Object First® Privacy Policy

This policy is effective as of 20.05.2024 and gets updated every 12 months. This Privacy Policy applies to the information and data that Object First, GmbH and its affiliates ("Object First"), located in St. Niklausenstrasse 15, 6005, St. Niklausen, Horw LU, Switzerland, CHE-366.953.027 and available for contact under +1 (844) 569-0653, collects when you use our website or our products and services.

Summary

This policy applies to:

● Visitors to our website

● Customers

● Partners and Distributors

● Users of our products and services

The purpose of this Privacy Policy is to let you know how we collect, use, store, share, retain, transfer, and process your Personal Information. This policy also describes your choices and rights with respect to your Personal Information and how to exercise those rights. “Personal Information” is any information relating to an identified or identifiable individual.

We may amend this policy from time to time. We encourage you to review this policy periodically, as changes will be posted on this page. If we make any material changes to this policy, we will provide a prominent notice. If you do not agree with this policy, you should not use our website, products, or services.

By using and interacting with our website, you explicitly accept this Policy and grant Object First, GmbH and its affiliates and authorized partners to use your personal data in order to receive information and updates regarding Object Storage products, services, surveys, and events.

This Policy covers:

• What Personal Information We Collect

• How We Collect Information

• How We Use Your Information

• The Legal Basis For Collecting and Processing Information

• How We Share Information

• How We Retain Information

• Cookies and Other Tracking Technologies

• Your Rights Regarding Access to and Control over Personal Information

• Information for California Residents

• International Data Transfers

• Security

• Automated Decision Making and Profiling

• Children's Privacy

• Sensitive Information

• Contact Us

• Additional Information

What Personal Information We Collect

We collect various types of information depending on how you interact with us and what

products or services you use.

Personal Information you provide to us

If you fill out a form on our Website to receive communication about Object First’s Services, obtain Collateral or Services, participate in other activities on the Website, or otherwise contact Object First, we will collect and process the information you provide to give you access to the communication, samples, services, and events requested. These types of Personal Information may include:

• Name and Contact Data: your first and last name, job title, corporate e-mail address, your employer, phone number, and your country of residence.

• Credentials: user account details, passwords for authentication, and account access. Object First may also use similar credentials, like password hints and other security information, as the case may be.

Personal Information collected when you visit our website

When you use our website, we may automatically collect Personal Information such as device and usage information, including your IP address, user - agent information (which is automatically sent by your web browser and may include your browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location), information about how and when you use the Website, and information collected by cookies and other similar technologies.

Personal Information collected when you use our products or services

When you use our products and services, we collect other types of Personal Information. These types of Personal Information may include:

● Username

● IP Address

● Name

● Email address

● Street Address

● Telephone Number

We may also collect usage data regarding your use of our products and services and this data may contain Personal Information.

We also collect payment and billing information when you register for the use of our products and services. For example, we may ask you to provide a billing address for your account and payment information. We use this information solely to process payments and deliver our products and services.

If we need sensitive personal information , we will only collect such information with your explicit consent.

Unless otherwise noted in this policy, we act as the “controller” of personal data that we collect and process.

How We Collect Information

We collect Personal Information from you when you visit our website or use our products and services. Some of this information is provided by you and some is collected automatically. We collect Personal Information in the following ways:

• When you interact with our Website to receive communication about Object First’s Services, Collateral or Services, participate in other activities on the Website, or otherwise contact Object First.

• When you use our website, we may automatically collect Personal Information such as device and usage information, including your IP address, user - agent information (which is automatically sent by your web browser and may include your browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location), information about how and when you use the Website, and information collected by cookies and other similar technologies.

• When you contact Object First’s customer support team via call, email, or another communication tool. The legal basis of collecting this information is Object First’s fulfillment of contractual or pre-contractual obligations to you or your consent thereto.

• Additionally, Object First may record support team calls. The purpose of call recording is quality control of Object First’s customer support services and personnel training. The legal basis for call recording is Object First’s legitimate interests in retaining you as a customer and providing you with first-class customer support services.

We may collect personal information from other sources, such as: public databases, marketing partners, or other publicly available sources. Examples of the information Object First may receive from other sources include: social media profile information; marketing leads; search results; and links to paid listings (such as sponsored links).

How We Use Your Information

We process your personal information for the following purposes (note that the list is non-

exclusive):

● To facilitate the creation of an account and log-on process with your consent;

● To keep in touch with you for administrative, business, or contractual purposes with your consent;

● For advertising and marketing purposes, if this is in accordance with your preferences. You can always opt-out of Object First's marketing e-mails at any time by Contacting Object First as outlined in Section M, below;

● To send you Services and new feature information depending on your account preferences;

● To notify you about changes and updates to Object First's terms, conditions, or policies;

● In order to fulfill and manage your orders for contractual reasons. Object First may use your information to fulfill and manage your orders, payments, returns, or exchanges made through the Website or otherwise;

● To request feedback or comments from you concerning Object First's Services;

● To respond to legal requests and prevent harm. For example, if Object First receives a subpoena or other legal request, Object First may need to inspect the Personal Information it holds in order to determine if and how to respond; and

● To view your online actions across the Website and Services for data analysis, specifically, identifying usage trends, determining the effectiveness of promotional campaigns, and to evaluate and improve the Website, products, Services, and your overall experience.

The Legal Basis For Collecting and Processing Information

We use the following legal bases for collecting Personal Information:

● We may collect or process information with your consent, such as when you fill out a form on our website, ask for information, or sign up for services.

● We may collect or process information we need to provide our services or fulfill a contractual obligation.

● We may collect or process information to fulfill a legal obligation.

● We may collect information when we have a legitimate interest to do so, such as for marketing, as long as our legitimate interests are not outweighed by your rights.

● We may collect or process information if necessary to protect the vital interests of the user or another individual.

● We may collect your Personal Information when you contact us through customer support via call, email, or another communication tool. The legal basis of collecting this information is our fulfillment of contractual or pre-contractual obligations to you or your consent thereto.

● We may record support team calls. The legal basis for call recording is our legitimate interests in retaining you as a customer and providing you with first-class customer support services.

How We Share Information

Object First only shares Personal Information with your consent to comply with laws, to protect your rights, or to fulfill business obligations. As a non-exclusive list of examples, Object First only shares and discloses your Personal Information in the following situations:

• Compliance with Laws. Object First may disclose your Personal Information where it is legally required to do so in order to comply with applicable law, governmental requests, judicial proceeding, court order, or legal processes such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements);

• Vital Interests and Legal Rights. Object First may disclose your Personal Information where it believes it is necessary to investigate, prevent, or take action regarding potential violations of Object First’s policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or in the event of litigation;

• Vendors, Consultants, and Other Third-Party Service Providers. Object First may share your Personal Information with third-party vendors, service providers, contractors, or agents (“Third-Party Processors”) who perform services on its behalf and require access to such information. For example, Object First may use third parties for technical and customer support, payment processing, data analysis, email delivery, hosting services, customer service, and marketing efforts. These Third-Party Processors may be located within the EU, the U.S., or another country at Object First’s sole discretion, however, any third party with which Object First shares your Personal Information will be held to similar data protection standards to that of the EU-US Privacy Shield Framework and the GDPR.

• Tracking Technology. Object First also may allow select third parties to use tracking technology on the Website, which will enable the collection of data about how you interact with the Website over time. This information may be used to, among other things, analyze and track data, determine the popularity of certain content or pages, and better understand online activity in order for Object First to better its Website and Services.

• Business Transfers. Object First may share or transfer your Personal Information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of its business to another company;

• Business Partners. Object First may share your Personal Information with its business partners to offer you certain products, Services, or promotions, and/or facilitate the provision of Object First products and Services to you, as well as with other Object First entities;

• With your Consent. Object First may disclose your Personal Information for any other purpose in accordance with your consent.

How Long We Retain Your Information

Object First keeps your Personal Information for as long as necessary to fulfill the purposes outlined in the Privacy Policy, unless otherwise required by law. Object First undertakes not to store your information for longer than is required, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When Object First no longer has a legitimate business need to process your Personal Information, it will either delete or anonymize such information. However, if this is not possible (for example, because your Personal Information has been stored in backup archives), then Object First will securely store your Personal Information and isolate it from any further processing until deletion is possible.

Cookies and Other Tracking Technologies

Object First may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Cookies are small files stored on your web browser when you visit our website. Some cookies last only as long as you remain on the website; others, called “persistent cookies” may be stored for longer periods of time. These cookies can make browsing easier by storing your password or your preferences regarding how you use the website. Cookies collect information such as the IP address of your computer, your browser settings, and information about how you use the website. Your general location may be estimated from your IP address. Some cookies track users’ activity on our website, apps, and services in order to deliver personalized advertising to you on this and other websites.

If you would like to opt out of cookies, you may change the settings on your web browser to reject or delete cookies. You may also find more information about cookies, including how to opt out of interest-based advertising, at www.cookiesandyou.com.

Your Rights Regarding Access to and Control over Personal Information

If you reside in the EU/EEA, you may have the following rights with regard to your personal information:

● Right of information and access - You have the right to access your Personal Information we have about you and to be provided with a copy of your Personal Information.

● Right to rectification - You have the right to correct or update your inaccurate or out of date Personal Information.

● Right of erasure - You have the right to request that your Personal Information be permanently erased/deleted.

● Right to restrict processing - You have the right to restrict the processing of your Personal Information.

● Right to object to processing - You have the right to object to specific types of processing of your Personal Information.

● Right to portability - You may ask to receive a portable copy of your personal information in a format that may be transferred to another organization.

● Right not to be subject to decisions based solely on Automated Decision Making - You have the right not to be subject to decisions based solely on automated processing.

● Right to complain to a data protection authority - You have the right to complain to a supervisory authority in the country in which you reside, details of which can be provided upon request or to the lead supervisory authority for Object First GmbH, which is Kelly Wells kelly.wells@objectfirst.com

● Right to withdraw consent - If you have given us consent to collect or process your Personal Information, you may withdraw that consent at any time.

● The Right to Non-Discrimination - We may not discriminate against you if you exercise your privacy rights. 

If you wish to exercise any of these rights please submit a request DSAR Form 

We may charge a reasonable fee if your request is not valid under applicable law, is repetitive or excessive. We may also request additional information from you in order to verify your identity before processing your request.

Information for California Residents

The California Consumer Privacy Act (CCPA) applies to information collected from California residents. Residents of California have the following rights with regard to their personal information:

● The Right to Know and Access Information

The categories of personal information we collect is described above in the section entitled “ The Information We Collect”. California residents may submit a verifiable request regarding the information collected, the types of sources from which personal Information is collected, the purposes for which information is collected, and the specific personal information collected about them.

● The Right to Have Personal Information Deleted

● The Right To Portability

California residents may request a copy of their personal information in a format that can be transferred to another person or entity.

● The Right to Non-Discrimination

We may not discriminate against you if you exercise your privacy rights. 

You may be asked for more information in order for us to verify your identity when you make a request. We do not sell Personal Information to third parties (pursuant to California Civil Code Sections 1798.100-1798.99, also known as the California Consumer Privacy Act of 2018.

The sections above “What Personal Information We Collect” lists the categories of Personal Information we have collected in the preceding 12 months.

International Data Transfers

Personal Information may be transferred from users residing in the European Union to our servers, partners, or vendors located in the United States and other non-EU countries where there may not be an adequacy opinion issued with respect to that country. We have taken appropriate safeguards to ensure that Personal Information remains protected wherever it is transferred. When we transfer Personal Information of individuals in the European Economic Area (“EEA”), Switzerland or the United Kingdom (“UK”) to the US, we make use of the Standard Contractual Clauses and the UK Addendum as well as additional safeguards where appropriate. To obtain a copy of our Standard Contractual Clauses, please contact kelly.wells@objectfirst.com .

Security

We take all reasonable steps to protect the information we receive from you from accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access. We have put in place appropriate physical, technical, and administrative measures to safeguard and secure your information, but no security measures are perfect; the risk of a data breach is possible.

• Personal data is encrypted during transmission.

• Personal information is encrypted at rest at our data centers.• Employees are given access to users’ personal information only on a “need to know” basis.

• All employees are required to receive training on information security.

• All employees with access to personal information are subject to background checks.

• All employees with access to personal information are required to sign a binding confidentiality agreement.

• Before sharing personal information with our vendors, we make sure they have implemented security procedures to protect your data. Our vendors and partners are not permitted to use or share your information for any purpose other than to provide the services for which they have been contracted.

Children’s Privacy

We do not knowingly collect or solicit personal information from children under age 13 without parental consent, unless permitted by law. If we become aware that we have collected personal information from children under the age of 13 without parental consent (or as permitted by law), we will delete it. If you believe that a child may have provided us with personal information without such parental consent, please contact us.

California consumers: We will not sell the information of California consumers who are 16 years old or younger unless we have prior parental authorization. If a California consumer is under the age of 13, a parent or guardian must consent to the sale of such minor’s personal information. If the California consumer is between the ages of 13 and 16 years old, the minor may consent on an opt-in basis to the sale of their personal information.

EU residents: We do not collect or process personal information of data subjects in the EU under the age of 16 without explicit consent from a parent or guardian.

Sensitive Information

Unless specifically requested, we ask that you not send us, and you not disclose on or through our websites or otherwise to us sensitive personal Information unless specifically requested by us or required by law.

Contact Us

If you have any questions about this privacy policy, or if you want to exercise your privacy rights as outlined above, please contact us at St. Niklausenstrasse 15, 6005, St. Niklausen, Horw LU, Switzerland, CHE-366.953.027; phone number: +1 (844) 569-0653.

Data Protection Officer: Kelly Wells

Email: kelly.wells@objectfirst.com

ATTN: Privacy Inquiry/Complaint

Mailing Address: St. Niklausenstrasse 15, 6005, St. Niklausen, Horw LU, Switzerland, CHE-366.953.027 

EU-US PRIVACY SHIELD POLICY

Object First’s Privacy Policy also adheres to the EU-US Privacy Shield Framework (the “Framework”) as set forth by the U.S. Department of Commerce regarding the processing of Personal Information transferred from the EU to the U.S. The Framework further outlines Object First’s practices for collecting, disclosing, maintaining, using, and protecting your Personal Information. As a participant, Object First is certified by the Department of Commerce that it will adhere to the Privacy Shield Principles. Should there be a conflict between Object First’s Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To view Object First’s EU-US Privacy Shield status and listing as a participant, click the following link to view the Privacy Shield List of Participants.

In compliance with the Framework’s Principles, Object First is committed to resolve complaints about your privacy and its collection or use of your Personal Information. As outlined in Sections C, D, & F above, Object First may use some third-party services in order to provide you with functionality and services pertaining to your use of the Website and Services. In the case of onward transfers to these third parties, Object First may be liable for breaches of Personal Information regarding such transfers. However, all Third-Party Processors used by Object First will be similarly held to provide at a minimum the same level of protection of Personal Information as required by the Framework. Should you be a Qualified Individual and have an inquiry or complaint concerning Object First’s Privacy Policy or use of your Personal Information, You should follow the procedures as outlined in the section above. Under certain limited conditions, you may be able to invoke binding arbitration as provided under the Framework to address an otherwise unresolved complaint.

European Contacts

If you have a privacy concern, complaint, or question for the data protection officer for your region, please contact us by using our DSAR Form.

We value your opinions. If you have any questions or comments regarding this Supplemental European Privacy Statement, please contact us at Kelly.wells@objectfirst.com