entering into contractual agreements with you, responding to your inquiries and fulfilling your requests, sending administrative information to you, such as information regarding the Service to complete any requests to enter into and manage customized contracts and international payroll, performing quality controls and customer satisfaction activities. This use is necessary for our performance of Service to you.

• In order to communicate with you in connection with our marketing initiatives or user and/or customer surveys. We may use any information you choose to submit in response, and we will communicate with you, provided that you give us your consent to be contacted in this way at the time you provide us with the Personal Data.

• For security purposes, including but not limited to our protection, as well as that of our employees, suppliers, contractors, Clients, Ontop Platform Contractors, or Employees. We analyze data for fraud prevention and analytics purposes; specifically, your IP address may be used to determine your location, and your transaction history may be analyzed or shared with Clients, Service Providers or authorities as it may be needed for law enforcement purposes.

• For legitimate business interests, including but not limited to addressing complaints you make, managing our Website and Ontop Platform to better understand how visitors interact with our Service, and ensuring that our Website and/or Ontop Platform is displayed in the most effective manner from your computer/device.

• For appropriate legal reasons, such as complying with legal and regulatory requirements, carrying out background checks (KYC processes), responding to requests from public and government authorities and regulators, including those outside your country of residence, enforcing our Terms of Service (https://www.ontop.ai/terms-and-conditions/) and this Privacy Policy, protecting our operations, rights, privacy, safety or property, as well as in order to allow us to pursue available remedies or limit damages that we or other third parties may incur.

• For internal business reasons, we may anonymize, aggregate, and de-identify the data that we collect and use such data for our own internal business purposes, including but not limited to sharing it with our current and prospective Customers, business partners, our affiliated businesses, agents and other third parties for commercial, statistical and/or market research purposes, for example, to allow those parties to analyze patterns among groups of people, and conducting research on demographics, interests, and behavior.

• For marketing and events-related communications, including but not limited to those related to our products and services, inviting you to participate in events, surveys, or otherwise communicating with you for marketing purposes, pursuant to the requirements for consent under the applicable law: (i) when you consent to said communication; (ii) when it is in Ontop's legitimate interest; and (iii) increasing efficiency in the fulfillment of our legal and contractual duties.

• For providing new services or products directly or via third parties. Ontop may share your Personal Data with third parties that will offer benefits, products or services, or “perks”. We may share with such third parties or Business Partners your contact information, your transaction information, and biographical, biometric and other identification data, without limitation. 

• For reasons you have previously consented to.

7. With Whom We Share Collected Personal Data 📲

Clients. We disclose the Personal Data regarding full time employees or independent contractors to the Client they are related with. 

Vendors and Service Providers. We may disclose your Personal Data and other information you provide to us to Service Providers and other third parties we hire to support our business, such as those who assist with website hosting, data analysis, and customer service. This is done under written instructions that limit processing to our specific directions or if there is a legitimate business interest. We strictly prohibit our vendors and suppliers from using your information for any type of model training or independent profiling.

Business Partners. We may disclose Personal Data about you with our Business Partners to provide you with tailored services. 

Merger or Acquisition. We may disclose Personal Data collected about you and/or other information you provide us to a third party who acquires any part of our business, whether such acquisition is by way of merger, consolidation, divestiture, spin-off, restructuring, reorganization, dissolutions, purchase of all or a substantial portion of our assets, or other sale or transfer of some or all of Ontop or any subsidiary of Ontop Group’s assets, whether as going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Ontop or Ontop Group about App, Platform, and/or Website users is among the assets transferred.

Disclosure Permitted by Law. We may disclose Personal Data collected about you and/or other information you provide us to law enforcement authorities, government or public agencies or officials, regulators, and/or any other person or entity having appropriate legal authority or justification for receipt of your Personal Data and/or other information if required or permitted to do so by law or legal process, in order to respond to claims, protect our rights, interests, privacy, property or safety, as well as those of our shareholders Clients, employees or contractors.

Purpose fulfillment. To fulfill the purpose for which you provide it or for any other purpose disclosed by us when you provide the information.

‍

8. How to Exercise Your Rights

You have certain rights regarding your personal data under applicable law, including (i) access, (ii) update, (iii) rectification, (iv) deletion, (v) revocation of consent, and (vi) confidentiality. You also have the right to (i) request proof of consent, (ii) be informed about the use of your personal data, and (iii) file complaints with the data protection authority.

For any inquiries, complaints, or requests, you can contact Ontop at https://ontop.privacy.saymine.io/Ontop-privacy. In some cases, we may retain your personal data for legal, regulatory, or contractual reasons. We will delete it once those specific purposes are fulfilled and it is no longer required for legitimate business needs or legal compliance.

‍

9. Communications 🗣️

We may contact you with newsletters and other marketing information that may be of interest to you. You may opt out of receiving any or all of these marketing communications from us at any time by clicking on the unsubscribe link or instructions provided in any email we send or by contacting us. Please note that we may still send you transactional or administrative messages related to the Services even after you have opted out of receiving marketing communications.

‍

10. Cookies + Other Web Technologies 🍪

Our Services use Cookies and similar technologies.

Information collected through the use of Cookies includes, but is not limited to, user login information and time zone setting. You may learn more about it in our Cookie Declaration.

We use Necessary Cookies for several purposes, including but not limited to: (i) to improve the user experience, (ii) to collect anonymous and aggregated statistical data about users’ visits to our Website, App, Ontop Platform and/or use of our Services; (iii) to analyze users' navigation patterns, search behavior, and enhance our business and promotional initiatives. (iv) to display personalized advertising, promotions, and banners of interest. (v) to ensure the security of our Website and Services. (vi) to personalize content, presentation, and services based on user actions. (vii) We use this data to analyze how our Service is used and how to improve it, and we may use said data to advertise third-party products online.

Unless you set up your internet browser not to accept Cookies, it will accept the use of them. You can always disable Cookies in your browser’s preferences even if you have consented to the use of Cookies in the past. You may also delete Cookies stored on your computer at any given time. Please note that disabling Cookies may negatively impact your online experience with our Service and prevent you from logging in to our Website and Platform.

We use analytics tools to help us get a better understanding of how visitors use our Website and Platform. The information generated by these Cookies about users of our Service is transmitted to and stored by those analytics tools.

You may delete or block Cookies at any time by modifying your preferences in our Cookie banner. The Cookie banner appears at the moment you initially visit and you may change your preferences by clicking on the button in the bottom left corner. If you choose to disable Cookies, please note that certain features of our Website and Services may not be fully functional, and your user experience may be affected. For instructions on how to manage Cookies in your browser, please consult your browser’s help section.

‍

11.   AI in OnTop 

At Ontop, we're always looking for new ways to make our services even better for you. That's why we're so excited about the potential of Artificial Intelligence (AI) to enhance your experience. But as we explore these new technologies, our top priority is, and always will be, the security and privacy of your data.

We want to be completely transparent about how we're using AI. That's why we've put a comprehensive AI governance policy in place (Link). This policy is our promise to you that we'll develop and use AI tools in a way that aligns with the highest international standards for data protection.

Our approach is guided by key principles that ensure these new technologies will never compromise your rights or freedoms. We believe that by being proactive and transparent, we can use AI to innovate responsibly while giving you peace of mind.

In compliance with our AI Governance Policy, our AI systems are built with a "Privacy by Default and Design" approach. We prioritize the use of anonymized or pseudonymized data whenever possible to minimize privacy risks. We commit to not using personal data for purposes that could result in unlawful discrimination or significant negative effects without human oversight.

Ontop uses Artificial Intelligence to improve fraud prevention, support, product experience, analytics, and internal workflows. We design, build, and operate AI systems in line with data protection laws and with the European Union AI Act where applicable. 

Our current AI use cases are:

• fraud and abuse detection and transaction risk signals;
• customer due diligence and customer screenings as part of our know your client and know your business programs;
• provide automated support to customers;
• analyze and classify client and user documents;;
• product features such as search, recommendations, and autofill
• internal quality assurance, analytics, and security monitoring
• internal workflows for the optimization of business operations.

Depending on the activity, we rely on performance of a contract, legitimate interests, compliance with legal obligations, or consent where required.

We do not use Client Content or Personal Data to train foundation  models that are made available to other customers, unless we have your separate written permission or we present a just-in-time choice and your consent. We may fine-tune or configure models on de-identified or aggregated data and on synthetic data.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without meaningful human review and appropriate safeguards. Where an AI system contributes to a decision that may significantly affect you, a human reviews that outcome, you may request human intervention, and you may contest the decision as set out in Section 8.

When an AI feature interacts with you directly, we will indicate that AI is in use and provide clear instructions on how to opt out where the feature is optional.

Enterprise Clients may request AI features to be disabled for their tenant. If a Client disables AI, Ontop will not use that Client’s tenant data to power AI-enabled product features, except where necessary for security, abuse prevention, or to comply with law. Requests can be made through the Ontop Privacy Center or your account team.

We may use AI providers as Service Providers to process Personal Data on our behalf or use AI providers to operate on your Personal Data. These providers are bound by contracts that limit processing to our instructions, prohibit use for their own training, require confidentiality and security, and require prompt incident notice. An up-to-date list of Service Providers is available on request.

Inputs and outputs used by AI features are retained under our standard retention policy unless a shorter period is stated in product controls or required by law. We apply additional safeguards for any Sensitive Data involved.

In addition to the rights in Section 8 and Appendix B, you have the right to obtain meaningful information about the logic involved in AI-assisted decisions that have legal or similar effects, to request human review, and to object to processing based on legitimate interests.

AI features are not designed for use by minors. We do not knowingly process children’s data with AI.

12. Information Security 🏰

The security of your Personal Data is extremely important to us. We take the appropriate steps to protect the information you provide us from loss, misuse, unauthorized access or disclosure, alteration and destruction, both against external and internal threats. Where we have given you (or where you have chosen) a password or other login information which enables you to access certain restricted parts of our Service, you are responsible for doing everything you reasonably can to keep this information secret. You must not share your password or login information with anyone else.

As no data transmission or security system can be guaranteed as 100% secure, we cannot ensure or warrant the security of any Personal Data and/or information that you transmit to us.

Ontop is not responsible for illegal interceptions or violations of its systems or databases, or for their use by unauthorized individuals. Ontop is not liable for the misuse of information obtained through these means. However, Ontop will report any security incidents in accordance with the terms established by the competent data protection authority and will provide its full cooperation to clarify the circumstances surrounding events beyond our control, as a risk mitigation measure.

‍

13. Personal Data and/or Information Collected from Other Sources ⛲

We may also collect Personal Data and/or information about you from other sources in order to help us correct or supplement our records, to improve the quality or personalization of our service to you, and to prevent or detect fraud. We work closely with third parties (e.g., business partners, Service Providers, sub-contractors, advertising networks, analytics providers, search information providers, fraud, and protection services) and may receive Personal Data and/or information about you from them.

In order to provide and improve our Services, we may engage with Service Providers. In the process of supplying services to us, these Service Providers may need to collect Personal Data about you.

‍

14. Disclosure of Personal Data Via Links to Third-Party Websites, Services, and Applications 🔗

Using our Website or the Services may link to third-party websites, services, and/or applications. We are not responsible for any Personal Data collected through these means. Personal Data collected in this manner is governed through the third-party website’s privacy policy. Any interactions you have with these websites, services and/or applications are beyond our control. We urge you to read the privacy and security policies of any external websites before providing any Personal Data while accessing those websites.

‍

15. Tracking Technologies and Data Collection

We use various tracking technologies on our website, such as cookies, web beacons, and similar tools, to enhance your experience and provide personalized content. These technologies collect data such as device information (e.g., IP address, browser type) and usage data (e.g., pages visited, links clicked). Learn more about our tracking technologies in our Cookie Declaration.

The data collected is used for personalization, analytics, marketing, and ensuring the proper functioning of our website. It helps us improve user experience, analyze traffic, and serve relevant ads.

By using our website, you consent to the use of these technologies and the collection of your data as described. You can manage your cookie preferences through your browser settings, but please note that disabling certain cookies may affect website functionality.

16. Minors 👶

Our Ontop Platform and Services are not directed to minors under the age of 18. We perform age verification on users that access our Ontop Platform, and if you are under the age of 18, you will be unable to contract our Services.

‍

17. Modifications to this Privacy Policy 🔀

We may revise this Privacy Policy from time to time. The most current version of the Privacy Policy We may revise and update this Privacy Policy from time to time. The most current version of the Privacy Policy will govern our collection, use, and disclosure of Personal Data and/or information about you. If we make material changes to this Privacy Policy, we will notify you by email, by posting a notice on our Website, App, and/or Ontop Platform prior to the effective date of the changes. 

‍

18. Contact us 📨

To exercise your rights or to make any inquiries about Ontop’s Privacy Policy or privacy practices, would like to contact our Data Protection Officer, or would like to submit a complaint, you can contact us at privacy@getontop.com (please write "Privacy Policy Issue" on the subject line) or fill out the Personal Data Request Form at the Ontop Privacy Center. You can also reach out to us via mail mail at: Ontop Holdings Inc., 66 W Flagler St. Ste 900, Miami, Florida 33130.

‍Ontop takes your privacy questions seriously. A dedicated team reviews your inquiry to determine how best to respond to your question or concern, including those inquiries received in response to an access or download request. In most cases, all substantive contacts receive a response within 30 days. In other cases, we may require additional information or let you know that we need more time to respond.

‍

‍‍‍

IMPORTANT: Please check the table above to see if these apply to you.

APPENDIX A: CALIFORNIA RESIDENTS

Note: This section applies specifically to California Residents.

California Residents

This appendix (“Appendix A” or “CCPA Privacy Terms”) addresses the specific disclosure requirements under the California Consumer Privacy Act of 2018 (“CCPA”). It applies to personal information about California residents using our Website, Platform, App, and/or Services. For purposes of the CCPA, personal information means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household (“Personal Information”). In the event of a conflict between Appendix A and any of our other privacy policies and or terms, Appendix A shall control only with respect to the Personal Information of California residents.

Personal Information Categories
Appendix A covers our Personal Information collection and usage more fully. The chart below describes the categories of Personal Information we collect and the sources from which we collect the Personal Information, organized into the categories specified by the CCPA.

‍

‍

‍

California Residents' Privacy Rights
California residents have the right to request access to or deletion of their Personal Information and may not be discriminated against because they exercise any of their rights under the California Consumer Privacy Act in violation of Cal. Civ. Code §1798.125. You can make requests by sending an email to us with details of your specific request. We may ask that you provide certain information to verify your identity, and the information we request from you will depend on your prior interactions with us and the sensitivity of the Personal Information in question. Once confirmed, we will respond to your request in accordance with the CCPA. If we deny your request, we will explain why.
You may designate an authorized agent to make a request under the CCPA on your behalf if: (1) the authorized agent is a natural person or a business entity registered with the Secretary of State of California; and (2) you sign a written declaration that you authorize the authorized agent to act on your behalf. We may ask that you provide certain information to verify your identity and that you authorized the authorized agent to act on your behalf. If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4000 to 4465, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA. If you have any questions regarding our Privacy Policy or specifically these CCPA Privacy Terms, or would like to change your preferences, you may contact us using the contact information contained in Section 12 of our Privacy Policy.}

APPENDIX B: GDPR PRIVACY TERMS

Note: This section applies specifically to EEA/EU/UK/Switzerland residents.

This appendix (“Appendix B” or “GDPR Privacy Terms”) applies to the Processing of Personal Data by us in our role as a Controller or as otherwise covered by the European Union General Data Protection Regulation 2016/679 (“GDPR"), when individuals:

● Visit or use our Website, App, Platform, and/or Services;
● interact with us either on your own behalf or on behalf of a Customer in connection with the provision of our Services;
● interact with us on behalf of a Service Provider in connection with the products and services our Service Provider provides to us;
● interact with us on behalf of a business partner in connection with our relationship with the business partner;
● apply to work with us;
● receive marketing communications from us, with prior explicit consent; and/or
● interact with us by registering for, attending, and/or otherwise taking part in our trade events, webinars, or conferences, or communicate with us via email, phone, or in-person interactions.

These GDPR Privacy Terms do not apply to any Personal Data Processed, stored, or hosted by Customers using any of our Services or to the extent that we Process Personal Data in the role of a Processor on behalf of our Customers. Where we act as Processors on behalf of our Customers, that Processing is subject to the protections contained in our data processing agreements with Customers. We have no control over, and are not responsible for, any Personal Data that our Customers may store or host on their equipment or otherwise Process while using our Services. We are not responsible for the privacy or data security practices of our Customers, which may differ from those set forth in our Privacy Policy and/or these GDPR Privacy Terms. For information related to how our Customers Process Personal Data, please contact the respective Customer directly. Furthermore, these GDPR Privacy Terms do not apply to any third-party websites or services that may be linked to our Website, App, Platform, or the Services unless that website or service is controlled by us and displays our Privacy Policy and/or these GDPR Privacy Terms. We have no control over, and are not responsible for, the data collection and/or handling practices of these third-party websites or services outside our Website or Services. We encourage you to read the privacy statements of any third-party websites or services linking to (or linked to via) the Website or Services.

In the event of a conflict and/or discrepancy between these GDPR Privacy Terms and our general Privacy Policy, these GDPR Privacy Terms will prevail.

Our Contact Details
If you have any questions or concerns as to how your Personal Data is Processed, please write to us using the contact information contained in Section 12 of our Privacy Policy.

Our Data Collection Practices
We collect and Process the following categories of Personal Data from Customers, Service Providers, business partners, Representatives, Website Visitors, prospective employees, individuals who receive marketing communications from us, and individuals who interact with us by registering for, attending, and/or otherwise taking part in our webinars or conferences or who communicate with us via email, phone or in person, in each case to operate its business for the specific purposes identified below.

Personal Details include data such as names, titles, company names, departments, email addresses, physical street addresses, telephone numbers, and social media usernames of individuals.

• Login Credentials include data such as usernames and passwords of individuals needed to access our Services.
  
• Unique IDs include data that we obtain from (a) prospective employees, (b) Website Visitors, or (c) other individuals that interact with us.
  
• Customer Support Records include data such as call details and other similar data regarding customer support communications and chat sessions with Representatives.
  
• Website and Service Records include data related to your interactions with our Website and Services and other online content such as log data (i.e. login information, preferences and settings, etc.).
• Employment Information includes details such as descriptions of roles performed and locations of employment.

Employment Information includes details such as descriptions of roles performed and locations of employment.Why do we collect Personal Data, what are the sources of Personal Data, what are the purposes for Processing and what is the lawful basis?

The table below sets out the types of Personal Data we Process, the purposes of Processing such Personal Data and our lawful basis for doing so. The lawful basis will vary with the type of Processing involved and will typically include Processing (i) necessary for us to pursue our legitimate business interests, (ii) based on your consent, where this is required by data protection laws, (iii) necessary for us to comply with our legal obligations, or (iv) necessary for the performance of a contract. Where we rely on our legitimate business interests, we have explained what the grounds are for that reliance.

‍

‍

‍Sharing Personal Data with Third Parties
Except as described below, we will not share or disclose Personal Data with or to outside third parties. Any and all Personal Data provided to us by a Customer, Website Visitor, business partner, or other third party is transferred only on a “need to know”, for ensuring the execution of contract or for compliance with legal and regulatory obligations in keeping with the purposes outlined in our Privacy Policy and/or these GDPR Privacy Terms. Also, in these cases, we ensure that the minimal necessary data is shared.

Service Providers. We may share Personal Data with our Service Providers in connection with advertising, hosting, data analytics, information technology and infrastructure, order management and fulfillment, billing, contract management, email delivery, auditing, events, and other related activities. We provide such Personal Data or authorize the Processing of such Personal Data only as necessary to enable our Service Providers to perform their designated functions. Our contractual agreements with them (1) require them to act only under our instruction and for the purpose(s) directed by us with respect to such Personal Data; and (2) prohibit them from sharing such Personal Data with any third parties without prior authorization.

Business Partners. We may also share your Personal Data with trusted business partners pursuant to our contractual arrangements with them, which will include appropriate safeguards to protect any Personal Data that we share with these partners. These may include, but are not limited to third parties that organize trade shows, consultants, experts and auditors.

Affiliated Entities. You acknowledge and agree that we share Personal Data with our affiliates. Subject to local requirements, this Personal Data may be used to provide Services offered by our affiliates, for the affiliates to provide support to the affiliated entity that is sharing the Personal Data or for any other purposes described in our Privacy Policy and/or these GDPR Privacy Terms. For example, affiliates may share Personal Data about our Customers, Service Providers, business partners, representatives, prospective employees and Website Visitors for direct marketing purposes.

Fraud Prevention and Protection of Legal Rights. We may use and disclose Personal Data to the appropriate regulatory, legal, judicial or law enforcement authorities and our advisors and investigators when: (i) we believe, at our sole discretion, that such disclosure is necessary to investigate, prevent, or respond to suspected illegal or fraudulent activity or to protect our safety, rights and/or property or that of our group of companies and/or Customers, Service Providers, business partners, Representatives, Website Visitors, prospective employees, employees, contractors, among others; (ii) we suspect abuse of the Website, Ontop Platform and/or Services or unauthorized access to any system, spamming, denial of service attacks or any other similar attacks; (iii) exercising or protecting legal rights or defending against legal claims; or (iv) pursuing available remedies, as well as mitigating or limiting the damages that we may sustain. We may disclose Personal Data to our partners, Service Providers and law enforcement to secure our Website, Ontop Platform and/or Services, including to detect, prevent, and investigate security incidents or violations to our Terms of Service (for Clients - https://www.getontop.com/legal/ontop-platform-b2b-general-terms-and-conditions; for Workers - https://www.getontop.com/legal/ontop-platform-b2c-general-terms-and-conditions, other services (here you can find all the terms of service that may be applicable depending on the service provided https://www.getontop.com/legal-directory), this Privacy Policy (https://www.getontop.com/privacy-policy), and/or applicable laws.

Law Enforcement. We may have to disclose the Personal Data of our Customers, Service Providers, business partners, representatives, applicants, Website Visitors or other third parties if a court, law enforcement or other public or government authority with appropriate jurisdiction requests that we provide said Personal Data and we believe, at our reasonable discretion, that such request was made in compliance with the applicable law.

Corporate Reorganization. We may transfer the Personal Data of our Customers, Service Providers, business partners, Representatives, Website Visitors or other third parties to another third party in the case of the reorganization, sale, merger, joint venture, assignment, transfer or other alienation of any or all of our business, assets and/or stocks, including in the event of bankruptcy or corporate restructuring. Except as otherwise provided by a bankruptcy or other court, the use and disclosure of all transferred Personal Data will be subject to compliance with applicable data protection laws. Any Personal Data that an individual submits or that is collected after the reorganization may be subject to a new privacy policy adopted by the successor entity, which will be informed to you as provided under Section 11 of our Privacy Policy.

Service Improvements. We may disclose Personal Data to our Service Providers in order to improve our Website,Ontop Platform and/or Services, such as to identify bugs, repair errors or ensure that services function as intended, or to conduct internal research and analysis in order to improve our technology.

Cross-Border Transfers of Personal Data

If we transfer EEA/EU/UK/Switzerland Personal Data to affiliates outside this EEA/EU/UK/Switzerland region, we will put in place appropriate intra-group agreements in accordance with the GDPR requirements, including use of the EU commission-approved standard contractual clauses (“SCC(s)”) for Controllers as appropriate. If we transfer EEA/EU/UK/Switzerland Personal Data to third parties, such as Service Providers or business partners in countries outside the EEA/EU/UK/Switzerland region, we will put in place the EU SCCs or other relevant international transfer documentation that complies with the GDPR requirements. We will also put in place a GDPR-compliant data processing agreement.

Data Retention
We will retain Personal Data that we collect and process where we have a justifiable business need to do so and/or for as long as it is needed to fulfill the purposes outlined in our Privacy Policy,these GDPR Privacy Terms and also enforcement agencies requests. We may retain Personal Data as required by law, such as for tax, legal and/or accounting purposes. When we have no justifiable business need to process your Personal Data (e.g. after all of our necessary interactions have ended, our internal record keeping policies no longer require us to continue to process your Personal Data and we have no other legal obligations to retain your Personal Data), we will either delete or anonymize your Personal Data, at our reasonable discretion.

Data Subject Rights under the GDPR
The GDPR grants individuals who are in the EU/EEA/UK the rights as detailed in the paragraphs below, with some limitations. Individuals may contact us through our contact information contained in Section 12 of our Privacy Policy to exercise any of these rights and we will respond with the requested action or information, as applicable, or we will let you know why such rights do not apply to you. These rights are not absolute and are subject to various conditions under the applicable data protection and privacy legislation, as well as the laws and regulations that apply to us. In some cases, the exercise of these rights (e.g. erasure, deletion, objection, restriction or the withholding or withdrawing of consent to Processing) may make it impossible for us to provide our Services.

Right to Not Provide Consent or to Withdraw Consent. We may seek to rely on your consent in order to Process certain Personal Data. Where we do so, you have the right to not provide your consent and the right to withdraw your consent at any time. If you withdraw your consent, this will not affect the lawfulness of the Processing conducted based on consent before its withdrawal.

Right of Access. You have the right to obtain confirmation as to whether or not we collect or Process Personal Data concerning you and, if this is the case, you have the right to request a copy of such Personal Data in digital format.

Right of Rectification. You have the right to require that we correct any inaccurate Personal Data concerning you and that we supplement incomplete Personal Data.

Right of Erasure. Under certain circumstances, you have the right to request that we erase Personal Data concerning you; e.g. if it is no longer necessary for the purposes for which it was originally collected and we do not otherwise have a legitimate reason to retain the Personal Data. We may need to retain certain Personal Data when legally required for internal, record keeping purposes and/or in order to complete any transactions initiated prior to your request to remove or delete your Personal Data. When we are unable to delete Personal Data from our systems, we will anonymize it so it will no longer be directly or indirectly linked to your identity or identifiable.

Right to Restrict Processing. Under certain circumstances, you have the right to request that we restrict the Processing of your Personal Data that we have collected; e.g. when you believe that your Personal Data that we retain is not accurate or unlawfully held.

Right to Data Portability. Under certain circumstances, you have the right to receive the Personal Data concerning you that you have provided to us in a structured, commonly used, machine readable format, and for us to transmit the data to another entity where technically feasible.

Right to Object to the Processing. Under certain circumstances, you have the right to request that we stop Processing your Personal Data, including when we rely on legitimate interests as a legal basis set forth in Table 1 above. If you receive commercial electronic communications from us, you can unsubscribe from the receipt of future commercial electronic communications from us by clicking on the “unsubscribe” link provided in such communications. Please also note that if you do opt out of receiving commercial electronic communications from us, we may still send you important administrative messages (such as updates about your account or changes to the Services) and you cannot opt out from receiving these messages, unless you stop engaging our Services. You also have the right to object to processing for AI-assisted profiling for direct marketing at any time and to request human review of decisions that produce legal or similar effects.

Right to Not be Subject to Decisions Based Solely on Automated Processing that Produce Legal Effects. We do not make decisions based solely on automated Processing - including profiling - that produces legal effects or similarly affects you.

Right to Complaint before a Supervisory Authority. You have the right to lodge a complaint with a Supervisory Authority if you believe that our Processing of Personal Data relating to you is inconsistent with our obligations under the GDPR. In this situation, we ask you please consider contacting us first, so that we can try and assist with your query or address your concern.

In order to exercise any of your rights as set forth herein, please contact us in writing, via email or postal mail as indicated in Section 12 of our Privacy Policy, so that we may consider your request under the applicable law. We may ask that you provide the following Personal Data for us to promptly address your request:

● The name, user ID, pseudonym, email address or other identifier you have provided to us or, if you have not otherwise previously interacted with us, your first and last name and an address where we can contact you;
● The country in which you are located;
● A clear description of the Personal Data or content that you wish to receive or to be deleted or corrected and/or the action you wish to be taken; and
● Sufficient information to allow us to locate the content or Personal Data to be deleted, removed and/or corrected.

For your protection, we may only respond to requests with respect to the Personal Data that is associated with the particular email address that is registered under your user account. In addition, please note that, depending on the nature of your inquiry, request and/or complaint, we may need to verify your identity before implementing your request and require documentary proof of identity, such as in the form of a government issued ID and proof of your physical address. We will make all efforts to comply with your request as soon as reasonably practicable and in any case within the timelines prescribed by the applicable law. However, we reserve the right to refuse to act on a request that is manifestly unfounded or excessive (e.g. because it is repetitive) and/or to charge a fee that takes into account the administrative costs for providing the information or the communication or taking the action requested, in the cases where such action is justified.

‍

APPENDIX C:  AI Governance and EU AI Act Alignment

 This Appendix applies where Ontop acts as provider, deployer, importer, distributor, or operator of AI systems in the EEA, the UK in the future to the extent adopted, and Switzerland where relevant.

Risk-based approach.

• Prohibited practices. Ontop does not design or deploy AI systems that exploit vulnerabilities of specific groups, perform social scoring of natural persons by public authorities criteria, or perform emotion recognition in the workplace for disciplinary purposes.
  
  
• High-risk systems. If a feature falls into a high-risk use case under the EU AI Act, Ontop will implement a risk-management system, data-governance and quality controls, technical documentation, logging, accuracy and robustness testing, human oversight, post-market monitoring, incident reporting, and conformity assessment as required.
  
  
• Limited-risk transparency. For AI systems that interact with users, generate content, or manipulate audio, image, or video, Ontop provides clear notices that users are interacting with AI and, where applicable, labels AI-generated or AI-manipulated content.
  
  
• General Purpose AI (GPAI). Where Ontop provides or integrates GPAI, we require model providers to meet applicable transparency, copyright, safety, and evaluation duties. Ontop will document known model limitations and intended uses.
  
  

Data governance. Training, testing, and validation datasets used by Ontop comply with applicable data protection and intellectual property laws. Personal Data is used only where a lawful basis exists, is minimized, and is subject to privacy by design and default. Sensitive Data is excluded unless a clear legal basis applies and appropriate safeguards are in place.

Human oversight. Ontop designs AI-assisted decisions to include qualified human review, with clear ability for individuals to obtain human intervention and to contest outcomes.

Record-keeping and logging. Ontop maintains technical documentation and logs sufficient to demonstrate compliance, facilitate audits, and investigate incidents, consistent with security and retention rules.

Post-market monitoring and incidents. Ontop operates a monitoring program to review AI system performance, bias, and safety, and will take corrective actions. Reportable serious incidents will be notified to competent authorities as required.

Third-party systems. When Ontop integrates third-party AI, we conduct due diligence and bind providers to contractual obligations that support this Appendix. If a third-party AI is classified as high-risk, Ontop will verify evidence of conformity assessment before deployment.

Client controls and opt out. Enterprise Clients may disable AI features for their tenant or request a custom data-use posture. If disabled, Ontop will not use that Client’s tenant data to operate optional AI features, except for security, abuse prevention, or legal compliance.

Contact. Questions about AI governance can be directed to privacy@getontop.com or through the Ontop Privacy Center.

APPENDIX D: LGPD Privacy Terms (Portuguese)

Note: This section applies specifically to Brazil residents.

ANEXO D: Termos de Privacidade LGPD (português)

Obs.: Esta seção aplica-se especificamente aos residentes do Brasil.

Os presentes termos e condições de privacidade relativos à Lei Geral de Proteção de Dados, n. 13.709/2018, (“Termos LGPD”) aplicam-se a atividades de processamento de Dados Pessoais sob a lei brasileira e complementa a nossa Política de Privacidade (General Privacy Policy - https://www.getontop.com/privacy-policy/).
‍

Seus direitos

Nos termos da Lei Geral de Proteção de Dados (Lei nº 13.709/2018, ou simplesmente “LGPD”), você terá os seguintes direitos:

● Confirmação da existência de tratamento dos seus dados;
● Acesso aos dados;
● Correção de dados incompletos, inexatos ou desatualizados;
● Anonimização, bloqueio ou eliminação de dados desnecessários, excessivos ou tratados em desconformidade com a lei;
● Portabilidade dos dados a outro fornecedor de serviço ou produto, mediante requisição expressa;
● Eliminação dos dados tratados mediante requisição expressa;
● Obtenção de informações sobre as entidades públicas ou privadas com as quais a Ontop compartilha os seus dados;
● Informação sobre a possibilidade de não fornecer o seu consentimento, bem como de ser informado pela Ontop sobre as consequências em caso de negativa; e
● Revogação do consentimento.

Dados Pessoais que coletamos

Podemos coletar e processar Dados Pessoais de clientes, prestadores de serviço, parceiros comerciais, representantes, visitantes ao nosso site, potenciais empregados futuros, indivíduos que recebem comunicações de marketing de nós e indivíduos que se engajam conosco em se registrando, comparecendo e/ou de outra forma participando em nossos webinars ou conferências ou aqueles que se comunicam conosco via e-mail, telefone ou presencialmente, em cada caso e para conduzir o nosso negócio nos propósitos específicos detalhados abaixo:

a. Dados de contato e de contas. Os dados e informações pessoais fornecidos quando usuários se inscrevem para contratar o nosso Serviço. Isso incluirá o nome, e-mail, número de telefone, endereço, cargo e senha, organização (se pessoa jurídica), e outras formas para que possamos entrar em contato com o cliente e usuário.

b. Informações sobre transações financeiras de usuários. Informações sobre as transações financeiras que você executa, pagamentos e informações de contas da Ontop.

c. Informações de pagamento. Se o pagamento pelos nossos Serviços for realizado via cartão de crédito, os dados coletados poderão incluir o número do cartão, data de vencimento, código de segurança e endereço de cobrança. Se o pagamento for realizado por meio de transferência bancária (internacional), os dados coletados poderão incluir o seu nome e dados bancários, como número de agência, número da conta, código IBAN e/ou SWIFT, entre outros. Caso o pagamento seja realizado via serviços eWallet (p.ex. PayPal, Payoneer, etc.), os dados coletados poderão incluir o nome e usuário da conta, endereço de e-mail e quaisquer outras informações que identifiquem a conta do usuário ou carteira digital aplicável. Caso os pagamentos sejam realizados via plataformas de processamento de pagamentos de terceiros, estes coletarão os seus Dados Pessoais referentes a tais pagamentos, não sendo a Ontop a empresa responsável por tais informações. Nestes casos, a política de privacidade da empresa terceira será a aplicável.

d. Dados e informações fornecidos em chat de mensagens instantâneas. Para melhor atender aos nossos usuários, disponibilizamos em nosso site ferramentas de mensagens instantâneas (IM). Quaisquer Dados Pessoais ou informações fornecidas por este meio serão coletados e armazenados.

e. Dados biométricos. Informações sobre o usuário que são armazenadas em documentos de diferentes formatos ou cópias destes, com o devido consentimento para uso da plataforma e/ou serviços da Ontop. Referem-se aos dados contidos no seu passaporte, documento de identidade, seguridade social ou quaisquer outros documentos de identificação pessoal. Para fins de verificação de usuário, algumas empresas terceiras que utilizamos poderão coletar fotos e/ou vídeos estilo selfie que executem softwares de reconhecimento facial para verificação de identidade.

f. Dados Pessoais fornecidos por telefone. Nós possuímos agentes de atendimento disponíveis para atender os nossos Clientes 24/7. Ligações poderão ser gravadas e quaisquer Dados Pessoais e/ou informações fornecidas pelo telefone, inclusive informações de pagamento, serão coletados e armazenados.

g. Outros Dados e/ou informações. Podemos solicitar que Clientes e Usuários forneçam informações gerais e outros Dados Pessoais através de nossos canais de atendimento e com o devido consentimento, com o objetivo de participar em pesquisas para a constante melhoria de nosso site, software ou Serviços.

Princípios a serem observados: Art. 6º As atividades de tratamento de dados pessoais deverão observar a boa-fé e os seguintes princípios:

I - finalidade: realização do tratamento para propósitos legítimos, específicos, explícitos e informados ao titular, sem possibilidade de tratamento posterior de forma incompatível com essas finalidades;

II - adequação: compatibilidade do tratamento com as finalidades informadas ao titular, de acordo com o contexto do tratamento;

III - necessidade: limitação do tratamento ao mínimo necessário para a realização de suas finalidades, com abrangência dos dados pertinentes, proporcionais e não excessivos em relação às finalidades do tratamento de dados;

IV - livre acesso: garantia, aos titulares, de consulta facilitada e gratuita sobre a forma e a duração do tratamento, bem como sobre a integralidade de seus dados pessoais;

V - qualidade dos dados: garantia, aos titulares, de exatidão, clareza, relevância e atualização dos dados, de acordo com a necessidade e para o cumprimento da finalidade de seu tratamento;

VI - transparência: garantia, aos titulares, de informações claras, precisas e facilmente acessíveis sobre a realização do tratamento e os respectivos agentes de tratamento, observados os segredos comercial e industrial;

VII - segurança: utilização de medidas técnicas e administrativas aptas a proteger os dados pessoais de acessos não autorizados e de situações acidentais ou ilícitas de destruição, perda, alteração, comunicação ou difusão;

VIII - prevenção: adoção de medidas para prevenir a ocorrência de danos em virtude do tratamento de dados pessoais;

IX - não discriminação: impossibilidade de realização do tratamento para fins discriminatórios ilícitos ou abusivos;

X - responsabilização e prestação de contas: demonstração, pelo agente, da adoção de medidas eficazes e capazes de comprovar a observância e o cumprimento das normas de proteção de dados pessoais e, inclusive, da eficácia dessas medidas.

Controladora e Encarregado (DPO)A controladora de dados responsável por seus dados pessoais é a Ontop Holdings Inc. e/ou quaisquer de suas empresas afiliadas (“Controladora”). Você pode entrar em contato com o encarregado pelo tratamento de Dados Pessoais (“DPO” ou “Encarregado”) através dos canais de contato disponíveis abaixo e na Cláusula 12 da nossa Política de Privacidade, com o assunto “Política de Privacidade”:

Encarregado pelo tratamento de Dados Pessoais - DPO

E-mail: privacy@getontop.com
Endereço: Ontop Holdings Inc., 251 Little Falls Drive, Wilmington, New Castle County, Delaware, 19808.

Updates to the Policy: Inform users that the policy may change with any LGPD updates or ANPD new guidance and describe how updates will be communicated.

APPENDIX E: COLOMBIA PRIVACY TERMS (SPANISH)

Note: This section only applies to Colombian residents.

ANEXO E: TÉRMINOS DE PRIVACIDAD PARA COLOMBIA (ESPAÑOL)

Obs.: Esta sección sólo aplica a residentes en el territorio de la República de Colombia.

1. GENERALIDADES
De conformidad con el artículo 15 de la Constitución Política, relativo al derecho que tienen todas las persona a conocer, actualizar y rectificar las informaciones que se hayan recogido sobre ellas en bases de datos; el artículo 20 de la Constitución Política, sobre el derecho a la información; la Ley Estatutaria 1581 de 2012 “Por la cual se dictan disposiciones generales para la protección de datos personales”, el Decreto 1377 de 2013, “Por el cual se reglamenta parcialmente la Ley 1581 de 2012” y demás normas reglamentarias; Ontop, teniendo en cuenta su responsabilidad en el tratamiento de datos personales de otros, en cumplimiento de las normas señaladas, adopta este Anexo con temas complementarios para Colombia a su Política de Privacidad sombrilla (General Privacy Policy – https://www.getontop.com/legal/privacy-policy/).

2. CAMPO DE APLICACIÓN
El Anexo D se aplica a clientes, contratistas, empleados, proveedores o, de cualquier otra persona que por algún motivo suministre información a Ontop, mientras se encuentren en el territorio de la República de Colombia.

3. PRINCIPIOS PARA EL TRATAMIENTO DE DATOS PERSONALES
El Anexo D se aplica a clientes, contratistas, empleados, proveedores o, de cualquier otra persona que por algún motivo suministre información a Ontop, mientras se encuentren en el territorio de la República de Colombia.

Ontop como Responsable del Tratamiento, aplicará, de manera armónica e integral, los siguientes principios rectores en la recolección, manejo, uso, tratamiento, almacenamiento e intercambio de datos personales:

1. Principio de legalidad en materia de Tratamiento de datos: En el Tratamiento de datos personales, Ontop dará aplicación al artículo 15 de la Constitución Política; al artículo 20 de la Constitución Política; a la Ley Estatutaria 1581 de 2012; al Decreto 1377 de 2013; al Decreto 1074/15 y a las demás normas vigentes y aplicables y demás disposiciones que la desarrollen, que rigen el tratamiento de datos personales y demás derechos fundamentales conexos.

2. Principio de finalidad: El Tratamiento de datos personales que sean acopiados o recogidos por Ontop o a los que esta tenga acceso, obedecerá a una finalidad legítima de acuerdo con la Constitución y las Leyes, la cual debe ser informada al Titular.

3. Principio de libertad: El Tratamiento de datos personales sólo puede ejercerse con el consentimiento, previo, expreso e informado del Titular. Los datos personales no podrán ser obtenidos o divulgados sin previa autorización, o en ausencia de mandato legal o judicial que releve el consentimiento.

4. Principio de veracidad o calidad: La información sujeta a captura, recolección, uso y tratamiento de datos personales debe ser veraz, completa, exacta, actualizada, comprobable y comprensible. Se prohíbe el Tratamiento de datos parciales, incompletos, fraccionados o que induzcan a error.

5. Principio de transparencia: En el Tratamiento de datos personales debe garantizarse el derecho del Titular a obtener de Ontop o del Encargado del Tratamiento, en cualquier momento y sin restricciones, información acerca de la existencia de datos que le conciernan.

6. Principio de acceso y circulación restringida: El Tratamiento de datos personales se sujeta a los límites que se derivan de la naturaleza de los datos personales y, a las normas vigentes y aplicables que rigen el tratamiento de datos personales y demás derechos fundamentales conexos. En este sentido, los datos personales sólo podrán ser objeto de Tratamiento por personas autorizadas por el Titular, y salvo la información pública, no podrán estar disponibles en Internet u otros medios de divulgación o comunicación masiva, salvo que el acceso sea técnicamente controlable para brindar un conocimiento restringido sólo a los Titulares o terceros autorizados conforme a la ley.

7. Principio de seguridad:La información sujeta a Tratamiento por parte de Ontop, se manejará con las medidas técnicas, humanas y administrativas existentes que sean necesarias para otorgar seguridad a los registros, evitando su adulteración, pérdida, consulta, uso o acceso no autorizado o fraudulento.

8. Principio de confidencialidad: Todas las personas que intervengan en el Tratamiento de datos personales o que tengan acceso a informaciones que se encuentren en Bases de Datos y que no tengan la naturaleza de públicos, están obligadas a garantizar la reserva de la información, inclusive después de finalizada su relación con alguna de las labores que comprende el Tratamiento de la información, pudiendo sólo realizar suministro o comunicación de datos personales cuando ello corresponda al desarrollo de las actividades autorizadas en las normas vigentes y aplicables que rigen el tratamiento de datos personales, y demás derechos fundamentales conexos.

Todas las personas que trabajen actualmente o sean vinculadas a futuro para tal efecto, en la administración y manejo de bases de datos, deberán suscribir otro sí a su contrato laboral o de prestación de servicios para efectos de asegurar tal obligación.

4. DERECHOS DE LOS TITULARES DE DATOS PERSONALES
Todo proceso que conlleve el Tratamiento de datos personales por parte de cualquier área de la compañía, tanto de visitantes, clientes, contratistas, trabajadores, proveedores y, en general, cualquier tercero con el cual Ontop sostenga relaciones comerciales y laborales, deberá tener en cuenta los derechos que le asisten a ese Titular de los datos, los cuáles se enuncian a continuación:

1. Conocer, actualizar, consultar o rectificar sus datos personales, en cualquier momento, frente a Ontop, respecto a aquellos datos que considere parciales, inexactos, incompletos, fraccionados y/o que induzcan a error.
2. Solicitar en cualquier momento una prueba de la autorización otorgada a Ontop para el Tratamiento de sus datos personales.
3. Ser informado por Ontop, previa solicitud del Titular de los datos, respecto del uso que le ha dado a los mismos.
4. Presentar ante la Superintendencia de Industria y Comercio las quejas que considere pertinentes para hacer valer su derecho al Habeas Data frente a Ontop.
5. Revocar la autorización y/o solicitar la supresión de algún dato, cuando considere que la Ontop no ha respetado sus derechos y garantías constitucionales.
6. Acceder, en forma gratuita, a los datos personales que voluntariamente decida compartir con Ontop, para lo cual la compañía se encargará de conservar y archivar de forma segura y confiable los formatos de autorización de cada uno de los titulares de datos personales debidamente otorgadas.

5. TRATAMIENTO DE LOS DATOS SENSIBLES
Dato sensible: Aquellos que afectan la intimidad del Titular o cuyo uso indebido puede generar su discriminación, tales como los relacionados con el origen racial o étnico, la pertenencia a sindicatos, organizaciones sociales o de derechos humanos, convicciones políticas, religiosas, de la vida sexual, biométricos o datos de la salud y, los datos biométricos, como huellas digitales, fotografías, iris, reconocimiento de voz, facial o de palma de mano. Esta información podrá no ser otorgada por el Titular de estos datos.

Ontop podrá hacer la captura, recolección, uso y tratamiento de los datos catalogados como sensibles cuando:

a) El Titular haya dado su autorización previa y explícita a dicho Tratamiento, salvo en los casos que por ley no sea requerido el otorgamiento de dicha autorización.

b) El Tratamiento sea necesario para salvaguardar el interés vital del Titular y este se encuentre física o jurídicamente incapacitado. En estos eventos, los representantes legales deberán otorgar su autorización.

c) El Tratamiento sea efectuado en el curso de las actividades legítimas y con las debidas garantías por parte de una fundación, ONG, asociación o cualquier otro organismo sin ánimo de lucro, cuya finalidad sea política, filosófica, religiosa o sindical, siempre que se refieran exclusivamente a sus miembros o a las personas que mantengan contactos regulares por razón de su finalidad. En estos eventos, los datos no se podrán suministrar a terceros sin la autorización del Titular.

d) El Tratamiento se refiere a datos que sean necesarios para el reconocimiento, ejercicio o defensa de un derecho en un proceso judicial. El Tratamiento tenga una finalidad histórica, estadística o científica. En este evento deberán adoptarse las medidas conducentes a la supresión de identidad de los Titulares.

6. TRANSFERENCIA DE DATOS
Si Ontop transfiere los Datos Personales a su casa matriz o a otras sucursales, se aplicará la Política de Privacidad Sombrilla. Si Ontop transfiere los Datos Personales a terceros, tales como proveedores de servicios o socios de negocios, mediará un acuerdo de procesamiento de datos que cumpla con la legislación aplicable vigente.

7. OTROS DATOS PERSONALES QUE RECOLECTAMOS
Además de los datos personales mencionados en la Política de Privacidad sombrilla (General Privacy Policy – https://www.getontop.com/legal/privacy-policy/), en Colombia Ontop recolecta y administra datos como tipo de documento de identificación, número de documento de identificación, lugar de expedición de documento de identificación, género, RH, fotografía, huella digital, fecha y lugar de nacimiento, edad, grado de escolaridad (títulos obtenidos), compañía para la cual labora y/o que representa, cargo u ocupación, estado civil, nombre del cónyuge o compañero permanente, nombre de personas a cargo, parentesco de personas a cargo, edad de personas a cargo, fecha de nacimiento, ocupación de personas a cargo, dirección/domicilio, teléfono fijo personal, teléfono fijo de la compañía, teléfono celular personal, teléfono celular de la compañía, correo electrónico personal, correo electrónico de la compañía, nombre, parentesco y teléfono de persona a contactar en caso de emergencia, entidad promotora de salud (EPS), Caja de compensación, administradora de riesgos profesionales (ARL), administradora de fondo de pensiones, administradora de fondo de cesantías y, datos sensibles relacionados con la salud, en cuanto a órdenes y relación de pruebas, así como los resultados de éstas (por ejemplo y según corresponda, Perfil lipídico, Glicemia, PSA –Antígeno específico de próstata para hombres mayores de 40 años–, Audiometría, Espirometría, Optometría, Citología –para mujeres–, Pruebas de función renal y hepática –AST-ALT-FA-creatinina-Parcial de orina-hemograma–, KOH-coprocultivo y cultivo nasofaringe y, RX de tórax –PA Y lateral–).
Dichos datos son recolectados por Ontop con el propósito de gestionar la relación comercial existente entre Ontop y sus clientes, gestionar los procesos de nómina y realizar todas aquellas actuaciones relacionadas con la relación laboral existente entre Ontop y sus trabajadores o contratistas directos, y gestionar la relación comercial existente entre Ontop y sus proveedores.

8. PROCEDIMIENTOS PARA EL EJERCICIO DE LOS DERECHOS DEL TITULAR DE LOS DATOS PERSONALES
El usuario podrá ejercer su derecho a conocer, actualizar, rectificar y suprimir los datos personales que haya suministrado a Ontop, enviando una comunicación, en cualquier momento y de manera gratuita, a través del siguiente portal https://ontop.privacy.saymine.io/Ontop-privacy

De conformidad con lo dispuesto en el Artículo 20 del Decreto 1377 de 2013, los derechos de los Titulares establecidos en la Ley, podrán ejercerse por:a) El Titular, quien deberá acreditar su identidad en forma suficiente por los distintos medios que le ponga a disposición el Responsable.b) Por sus causahabientes, quienes deberán acreditar tal calidad.c) Por el representante y/o apoderado del Titular, previa acreditación de la representación o apoderamiento.La petición o derecho que ejercita el Titular de los datos personales deberá contener, como mínimo:1. Identificación del Titular.2. Los datos de contacto para recibir notificaciones.3. Los documentos que acrediten en debida forma la personería o mandato para actuar, si fuera el caso.4. La descripción clara y precisa de los datos personales respecto de los cuales el Titular busca ejercer alguno de los derechos.Estos derechos se podrán ejercer, entre otros, frente a datos parciales, inexactos, incompletos, fraccionados, que induzcan a error o, aquellos cuyo tratamiento esté expresamente prohibido o no haya sido autorizado por su Titular.9. CONSULTAS
Los Titulares, sus causahabientes o representantes podrán consultar la información personal del Titular que repose en cualquier base de datos de Ontop, suministrando a estos toda la información contenida en el registro individual o que esté vinculada con la identificación del Titular. La consulta se formulará por escrito, a través del medio indicado en el numeral 8, siempre y cuando sea el Titular de los datos o su representante.10. RECTIFICACIÓN O ACTUALIZACIÓN DE DATOS
Los Titulares, sus causahabientes o representantes que consideren que la información contenida en una base de datos de Ontop debe ser objeto de rectificación o actualización, podrán presentar un reclamo ante Ontop, el cual será tramitado bajo las siguientes reglas:El reclamo se formulará mediante solicitud dirigida a Ontop, a través del medio indicado en el numeral 8, con la siguiente información:1. Identificación del Titular.2. Los datos de contacto para recibir notificaciones.3. Los documentos que acrediten en debida forma la personería o mandato para actuar, si fuera necesario.4. La descripción de los hechos que dan lugar al reclamo.5. La descripción clara y precisa de los datos personales respecto de los cuales el Titular busca la rectificación o actualización.6. Los documentos que se quieran hacer valer.11. SUPRESIÓN DE DATOS
Los Titulares, sus causahabientes o representantes podrán solicitar, en todo momento y de forma gratuita, a Ontop, la supresión de sus datos personales cuando:a) Consideren que los mismos no están siendo tratados conforme a los principios, deberes y obligaciones previstas en la normatividad vigente y en la presente Política.b) Hayan dejado de ser necesarios o pertinentes para la finalidad para la cual fueron recabados.c) Se haya superado el periodo necesario para el cumplimiento de los fines para los que fueron recabados.Esta supresión implica la eliminación total o parcial de la información personal de acuerdo con lo solicitado por los Titulares, sus causahabientes o representantes, en los registros, archivos y bases de datos administrados por Ontop.El reclamo se formulará mediante solicitud dirigida a Ontop, a través del medio indicado en el numeral 8, con la siguiente información:1) Identificación del Titular.2) Los datos de contacto para recibir notificaciones.3) Los documentos que acrediten en debida forma la personería o mandato para actuar, si fuera necesario.4) La descripción de los hechos que dan lugar al reclamo.5) La descripción clara y precisa de los datos personales respecto de los cuales el Titular busca la rectificación o actualización.6) Los documentos que se quieran hacer valer.Ahora bien, es importante tener en cuenta que el derecho de cancelación no es absoluto y el Responsable puede negar el ejercicio del mismo cuando:1) El Titular tenga un deber legal o contractual de permanecer en la base de datos.2) La eliminación de datos obstaculice actuaciones judiciales o administrativas vinculadas a obligaciones fiscales, la investigación y persecución de delitos o la actualización de sanciones administrativas.3) Los datos sean necesarios para proteger los intereses jurídicamente tutelados del Titular; para realizar una acción en función del interés público, o para cumplir con una obligación legalmente adquirida por el Titular.12. REVOCATORIA DE LA AUTORIZACIÓN
Los Titulares, sus causahabientes o sus representantes podrán, en todo momento y de forma gratuita, revocar el consentimiento al Tratamiento de sus datos personales, siempre y cuando no lo impida una disposición legal o contractual.Para ello, el Titular podrá revocar su consentimiento mediante el mismo medio por el que lo otorgó.Al respecto, se debe tener en cuenta que existen dos modalidades de revocación del consentimiento: Una de ellas se da sobre la totalidad de las finalidades consentidas y, la otra, se da sobre algunos tipos de tratamiento determinados.13. DEBERES COMO ENCARGADO DEL TRATAMIENTO
Ontop se encarga directamente del tratamiento y custodia de los Datos Personales captados y almacenados. Sin embargo, se reserva el derecho a delegar en un tercero tal Tratamiento, para lo cual exigirá al Encargado la atención e implementación de las Políticas y procedimientos idóneos para la protección de los datos personales y la estricta confidencialidad de los mismos, de acuerdo con la normatividad vigente.14. MEDIDAS DE SEGURIDAD ADOPTADAS CON RELACIÓN AL TRATAMIENTO DE DATOS PERSONALES
Ontop adoptará las medidas técnicas, humanas y administrativas necesarias para garantizar la seguridad y confidencialidad de los datos y para evitar su alteración, pérdida, consulta, uso o acceso no autorizado. Los datos personales que el Titular de la información suministre a Ontop bajo cualquier medio, serán administrados de forma confidencial, con las debidas garantías constitucionales, legales y demás normas aplicables a la protección de datos personales.15. RESPONSABLE DEL TRATAMIENTO DE DATOS PERSONALES
El responsable de la captura, recolección, uso y tratamiento de sus datos personales es la sociedad Ontop Digital Colombia SAS, identificada con el NIT 901.456.887-1, con domicilio en Cr 18 No. 93 A 57, Bogotá, D.C., Colombia, correo electrónico privacy@getontop.com.

‍