At IONODES, respecting your privacy is very important to us and we are committed to protecting your personal information. This Privacy Policy document is intended to inform you on how we collect, manage and use any personal information as part of our delivery of products and services to you. It is our policy to respect privacy regarding any personal information we (IONODES Inc., together with our affiliates, licensors, partners and contractors, including their respective successors and assigns, referred to as “IONODES”, “we”, “us” or “our”) may need to collect about our Customer (individuals or legal entities; referred to as “Customer”, “you”, “your” or “yours”) in order to be able to provide this Customer with our products and / or services. As “controller/processor”, IONODES is responsible for your personal information as regulated under applicable data protection laws (including the General Data Protection Regulation). Please read this Privacy Policy carefully as it contains important information about how and why we collect and process your personal information and your rights in relation to this personal information.

Why we sometimes need to collect your personal information.

In order to provide you with our products and services, as well as obtain a better understanding of your needs regarding these products and services, we may need to collect and process the personal information you might provide to us. We may also need this personal information to contact you regarding your IONODES customer account, inform you of relevant product changes, notifications, software updates and upgrades, as well as to obtain your feedback on our products and services, conduct research, analysis and other business activities.

What personal information we collect and use.

General In order to provide you with our products and services, and in order to identify and associate you with an IONODES customer account, we may need to collect and process the personal information you might provide to us including your name, job title, employer, email addresses and contact details. Information collected in relation to customer accounts When you create an IONODES customer account in association with any IONODES products, IONODES may receive personal information about you and / or your users; currently this information comprises your full name, company name, email address and contact details.  This information is required for us to identify you (and your users) as owners of the customer account and therefore protect such information from unauthorized disclosure. Information collected in relation to our products and services When using our products and services we may also collect a range of information about the way you use our products and services, including, without limitation, device settings, app settings and usage. Under the European General Data Protection Regulation (GDPR) you remain the owner and data controller of your personal information, including any video data collected through the use of our products and services. As the data processor, we are enabled to store such data. We will only access your video data in 2 scenarios: 1) With your express permission, for example if we are resolving a particular technical issue for which we might seek your permission to view video data. 2) As may be required as part of sharing the information with someone else in accordance with the strict restrictions set out below. Information collected in relation to support services When you contact our support services, whether by phone, chat, email, through our websites or otherwise, we may retain a record of communications with our support services for assisting in resolving support issues, for training purposes, quality assurance, statistical purposes, as well as to plan improvements to our products and services.

How we use the information we collect.

IONODES will use your personal information for a number of purposes including the following:

• to provide you with our services and to enable us to process your requests and inquiries;
• for service administration purposes and to contact you for reasons related to the service(s) we provide you with (e.g. to provide you with password reminders or to notify you that a particular product, service or activity will be suspended for maintenance);
• to provide you with information about our services, products or activities;
• to customize our products and services when they are presented to you;
• to identify the location of users, to block disruptive use, to establish the number of visits from different countries and to analyse and improve our products and services, ultimately providing you with a user-friendly experience.

Legal basis for processing personal information.

Our use and processing of your personal information will satisfy at least one of the following processing conditions:

1. Consent – you have given consent to the processing for one or more specific purposes. You have the right to withdraw consent at any time but this will not affect the lawfulness of processing based on consent before its withdrawal;
2. Necessary for performance of a contract – The processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract. Where this ground applies the provision of the information is a contractual requirement and if you fail to provide it we will be unable to provide the services that you have requested;
3. Legal obligation – The processing is necessary for compliance with a legal obligation to which we are subject;
4. Vital interests – The processing is necessary in order to protect your or another person’s vital interests, e.g. in medical emergencies;
5. Public functions – The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
6. Legitimate interests – The processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Legitimate interests include transfer of data for internal administrative purposes, market research activities, direct marketing purposes, preventing fraud, ensuring network and information security and reporting criminal acts or threats to public security.

How long we keep the information we collect.

IONODES will generally keep your personal data until it is no longer required for the lawful purpose(s) for which it was obtained.

Who may have access to personal information.

We may share your information with our advisers, suppliers, customers and partners as is necessary to ensure that you are provided with the products and services you have requested. We will not share your information with any third parties for reasons other than providing the products and services you have requested. IONODES collects information about you to provide you with products and services, and to manage your customer account. In providing the products and services, we may send your details to, and also use information from credit reference agencies and fraud prevention agencies. IONODES will keep your information confidential except where (i) disclosure is required or permitted by law (for example to law enforcement agencies who require the information from us in a formal legal request or pursuant to court orders or legal process), or (ii) we have your consent to disclose the information, or (iii) as deemed necessary, in our reasonable discretion, to protect the legal rights or property of IONODES or a customer or third party, or to prevent personal injury, or (iv) in the event we are required to transfer personally identifiable information to a third party in the event of a sale, merger, assignment, joint venture or other transfer or disposal of all or part of our business, though any new owner would be required to adopt the same protections.

Where personal information and video data is stored.

Although our global headquarters are based in Laval, Canada, IONODES, together with our partners and affiliated companies, operate in various locations worldwide. As a result, we may store or otherwise process personal information in multiple places around the world, including outside the state, province or country where you are located, in which case personal information may become subject to foreign laws, and, therefore, may be available to the governing authorities under local laws and regulations. We will use various legal and contractual means to ensure that data transfers are done in compliance with applicable laws and industry best practices. Any video data gathered through your use of our cloud-based products and services is stored in our service provider’s “cloud platform” which is currently hosted by Amazon Web Services (AWS) and / or Microsoft Azure, a world leader in cloud hosting. We currently use two AWS and / or Microsoft Azure data centres, one in Ireland and one in the USA. When we create your cloud services account, we choose the data centre closest to you. For example, users in Europe will have their video data stored in Ireland and users in the Americas will have their video data stored in the USA. We may also share some personal data or usage data (excluding video data) with the third parties below:

• Some usage data, such as what features you have used in the app, is gathered and stored. This data is used to analyse what the users are doing as a group in order to help us improve our products and services. It is not used to analyse what you are doing as an individual unless you contact us and request to investigate a problem that you have experienced.

Deleting video data & personal information.

Please contact us if you wish to delete your personal information, customer account information and any other data stored within our products and / or services. Once your personal information has been deleted, it is removed immediately from our database. In the event of a cloud-based service account deletion, all of your video data will be deleted within 48 hours of submission to our service provider. Note that any video data collected by our cloud products and services is stored in our service provider’s cloud and is automatically deleted after a number of days depending on your cloud account subscription. Once deleted, the video data cannot be recovered as no back-ups are stored.

Your right to be forgotten.

Under certain circumstances you have a right to be forgotten. We do not need to comply if the processing is necessary for rights of freedom of expression or information or for compliance with a legal obligation under law or in certain other limited circumstances permitted by applicable law. The way to be forgotten is to simply ask us to delete your account and any related personal information. All of your personal data, including any video data, will get deleted within 2 days and your personal information will be removed from our database.

Your right to a copy of or to extract your personal data.

You have the right to request a copy of the information that we hold about you via a subject access request. If you would like a copy of some or all of your personal information, please contact us, supplying an email address to which the information should be sent. We may use reasonable means to verify the identity of the person making the request. If we hold a large quantity of data, we may ask you to specify the information or processing activities to which the request relates. We will provide an electronic copy of the information free of charge but may charge a reasonable, administrative-cost fee if further copies are requested. We will respond to subject access requests within a month. We can extend this by a further two months if the request is complex or if we have received a large number of requests. We can refuse to respond to the request if it is manifestly unfounded or excessive (or charge an administrative fee). We may refuse a request where it is not made for the purpose of allowing you to be aware of and verify the lawfulness of the processing we are carrying out. We can withhold personal data if disclosure would adversely affect the rights and freedoms of others, e.g. involving the conduct of a business in, for example, intellectual property rights, trade secrets and confidential information. You can extract and download any video data you have stored in our cloud-based products and services using the features of the said products or services. If you have a valid reason, such as wanting video data as evidence in a court case, we can help speed this process for you if you contact us.

Your data protection rights.

Under certain circumstances you have the right to object to the processing of your personal data. We will comply with the request where the processing is for direct marketing purposes or based on the processing conditions of public interest or legitimate interests. We will not comply if the processing is for legal claims or based on a compelling legitimate interest which overrides your interests. If we are unable to resolve an issue to your satisfaction, you may choose to request assistance from, or submit a complaint to, the privacy authorities, such as the Privacy Commissioner of Canada, who may be contacted at 1-800-282-1376, or by visiting www.priv.gc.ca.   IONODES Global Privacy Policy.pdf