Privacy provisions

Infinwebs processes, among other things, personal data for and on behalf of the customer because the customer has a software user agreement with Infinwebs. Infinwebs and the customer are therefore obliged under the General Data Protection Regulation (GDPR) to conclude a Data Processing Agreement.

This processing agreement is included in the Privacy Provisions, available at /privacy-agreement. In this respect Infinwebs is the 'processor' and the customer the 'controller'. Infinwebs and the customer mutually undertake to comply with the General Data Protection Regulation (GDPR). For the definitions of terms, the GDPR applies. Infinwebs will only process the personal data for and on behalf of the customer and in order to perform the agreement.

Processing instructions

The processing consists of making the onFact software available with the data entered and generated by the customer. Infinwebs will not add, modify or delete any data without the customer having given instructions to do so by email via support@onfact.ae.

Various types of personal data can be recorded in the customer's personal onFact environment. Infinwebs is aware that the customer can enter all of these, and possibly personal data or categories they create themselves, and that Infinwebs will then process them by, among other things, storage, backup, processing them for login, for sending the subscription invoice, ... In all cases, the customer is itself responsible for assessing whether the purpose and nature of the processing fit the services Infinwebs provides with regard to the onFact software.

Infinwebs collects anonymised data on the use of its products and services. This data helps Infinwebs understand whether, how and how often certain parts of the product are used. The anonymised data will be used exclusively to improve products and services. Infinwebs will never use the collected user statistics for commercial purposes or offer them to third parties.

Data collection

The onFact website and application use cookies, which store small pieces of information on your computer. These are three sessions/groups for statistical data by Google Analytics (_ga, _gat and _gad) and a session ID to keep track of the login (PHPSESSID). When the onFact software is used, a second session ID (session_key) is stored in local storage or in a cookie.

Infinwebs uses the Facebook pixel and associated cookies to track website visitors and analyse promotional campaigns.

All visitors to the onFact websites are included anonymously in usage statistics via Google Analytics.

Duty of confidentiality

Infinwebs is aware that the information the customer shares and stores within its onFact environment is confidential and commercially sensitive. All Infinwebs employees are obliged by their employment contract to keep any customer data strictly confidential.

Employees with access to customer data

Only onFact system administrators have full access to customer data for:

• deploying a new version;
• applying patches and hotfixes;
• making a backup;
• importing data at the explicit request of the customer.

Support staff only have access to customer data if they have received permission from the customer and for as long as they have the customer's permission. In some cases this permission is essential to solve specific problems. The customer is itself responsible for granting this access, via the ‘GDPR’ tab under ‘Company settings’ in your onFact account. This access can be revoked at any time.

In order to follow up a support question reported by the customer, the communication with the customer about it is also stored.

Security

Infinwebs continuously takes appropriate technical and organisational measures to protect the customer's personal data against loss or any form of unlawful processing.

The connection between the subscriber's (customer's) computer and the onFact servers is secured by a 256-bit encryption certificate issued by Amazon.

The data the subscriber (customer) enters in its onFact environment is always protected by the account name and password. An extra security layer of 2-factor authentication via an authentication app can be activated by the customer. A user's password is stored securely under encryption. Nobody can view the personal password within onFact.

Sub-processors

Infinwebs processes customer data in Amazon Web Services data centres, which is therefore a sub-processor. The data centres Infinwebs uses (physical servers) are located in Ireland and comply with strict European legislation on logical and physical access security and continuity. The data centres are at least ISO 27001 certified. The (personal) data is processed by Infinwebs and the sub-processor exclusively within the European Economic Area. Infinwebs has imposed on the sub-processor(s) the same obligations as apply to itself. Amazon has no access to the actual data on these servers.

Integrations with third-party service providers

Software applications

By activating available integrations with other software applications, onFact may share data with third-party service providers in the context of these integrations.

The customer chooses which integrations to activate and is therefore responsible for the relationship between its onFact environment and the access granted to it inherent to the chosen integration. The customer will itself conclude the necessary agreements with the third parties offering these integrations.

External users

The customer has the option of giving external users access to the onFact environment from its own account. The customer is itself responsible for this activated access and will itself ensure the GDPR compliance of this access.

If, for example, a user gives their accountant access to the onFact environment, the customer and the accountant will need to conclude an agreement that is GDPR-compliant and in which the rights and obligations of both parties are clearly stated.

Infinwebs can in no case be held liable for actions of external users added by an onFact customer to their account.

Privacy rights

Infinwebs has no control over the personal data made available by the customer. Without necessity given the nature of the assignment provided by the customer, explicit consent of the customer or a legal obligation, Infinwebs will not provide the data to third parties or process it for purposes other than the agreed purposes. The customer guarantees that the personal data may be processed on the basis of a legal ground stated in the GDPR.

Obligation to report data breaches

The GDPR requires that any data breaches be reported to the Data Protection Authority by the controller of the data. Infinwebs will therefore not itself make any notifications to the Belgian Data Protection Authority (GBA). Of course, Infinwebs will inform the customer correctly, in a timely manner and completely about relevant incidents, so that the customer as controller can meet its legal obligations. More information

If the customer makes a (provisional) notification to the GBA and/or the data subject(s) about a data breach at Infinwebs without the customer having informed Infinwebs about it, the customer is liable for damage suffered by Infinwebs and the costs of this notification. If it turns out that there is no data breach at Infinwebs, the customer is obliged to withdraw the notification immediately.

Notification to the customer

If it turns out that there is a security incident or data breach at Infinwebs, Infinwebs will inform the customer as soon as possible after Infinwebs has become aware of the data breach. If there is a data breach at a sub-processor of Infinwebs, Infinwebs will of course report this too.

Deleting data

At the end of the agreement, Infinwebs will delete all customer data as described in the General Terms and Conditions under ‘Termination of the agreement’. Should the customer wish to have the data deleted earlier, a simple request can be submitted via support@onfact.ae.

Data entered in onFact by the subscriber or customer is portable in one or more formats. An overview of data types and possible export formats is available on the onFact documentation platform: https://onfact.gitbook.io/support/overige-functies/gegevens-exporteren