Privacy Statement

Last updated: 30 Nov 2025

1. Introduction

Ongaro Systems ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Statement explains how we collect, use, process, and protect your information when you visit our website ongarosystems.com (the "Website") or interact with our services.

This Privacy Statement complies with the General Data Protection Regulation (GDPR) and Belgian privacy laws.

2. Data Controller Information

3. What Personal Data We Collect

3.1 Information You Provide Directly

• Contact information (name, email address, phone number)
• Business information (company name, job title)
• Communication content (messages, inquiries, feedback)
• Account information (if you create an account)

3.2 Information Collected Automatically

• IP address and location data
• Browser type and version
• Operating system
• Website usage data (pages visited, time spent, click patterns)
• Device information
• Referral sources

3.3 Cookies and Tracking Technologies

We use cookies and similar technologies as managed by our Complianz cookie management system. For detailed information, refer to our Cookie Policy available via the cookie banner on our website.

4. Legal Basis for Processing

• Consent (Article 6(1)(a))
• Contract (Article 6(1)(b))
• Legal Obligation (Article 6(1)(c))
• Legitimate Interests (Article 6(1)(f))

5. How We Use Your Personal Data

5.1 Service Provision

• Responding to inquiries
• Delivering services
• Processing orders
• Account management

5.2 Communication

• Service-related communications
• Updates about services (with consent)
• Marketing communications (with consent)

5.3 Website Improvement

• Performance analytics
• Improving user experience
• Technical maintenance

5.4 Legal Compliance

• Legal obligations
• Protecting rights
• Fraud prevention

6. Data Sharing and Third Parties

6.1 Service Providers

• Hosting
• Email services
• Analytics
• CRM platforms
• Payment processors

6.2 Legal Requirements

• Law enforcement
• Regulatory authorities
• Legal advisors

6.3 Business Transfers

In mergers, acquisitions or asset sales, personal data may be transferred.

7. International Data Transfers

• Adequacy decisions
• SCCs
• Binding Corporate Rules
• Other GDPR safeguards

8. Data Retention

• Contact inquiries: 3 years
• Account data: Until deletion or 7 years inactivity
• Marketing: Until consent withdrawn
• Analytics: 26 months
• Legal: As required

9. Data Subject Rights (DSR)

10. Consent Management and Records

10.1 Consent Records

• What consent was given
• When it was given
• How it was obtained
• When withdrawn

10.2 Data Minimization

• Adequate
• Relevant
• Limited to what is necessary

11. Data Security

• Encryption
• Access controls
• Security assessments
• Staff training
• Incident response

12. Cookies and Tracking

We use Complianz for cookie consent management.

• Cookie banner
• Cookie settings
• Browser settings

13. Children's Privacy

We do not knowingly collect personal data from children under age 16.

14. Updates to This Privacy Statement

• Website updates
• Last updated date
• Email notification where appropriate

15. Contact Information

15.1 Data Protection Questions

15.2 Data Protection Authority

16. Definitions

• Personal Data: Information relating to an identifiable individual
• Processing: Operations performed on personal data
• Data Controller: Entity determining processing purpose
• Data Subject: Individual whose data is processed
• Consent: Freely given, informed agreement

This Privacy Statement is effective as of the date listed above.