Privacy Notice

1. Who we are

Onwinds provides a software platform that records and processes transaction requests in a verifiable ledger with evidence and policy outcomes. We work with business customers such as investment managers, venture capital firms, accounting firms, fintech companies and platforms that build on top of our core ledger.

Onwinds is a trading name of:

Impact Finance Technology B.V.
Chamber of Commerce number: 96033207
Email: hello@onwinds.com
Website: www.onwinds.com

For many uses of the Onwinds platform, our customer is the data controller and Onwinds acts as a data processor. For our own websites and commercial activities, Impact Finance Technology B.V. is the data controller.

The Onwinds platform and websites are intended for use by businesses and professional users. We do not offer services directly to consumers or children.

2. Scope of this Notice

This Notice covers:

• visitors to our websites, for example the Onwinds marketing and documentation sites
• users who sign up for an Onwinds account or interact with the platform
• contacts at our customers, suppliers and partners
• users who communicate with us by email or other channels

This Notice does not replace the specific data protection terms that may apply under an Enterprise or other written agreement with Onwinds. If there is a conflict, that agreement will prevail for those services.

We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, please contact us so that we can take appropriate steps.

3. Personal data we collect

The personal data we collect depends on how you interact with Onwinds.

3.1 Account and organisation data

When you create an account, request access to the platform or represent a customer, we may collect:

• name and contact details such as email address and phone number
• organisation name, role and team
• login details and authentication information (email address and hashed password)
• billing contact information where relevant

3.2 Platform and product data

When you use the Onwinds platform, we process:

• identifiers you or your systems send to us, such as tenant identifiers, account identifiers or references to users or customers
• metadata about transaction requests, such as timestamps, event identifiers and policy results
• log data about how the platform is used, such as API calls, client identifiers and technical headers

The design of Onwinds encourages customers to keep personal data in their own systems and send pseudonymous identifiers into the kernel, linking evidence and explanations in their own stores. However, you may choose to include personal data in evidence bundles or fields you control. In that case you are responsible for the lawfulness of that data.

3.3 Support and communication data

If you contact us, we may process:

• contact details and communication content
• details of your request and how it was resolved
• feedback you provide on the platform or our services

3.4 Website and usage data

When you visit our websites, we may collect:

• technical information, such as browser type, operating system and IP address
• usage data, such as pages visited, time on page and referring links
• cookie data and similar technologies where used

We use this data to operate and improve our websites and understand how visitors use them.

4. How we use personal data and legal bases

We use personal data for the following purposes and legal bases under the laws of the European Union, in particular the General Data Protection Regulation.

4.1 To provide and operate the Onwinds platform

We process personal data to:

• create and manage accounts and organisations
• authenticate users and secure access
• handle transaction requests and produce ledger outputs
• provide support and respond to questions

Legal basis: performance of a contract and legitimate interests in operating a secure platform.

4.2 To maintain security and integrity

We process technical and usage data to:

• monitor the platform for abuse, fraud or misuse
• detect and resolve security incidents and errors
• protect the rights and safety of Onwinds, our customers and others

Legal basis: legitimate interests in securing our services and preventing abuse and, where required, compliance with legal obligations.

4.3 To manage our relationship with customers and prospects

We process contact data to:

• handle sales, onboarding and account management
• send service related communications such as important updates or changes
• send limited marketing communications where permitted

Legal basis: performance of a contract, legitimate interests in running and developing our business and consent where required by law.

You can opt out of marketing emails at any time by using the unsubscribe link in the message or by contacting us.

4.4 To improve the platform

We may use aggregated and anonymised usage data to understand how our services are used and to improve reliability, performance and product design.

Legal basis: legitimate interests in developing and improving our services.

5. Onwinds as data processor

For most uses of the core ledger platform, our customer is the data controller and Onwinds acts as a data processor.

This means:

• the customer determines what personal data is sent into Onwinds and for what purposes
• Onwinds processes that data only on the documented instructions of the customer, except where required by law
• the customer is responsible for providing any required notices to its own users and obtaining any required consents
• the customer is responsible for data subject requests relating to the data they control

Onwinds implements technical and organisational measures to protect the data it processes on behalf of customers and will support customers with data protection obligations in line with applicable agreements.

6. Sharing of personal data

We do not sell personal data.

We may share personal data with:

• service providers and sub processors who host the platform or provide infrastructure, logging, monitoring, communication tools, support systems and other operational services
• professional advisers such as lawyers, auditors and accountants where needed
• authorities or third parties where required by law, regulation, court order or to protect our rights, safety or property

Where we use service providers who process personal data on our behalf, we put in place appropriate data processing agreements.

In the event of a merger, acquisition or other business transaction, personal data may be transferred as part of the transaction, subject to continued protection in line with this Notice.

7. International data transfers

Onwinds currently operates from within the European Union. Some service providers may process personal data outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we will take steps to ensure an adequate level of protection, such as:

• relying on an adequacy decision by the European Commission, or
• using standard contractual clauses or other appropriate safeguards recognised under data protection law

You can contact us for more information about transfers and the safeguards in place.

8. Data retention

We keep personal data only for as long as needed for the purposes described in this Notice or as required by law.

In general:

• account and contract data is kept for the duration of the relationship and for a period afterwards to meet legal, tax or accounting obligations
• platform logs and technical data are kept for a limited period for security, debug and audit purposes
• evidence and ledger artefacts may be kept longer where needed to support auditability and replay in line with agreements with customers
• support communications are kept for as long as necessary to handle the request and maintain a history of interactions

When personal data is no longer needed, we will delete or anonymise it.

9. Security

We apply technical and organisational measures intended to protect personal data, taking into account the nature of the data and the risks associated with processing it.

Measures may include:

• access control and authentication
• encryption in transit and at rest where appropriate
• network and infrastructure security controls
• logging and monitoring
• backup and recovery processes
• regular testing and review of controls

No system can be completely secure. You are responsible for keeping your account credentials safe and for securing your own systems that interact with Onwinds.

10. Your rights

Depending on where you are located and subject to applicable law, you may have rights over your personal data, including:

• the right to access and receive a copy of your personal data
• the right to correct inaccurate or incomplete personal data
• the right to request deletion of your personal data
• the right to restrict or object to certain processing
• the right to data portability
• the right to withdraw consent where processing is based on consent

Where Onwinds acts as data processor, you should direct these requests to the relevant customer, who controls the data. We will assist the customer where required.

Where Impact Finance Technology B.V. acts as data controller (for example for website visitors and direct contacts), you can exercise your rights by contacting us at the details below. We may need to verify your identity before fulfilling your request and may be unable to comply with a request where legal obligations require us to keep certain data.

You also have the right to lodge a complaint with your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

11. Cookies and similar technologies

Our websites may use cookies and similar technologies to:

• remember your preferences
• understand how the site is used
• improve performance and security

Where required by law, we will request your consent before setting non essential cookies. You can manage cookie settings in your browser and in any controls we provide.

We may publish a more detailed cookie notice with specific information about the cookies we use.

12. Changes to this Notice

We may update this Privacy Notice from time to time.

If changes are material, we will provide a reasonable form of notice, for example by email to account holders or by a notice on our websites. The "Last updated" date at the top of this Notice shows when it was last revised.

Continued use of the Onwinds services after changes take effect means that you accept the updated Notice.

13. Contact

If you have any questions about this Notice or how we handle personal data, you can contact us at:

Email: hello@onwinds.com
Website: www.onwinds.com