Website Privacy Policy

Effective: March 24, 2022

Last reviewed: March 24, 2022

1. Processing of Personal Data

1.1. Orcosa Inc. (referred to throughout as “Orcosa”, “our”, “we”, or “us”) is committed to ensuring your privacy and the confidentiality of your personal data, which is defined as any information which is related (whether directly or indirectly) to an identified or identifiable natural person or household or is reasonably capable of being associated with or could reasonably be linked to a particular person or household (“Personal Data”). By accessing or using our website located at https://www.orcosa.com/ and all associated websites linked to it by us (collectively, the “Website”), participating in an event and/or communicating with us, you consent to this Privacy Policy. In case you do not agree to any part of it, you must inform us and discontinue using our Website. If you have any questions, please contact us at privacy@orcosa.com.

1.2. We collect Personal Data such as source of connection and interactions with our Website through our service providers’ use of internet cookies.

1.3. During the last 12 months, we collected the following categories of Personal Data:

Category	Examples of Personal Data that would fall into this category (not necessarily Personal Data we collect)	Source
Identifiers	Name, email address, postal address, telephone number or other similar identifiers.   Online identifier, network location and Internet Protocol address.	Directly from you.     Indirectly from you via automatically collected meta-data and internet cookies.
Electronic network activity information	Data related to the device/browser.	Indirectly from you via automatically collected meta-data and internet cookies.
Geolocation data	Physical location or an individual’s movements.	Indirectly from you, for example, by observing your IP address.
Professional or employment-related information	Records of an individual’s past employment and education.	Directly from you.
Inferences	Individual profiles, preferences, characteristics and behaviors.	Indirectly from you, by drawing from any of the other information we collect from you.
Sensitive personal data	An individual’s racial or ethnic origin and an individual’s trade union membership.	Directly from you.

1.4. We process, collect, and share Personal Data for the following purposes, and we will only process Personal Data on the lawful basis specified:

i. For research purposes, including to develop, improve, maintain and facilitate operation of our Website.

Legal Basis for Processing:

(1) We have a legitimate interest in carrying out the processing (to the extent such interest is not overridden by your fundamental rights or freedoms); or

(2) We have obtained your prior consent to the processing.

ii. To process your requests.

Legal Basis for Processing:

(1) The processing is necessary to comply with a legal obligation;

(2) We have a legitimate interest in carrying out the processing (to the extent such interest is not overridden by your fundamental rights or freedoms); or

(3) We have obtained your prior consent to the processing.

iii. To respond to law enforcement requests and as required by applicable law, court order, governmental regulations, or our policies.

Legal Basis for Processing:

(1) The processing is necessary to comply with a legal obligation; or

(2) We have a legitimate interest in carrying out the processing (to the extent such interest is not overridden by your fundamental rights or freedoms).

iv. To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by us about our Website users is among the assets being contemplated for transfer or being transferred.

Legal Basis for Processing:

(1) The processing is necessary in connection with a contract you may enter into with us, or to take steps prior to entering into a contract with us;

(2) We have a legitimate interest in carrying out the processing (to the extent such interest is not overridden by your fundamental rights or freedoms); or

(3) We have obtained your prior consent to the processing.

v. We may process your Personal Data to manage our information technology and communications systems, including for the purpose of security audits.

Legal Basis for Processing:

(1) The processing is necessary to comply with a legal obligation;

(2) The processing is necessary in connection with a contract you may enter into with us, or to take steps prior to entering into a contract with us;

(3) We have a legitimate interest in carrying out the processing (to the extent such interest is not overridden by your fundamental rights or freedoms); or

(4) We have obtained your prior consent to the processing.

1.5. We do not sell your Personal Data to third parties.

1.6. During the last 12 months, we have disclosed Personal Data for a legitimate business purpose to the following categories of third parties:

1.7. When processing, collecting, and sharing your Personal Data, we rely on your consent to this Privacy Policy. You have the right to withdraw consent at any time, although such withdrawal will not make any processing, collecting, or sharing we carried out while we had your consent unlawful.

1.8. We restrict use and access to your Personal Data to those who have a need to know. Appropriate technical and organizational measures maintain the confidentiality and integrity of your Personal Data. We ensure compliance with applicable data protection and security laws.

1.9. We grant you the data protection rights as per the European Union’s General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”), irrespective of your country of residence: You have the right to be informed by us of any processing of your Personal Data, including how we collect, use, and disclose your Personal Data, and obtain a copy thereof to verify the lawfulness of processing (“right of access”). If you are affected by incorrect or incomplete Personal Data, you may request rectification or completion of relevant data (“right to rectification/right to correct”). You may request the deletion of your Personal Data (“right to erasure”) or a temporary processing restriction in certain cases (“right to restriction of processing”). You may object to the processing of your Personal Data (“right to object”), and you have the right to receive your Personal Data in a structured, commonly used and machine-readable format or to have your Personal Data transferred to another data controller if technically feasible (“right to data portability”). To the extent we process your Personal Data based on your consent, you may withdraw your consent, without affecting the lawfulness of our processing based on your consent, before its withdrawal. Please contact us at privacy@orcosa.com to exercise any of your rights enumerated in this clause. Only you (or, under the CCPA, someone legally authorized to act on your behalf) may make requests related to your Personal Data under this Clause. Your request must provide sufficient information that allows us to reasonably verify you are the person about whom we or our service providers collected Personal Data or an authorized agent, which may include: (1) personal information, including your name, email address, IP address and/or unique device identifiers (note that Orcosa may request additional information beyond the information already collected only if Orcosa cannot verify your identity based on the information already maintained; Orcosa shall delete any new personal information collected for verification as soon as practical) and (2) the nature of your request. Your request must include enough detail to allow us to respond to it. To verify your request, we will compare the information you provide in your request to any Personal Data we maintain about you. Note that we may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled.

1.10. Unless permitted by applicable privacy laws, we will not discriminate against you for exercising any of your privacy rights discussed in Clause 1.9, including by not: 1) denying you access to goods or services; (2) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (3) providing you with a different level or quality of goods or services; or, (4) suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

1.11. We store your Personal Data only for as long as necessary to respond to requests and/or as required by applicable laws and/or best practice retention requirements.

1.12. In case you are dissatisfied with any aspect of processing your Personal Data, please contact us at privacy@orcosa.com. You may also contact the data protection supervisory authority in your country of residence.

1.13. If we plan to use Personal Data for a new purpose, we will update this Privacy Policy and communicate the changes to you before starting any new processing.

2. Cookie Policy

2.1. The Website may use cookie technology to collect additional user and usage data. Cookies contain data that identifies you during your use of our Website. We use session cookies to better understand how you use our Website, to monitor aggregate usage by our users, and to improve our Website.

2.2. You may use your browser software to stop accepting cookies or to warn you before accepting a cookie. If you choose not to accept cookies, parts of the functionality of the Website operated by us may be impaired.

3. Analytics

3.1. Orcosa uses Google Analytics to improve the performance of the Website and for analytics purposes. Through the use of cookies, Google Analytics collects Personal Data such as online identifiers, network location, website usage and behavior, and data related to your device. For more information about how Google Analytics uses cookies, please visit: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage. Google’s ability to use and share information collected by Google Analytics about your visits to the Website is governed by Google Analytics Terms of Services and Google Privacy Policy (https://policies.google.com/privacy). You may prevent your data from being used by Google Analytics by downloading the Google Analytics opt-out add-on available at: https://tools.google.com/dlpage/gaoptout.

4. Links to Other Websites

4.1. The Website may contain links to other websites not operated or controlled by us (“Third-Party Sites”).The information that you share with Third-Party Sites will be governed by the specific privacy policies and terms of service of such Third-Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact these sites directly for information on their privacy practices and policies.

5. Privacy of Children

5.1. Our Website is not directed to children under the age of 13 and we do not knowingly collect Personal Data from children under the age of 13. No one under the age of 13 may provide any Personal Data to us on the Website. If you are under 13, do not use or provide any information on our Website. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from, or about, a child under 13, please contact us at privacy@orcosa.com.

6. Notice to California Residents

6.1. If you are a resident of the state of California, you are entitled to request information regarding the disclosure of your Personal Data to third parties for direct marketing purposes. To make such a request, please contact us at privacy@orcosa.com.

6.2. Your browser may include the ability to send us “Do Not Track” signals. We do not respond to Do Not Track signals. We do not track your activity over time and across third-party websites. However, third parties that have content integrated on our Website may set cookies on your web browser that may permit them to track your activity.

7. Notice to EU Residents

7.1. Our website is accessible to EU residents and may therefore need to transfer Personal Data in connection with the purposes set out in this Privacy Policy. In particular, if this involves transferring your Personal Data from inside to outside the European Economic Area (the “EEA”), we will take steps to ensure your information remains adequately protected in accordance with this Privacy Policy and applicable law, including the GDPR. The destination of a transfer for your Personal Data may be to the United States or any future location where we may operate. These locations may have different laws and data protection compliance requirements, including data protection laws of a lower standard than those that apply in the country in which you are located. However, if we make such a transfer of your Personal Data, we will take steps to ensure that the privacy of your Personal Data is respected, by ensuring that one of the following safeguards is put in place:

i. Binding corporate rules;

ii. Appropriate contractual clauses; or

iii. Other valid transfer mechanisms.

8. Updates to Privacy Policy

8.1. We may update our Privacy Policy from time to time, in particular due to changes in applicable law.

8.2. When we change the Privacy Policy in a material way, a notice will be posted on our Website along with the updated Privacy Policy.

8.3. Your continued use of our Website following the posting of such updates constitutes your acceptance of the changes made.