Privacy Policy

1. Who is responsible for your data

The controller of the personal data described in this policy is ON DIVERSITY CLOUD EUROPE, S.L. ("DIVERSITY", "we", "us"), NIF B24972143, with registered office at Calle de Hermosilla 48, 28001 Madrid, Spain.

For any question about this policy or about your data, write to legal@corp.ondiversity.eu.

Data Protection Officer: Harper Whitfield, who can be contacted at legal@corp.ondiversity.eu.

2. Scope

This policy explains how we process personal data when you visit https://ondiversity.cloud (the "Website"), contact us or subscribe to our newsletter. Each processing activity is described as a module in Section 4. When another of our services or apps links to this policy, we add a module for it before the link goes live.

This policy does not cover personal data that our customers store or process using our cloud, telecommunications or other services. For that data we act as processor on the customer's behalf, under the data processing agreement signed with each customer. Questions about that data should be addressed to the customer concerned.

3. Summary

4. What we process and why

4.1 Module W1: Delivering the Website

The Website is hosted and delivered by BunnyWay d.o.o. (bunny.net), Dunajska cesta 165, 1000 Ljubljana, Slovenia, acting as our processor. Its content delivery network serves pages, images and files from servers close to you. Our fonts are hosted by us. The Website loads no advertising, third-party trackers or social media plugins. Our LinkedIn and X profiles are plain links: nothing is sent to those networks unless you click them.

Data: IP address, date and time of the request, requested address, referrer, browser and operating system (user agent), response code and amount of data transferred.

Purpose: to deliver the pages you request, keep the Website secure and stable, and detect and investigate abuse.

Legal basis: our legitimate interest in providing a secure and working website (Article 6(1)(f) GDPR). The Website cannot be delivered to you without this data.

Retention: access logs are kept for 90 days and then deleted.

4.2 Module W2: Contact, investor and partner forms

Data: name, email address, organisation, message and the topic of your enquiry, which is taken from the page you use. On the investors page, also the type of proposal. Name, email and message are required to answer you. Without them we cannot deal with your enquiry.

To block spam, the forms contain hidden fields and a proof-of-work check that runs in your browser. This check is operated by us, involves no third party and sets no cookie.

Purpose: to answer your enquiry and, where relevant, to prepare a proposal or continue the conversation you started.

Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) where your enquiry concerns our services. Otherwise, our legitimate interest in answering messages sent to us (Article 6(1)(f) GDPR).

How it works: when you submit a form, code run by our hosting provider (Section 4.1) receives it and passes it to our own email service, which runs on our servers in the European Union. That service sends it to the relevant company mailbox through the email infrastructure of Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias, Geneva, Switzerland, which also hosts our mailboxes. Infomaniak acts as our processor.

Retention: our email service keeps a log of each email it sends (such as sender, recipient, date and delivery status, but not its content) for 90 days and then deletes it automatically. We keep enquiries in our mailboxes for as long as needed to deal with them and then for 12 months, in case of follow-up. If the enquiry leads to a contract, the related correspondence is kept for the periods required by law, including six years under Article 30 of the Spanish Commercial Code.

4.3 Module W3: Emails and contact points

When you write to one of our mailboxes, or contact one of the contact points listed in our Legal Notice, we process your contact details, your message and any other data you include. The purposes, legal bases and retention periods are those described in Section 4.2. Our mailboxes are hosted by Infomaniak (Section 4.2).

4.4 Module W4: Newsletter

Data: email address, the page you subscribed from, the date and IP address of your signup, which Infomaniak records as evidence of your consent, and whether you open the confirmation email and our newsletters and which links you click in newsletters.

How it works: the subscription list is kept, and newsletters are sent, by Infomaniak Network SA (Section 4.2), acting as our processor. When you submit the form, your browser sends your email address and the page you subscribed from directly to Infomaniak. Our own servers never receive your address. To block spam, your browser first fetches a proof-of-work check from Infomaniak and solves it. Infomaniak then sends you, on our behalf, an email with a confirmation link. You are subscribed only if you click that link. If you do not confirm, Infomaniak keeps your signup marked as unconfirmed, and you receive no newsletter.

Opens and clicks: the confirmation email and every newsletter contain a small image loaded from ondiversity.statslive.info, Infomaniak's statistics domain. When your email program loads it, Infomaniak records that you opened the email, and receives the usual details of that request, such as your IP address and email program. In newsletters, the links also pass through Infomaniak, which records which ones you click. The link in the confirmation email goes straight to Infomaniak and records no click. If your email program does not load images, no open is recorded.

Purpose: to send you our newsletter, to see which newsletters are opened and which links are clicked so that we can improve them, and to keep evidence of your consent. The record of whether you open the confirmation email is used only to check that confirmation emails reach the people who asked for them.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 21 of Spanish Law 34/2002, LSSI-CE). Infomaniak records this date and IP address for us, as our processor, and we keep that record to demonstrate that you consented (Article 7(1) GDPR). Your consent also covers the record of your opens and clicks in newsletters (Article 22.2 LSSI-CE), which you are told about before you subscribe. The confirmation email reaches you before you have consented, so recording whether you open it relies on our legitimate interest in checking that confirmation emails are delivered (Article 6(1)(f) GDPR). You can object to it, or prevent it by not loading images.

Withdrawing consent: every newsletter contains an unsubscribe link. You can also write to legal@corp.ondiversity.eu. Unsubscribing also ends the record of your opens and clicks. Withdrawing consent does not affect processing carried out before you withdrew it.

Retention: until you unsubscribe. After that, we keep your email address, the evidence of your consent and the date you unsubscribed, blocked and used only to respond to claims, for 3 years. Then we delete them. The record of your opens and clicks is kept no longer than your entry in the list, and is not used after you unsubscribe. A signup that is never confirmed is kept by Infomaniak, marked as unconfirmed, until we delete it. We delete unconfirmed signups once a month, so none is kept for more than a month. You can ask us to delete it at any time at legal@corp.ondiversity.eu.

4.5 Module W5: Audience measurement

We measure how the Website is used with Umami, open-source software that we run ourselves on our own servers in data centres in Madrid (Spain) and Amsterdam (Netherlands). No third party receives this data. No cookies are used.

Data: for each page view, the page address and title, the referrer, your browser language, your screen size and the hostname. From your IP address and browser user agent, the software derives your browser, operating system, device type and approximate location (country, region and city). Your IP address is used only for these calculations and to create a visit identifier that changes regularly. It is not stored.

We also record events that contain no personal data: clicks on contact email or phone links (channel and office), language changes, frequently asked questions opened, the result of the latency test (Section 4.6), and whether a form was submitted or failed. For a failed form we record only the reason, never what you typed.

Purpose: to obtain statistics on how the Website is used, so that we can improve it.

Legal basis: our legitimate interest in understanding how the Website is used (Article 6(1)(f) GDPR). This measurement is limited to our own audience statistics. It is not combined with other data, not shared with third parties and not used to follow you on other websites. On that basis it is exempt from consent under Article 22.2 LSSI-CE, in line with the guidance of the Spanish Data Protection Agency on audience measurement tools.

Opting out: you can object at any time. The opt-out control on this page stores a flag in your browser (Section 5), and the software then stops recording visits from that browser. You can also write to legal@corp.ondiversity.eu.

Retention: 90 days, then deleted.

4.6 Module W6: Latency test and service status

Some pages measure the network latency between your browser and our network, and show the current status of our services. For this, your browser connects to our own servers. Your IP address is processed only by our own infrastructure, to answer the request, and is not shared with anyone. The result of the measurement is recorded as an anonymous event (Section 4.5). Any server logs of these requests are kept for no more than 90 days.

Legal basis: our legitimate interest in showing you the performance and status of our services (Article 6(1)(f) GDPR).

5. Cookies and similar storage

We use only the following:

We use no advertising, social media or other third-party cookies. You can delete cookies and local storage in your browser settings. If you delete lang_detected, the Website may redirect you to your browser language again. If you delete umami.disabled, audience measurement resumes in that browser.

Our newsletter emails are not part of the Website, but the confirmation email and every newsletter contain an image that records whether you open them. Section 4.4 describes it and its legal basis.

6. Who receives your data

Both processors act only on our instructions under a data processing agreement (Article 28 GDPR). Infomaniak sends newsletter emails through Amazon Web Services in Ireland (EU), as its sub-processor. We do not sell your data. We disclose data to public authorities or courts only when the law requires it.

7. International transfers

7.1 Switzerland. Infomaniak processes data in Switzerland. The European Commission recognises Switzerland as providing an adequate level of data protection (Decision 2000/518/EC), so no additional safeguards are required.

7.2 No other transfers. Apart from Switzerland, we do not transfer the personal data described in this policy outside the European Economic Area. Enquiries are handled by our team in the European Union. Our contact points in the United Kingdom and the United States do not have access to them.

7.3 If this changes, we will update this policy before the transfer takes place and state the safeguard that applies.

8. Your rights

You can ask us for access to your data, its rectification or erasure, the restriction of its processing, and the portability of the data you provided on the basis of consent or a contract. You can withdraw your consent at any time.

Right to object: where we rely on our legitimate interest (Modules W1, W2, W3, W5 and W6, and the record of whether you open the confirmation email in Module W4), you can object at any time to the processing of your data on grounds relating to your particular situation.

To exercise your rights, write to legal@corp.ondiversity.eu. You can also contact our Data Protection Officer at the same address. We may ask you to confirm your identity. We will reply within one month. For complex requests this period can be extended by two further months, in which case we will tell you why.

9. Right to complain

If you consider that we have not respected your rights, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es (opens in a new tab), electronic office https://sedeaepd.gob.es (opens in a new tab), or with the supervisory authority of the EU country where you live or work. Before lodging a complaint with the Spanish Data Protection Agency, you may first contact our Data Protection Officer, who will inform you of the decision taken within two months of receiving your complaint (Article 37 LOPDGDD).

10. Children

The Website is aimed at businesses and professionals and is not intended for children. We do not knowingly collect data from anyone under 14. If you are under 14, do not subscribe to the newsletter or send us personal data (Article 7 of Spanish Organic Law 3/2018, LOPDGDD).

11. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

12. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access control and data minimisation. Our processors are bound by contract to process your data only on our instructions and to keep it secure.

13. Changes to this policy

We update this policy when our processing changes, for example when we add a module. The "Last updated" date shows the current version. We will inform newsletter subscribers of material changes by email.

Annex A. Basic information shown at each form (first layer, Article 11 LOPDGDD)

Contact, investor and partner forms

Newsletter form