Privacy Policy
English translation provided for information purposes only. The French version is the only legally binding version and prevails in the event of any discrepancy.
1. Purpose of this Policy
This Privacy Policy describes how ORIZAIR Sàrl (“ORIZAIR”, “we”) processes the personal data of natural persons who access the ORIZAIR digital platform, accessible at orizair.com or at any other address that may replace it (hereinafter, the “Platform”), use it, or interact with ORIZAIR in the context of the contractual relationship with a Client, an Operator or an Authorised Third Party, in particular as Administrator or User.
It covers the processing for which ORIZAIR determines the purposes and essential means and thus acts as controller. Where ORIZAIR processes certain personal data solely on behalf of a Client in the context of the Services, such processing is governed by the applicable contractual documents concluded with that Client, in particular the Data Processing Agreement where applicable.
2. Controller and contact
The controller is:
ORIZAIR Sàrl
35 avenue de Miremont, 1206 Geneva, Switzerland
UID CHE-255.238.380
Operational data protection contact: Louis Frei-Killy
Data protection contact: for the attention of Louis Frei-Killy, ORIZAIR Sàrl, 35 avenue de Miremont, 1206 Geneva, Switzerland
Security contact address: security@orizair.com
Should ORIZAIR subsequently appoint a data protection officer or data protection advisor, their contact details will be added to this Policy.
Processing of personal data in connection with the offering of ORIZAIR’s services to data subjects in the Union may fall within Article 3(2) of Regulation (EU) 2016/679. Where the conditions of Article 27 of that Regulation are met, ORIZAIR designates in writing a representative in the Union, established in one of the Member States where the data subjects concerned by such processing are located. The identity and contact details of that representative are then indicated in this Policy.
3. Data subjects
This Policy may concern in particular:
- the Administrator appointed by a Client or an Operator;
- the authorised Users appointed by a Client or an Operator;
- employees, representatives and business contacts of Clients and prospects;
- agents, MRV firms, independent verifiers and other Authorised Third Parties;
- persons who contact ORIZAIR with a commercial, contractual, technical or support request;
- visitors to the Platform, insofar as personal data is collected on that occasion.
4. Personal data we process
Depending on the situation, ORIZAIR may process the following categories of data:
- identification data and business contact details: surname, first name, job title, company, business address, e-mail address, telephone number;
- data relating to the Administrator’s or Users’ accounts: username, role, access rights, account creation and modification history;
- data relating to the acceptance of the Terms of Use by the Administrator in the name and on behalf of the Client or the Operator: version accepted, date and time of acceptance, identity of the Administrator and technical information necessary for the traceability of such acceptance;
- technical and security data actually collected: IP address where recorded, timestamps, internal application logs, technical information relating to the device or browser, and security events reported or handled;
- data relating to the contractual and commercial relationship: company represented, contracts and order forms, support requests, exchanges, billing and payment information not falling directly within the remit of a third-party payment provider;
- data contained in communications sent to ORIZAIR;
- data relating to the use of the Platform necessary for its operation, security and administration;
- data relating to communication preferences, where applicable.
Client Data and supporting documents imported into the Platform may incidentally contain personal data. Where ORIZAIR processes such data solely to provide the Services to the Client, it acts in principle on the Client’s behalf; such processing is then distinct from the processing described in this Policy.
5. Purposes of processing
ORIZAIR processes personal data for the following purposes:
- creating, administering and securing the accounts of the Administrator and the Users;
- authenticating the Administrator and the Users and managing their access rights;
- recording and retaining proof of acceptance of the Terms of Use and their updates by the Administrator on behalf of the Client or the Operator;
- providing and operating the Platform and the subscribed features;
- managing the contractual, commercial and administrative relationship with Clients and prospects;
- handling support and assistance requests and communications sent to ORIZAIR;
- preventing, handling and documenting security incidents, misuse or unauthorised access reported or identified through the tools actually in use;
- ensuring the maintenance, stability, improvement and technical monitoring of the Platform;
- complying with the legal, regulatory, accounting and evidentiary obligations to which ORIZAIR is subject;
- establishing, exercising or defending legal claims;
- sending business communications concerning the Services where permitted by applicable regulations.
6. Legal bases where the GDPR applies
Where the GDPR applies to the processing concerned, ORIZAIR bases its processing, as the case may be, on:
- the performance of a contract or of pre-contractual measures, where the processing is necessary for the provision of the Services or the management of a contractual relationship with the data subject;
- ORIZAIR’s legitimate interests, in particular in managing the accounts of the Administrator and the Users, ensuring the security of the Platform, preventing misuse, improving the Services and managing the relationship with its business Clients, subject to the rights and freedoms of the data subjects;
- compliance with a legal obligation to which ORIZAIR is subject;
- consent, where required by regulations for a specific processing operation.
Where only Swiss law applies, ORIZAIR processes data in accordance with the principles of lawfulness, proportionality, transparency, purpose limitation, accuracy and security laid down in Swiss data protection legislation.
7. Sources of data
Data may be collected:
- directly from the data subject;
- from the Client, the Operator, the Administrator or another authorised User when they appoint or invite a person to access the Platform;
- from an agent, MRV firm, verifier or other Authorised Third Party;
- automatically when the Platform is used, for technical and security data actually collected;
- from public or professional sources where necessary for managing the commercial relationship and permitted by applicable regulations.
8. Recipients and service providers
Personal data is accessible to those ORIZAIR personnel who need it for their duties, and to the technical and professional service providers ORIZAIR engages where necessary.
These recipients may include in particular:
- hosting and cloud infrastructure providers, in particular Laravel Cloud / Amazon Web Services (AWS);
- support, communication, monitoring, technical logging or security providers, in particular Intercom, Customer.io, Laravel Nightwatch, Sentry, Datadog and Cloudflare;
- SendGrid (Twilio), used for transactional messaging;
- legal advisers, accountants, auditors and other professional service providers bound by an appropriate duty of confidentiality;
- authorities or courts where disclosure is required or permitted by law.
Service providers acting on behalf of ORIZAIR are bound by appropriate contractual obligations of confidentiality, security and data protection.
9. Hosting and international transfers
The personal data covered by this Policy, as well as Client Data, are hosted and stored within the European Economic Area and, where applicable, in the United Kingdom, using Laravel Cloud / Amazon Web Services. However, certain service providers may access certain data from the United States in the course of their services.
Where personal data is transferred to, or made accessible from, a country that does not provide the level of protection required by applicable regulations, ORIZAIR implements, where necessary, an appropriate transfer mechanism, such as an adequacy decision, standard contractual clauses or any other safeguard recognised by applicable law.
10. Retention periods
ORIZAIR retains personal data only for as long as necessary for the purposes for which it is processed, and thereafter for the periods necessary to comply with its legal obligations or to defend its rights.
The retention criteria applied are as follows:
11. Security
ORIZAIR implements technical and organisational measures appropriate to its current environment to protect personal data against loss, unauthorised access, disclosure, alteration or destruction. These measures are described in more detail in the Security and Hosting Annex.
As at the date of this Policy, they include in particular individual authentication, role and permission management, HTTPS encryption in transit, AES-256 encryption of stored documents provided by the hosting infrastructure, and daily backups.
Any security incident may be reported to security@orizair.com. In the event of a data security breach, ORIZAIR makes the notifications required by applicable regulations, in particular to the Federal Data Protection and Information Commissioner (FDPIC) where the conditions laid down in the Swiss Federal Act on Data Protection (FADP) are met and, where the GDPR applies, to the competent supervisory authority under the conditions laid down therein. Data subjects are also informed where required by applicable regulations.
12. Your rights
Depending on applicable regulations and the circumstances, data subjects may in particular request access to the personal data concerning them, its rectification or erasure and, where the legal conditions are met, restriction of processing or the delivery or portability of certain data, or object to certain processing.
Where processing is based on consent, such consent may be withdrawn with effect for the future, without affecting the lawfulness of processing carried out before its withdrawal.
A request may be addressed to the operational data protection contact, Louis Frei-Killy, at the data protection contact address indicated in Article 2. ORIZAIR may request such information as is reasonably necessary to verify the requester’s identity and handle the request.
Where the request concerns data that ORIZAIR processes solely on behalf of a Client, ORIZAIR may invite the requester to contact the Client concerned or forward the request to that Client, in accordance with applicable contractual and legal obligations.
13. Complaints to an authority
Any data subject may, where the legal conditions are met, lodge a complaint with the competent data protection authority. In Switzerland, the competent federal authority is the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, a person may also have the right to lodge a complaint with the competent supervisory authority in the European Union or the European Economic Area.
14. Automated individual decisions
ORIZAIR does not take, solely on the basis of the personal data covered by this Policy, any automated individual decision producing legal effects concerning a person or similarly significantly affecting them, unless otherwise communicated in advance in accordance with applicable regulations.
15. Cookies and similar technologies
The Platform uses only cookies and similar technologies that are strictly necessary for its operation, security, authentication or session management. As at the date of this Policy, no cookie or tracker that is not strictly necessary is placed or read on the Platform.
Should ORIZAIR subsequently implement cookies or other trackers that are not strictly necessary, this Policy and, where required by applicable regulations, the consent collection and management mechanism will be adapted before they are activated.
SendGrid is used solely to send transactional messages (account creation, invitations, service-related notifications).
16. Changes to this Policy
ORIZAIR may amend this Policy to take account of changes in its processing, the Platform, its service providers or applicable regulations.
The current version and its effective date are indicated at the top of the document. Any significant change materially affecting the information provided to data subjects will be brought to their attention by appropriate means.
17. Relationship with other ORIZAIR documents
The Terms of Use set out the rules for access to and use of the Platform. They are accepted by the Administrator in the name and on behalf of the Client or the Operator and apply to the Users whom the latter authorises to access the Platform, without individual acceptance on their part. The Framework Agreement and the applicable Order Form govern the contractual relationship between ORIZAIR and paying Clients; the Trial Access Terms govern trial access. The Data Processing Agreement governs the processing that ORIZAIR carries out on behalf of a Client or an Operator where ORIZAIR acts as processor. The security and hosting documentation describes the main technical and organisational measures applicable.
The purpose of this Policy is to inform natural persons about the processing for which ORIZAIR acts as controller. It does not modify the rights and obligations agreed between ORIZAIR and its Clients.
The Terms of Use and this Policy are permanently accessible from the Platform via dedicated links.
18. Contact
For any question concerning this Policy or the exercise of your rights:
ORIZAIR Sàrl
35 avenue de Miremont, 1206 Geneva, Switzerland
Data protection contact: for the attention of Louis Frei-Killy, at the postal address indicated above.
Security e-mail: security@orizair.com.