Privacy Notice

This Privacy Notice applies to personal information processed by us, including through our public website at aetra.org, the customer portal at app.aetra.org, related marketing contact channels, and any other online offerings we control that link to this notice. We refer to these collectively as the “Services”.

Where your organisation has a separate customer agreement or data processing terms for the portal, those terms may govern processing of workspace data in addition to this notice.

Changes to our Privacy Notice. We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Notice if you continue to use our Services after the new Privacy Notice takes effect.

The categories of personal information we collect depend on how you interact with us, our Services, and the requirements of applicable law. We collect information that you provide to us, information we obtain automatically when you use our Services, and information from other sources such as third-party services and organisations, as described below.

Personal Information You Provide to Us Directly

We may collect personal information that you provide to us.

• Account and workspace information. When you or your organisation use the portal, we may process identity and contact details (such as name and email), role or membership information, and organisation or facility details associated with your workspace.
• Authentication. We use authentication services (including magic-link sign-in) that process your email address and related session data to verify identity and keep you signed in.
• Your communications with us. We may collect personal information, such as email address and message content, when you request information about the Company or our Services, request support, report issues, or otherwise communicate with us.
• Customer content. The Services may process documents, templates, change requests, audit-related records, and other content your organisation submits. That content may include personal information depending on what your organisation chooses to store.

Personal Information Collected Automatically

We may collect personal information automatically when you use our Services.

• Automatic collection. We may collect certain information automatically, such as your Internet protocol (IP) address, browser or device information, and approximate location information (including approximate location derived from IP address). We may also collect information regarding your use of our Services, such as pages that you visit, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our Services.
• Cookie Policy (and other technologies).We, as well as third parties that provide content or other functionality on our Services, may use cookies, pixel tags, local storage, and other technologies (“Technologies”) to automatically collect information through your use of our Services. See our Cookie Policy for more detail.

Cookies. Cookies are small text files placed in device browsers that store preferences and facilitate and enhance your experience.

Pixel tags / web beacons. A pixel tag (also known as a web beacon) is a piece of code embedded in our Services that collects information about engagement on our Services.

Our uses of these Technologies fall into the following general categories:

• Operationally necessary — required for the Services to function, security, fraud prevention, or core features;
• Performance-related — to assess performance and understand how individuals use our Services;
• Functionality-related — enhanced functionality such as remembering preferences.

Analytics. If we enable analytics tools (for example Google Analytics or similar), those tools may process usage information to help us understand how the Services are used and to improve them. We will update this notice and our Cookie Policy if analytics practices change materially.

Provide Our Services

We use your personal information to fulfil our contract with you and provide you with our Services, such as:

• Creating and administering accounts and workspaces;
• Authenticating users and controlling access by role and organisation;
• Delivering document libraries, previews, PDFs, change-request flows, and related features;
• Providing access to areas, functionalities, and features of our Services;
• Answering requests for support;
• Communicating with you about your activities on our Services and policy changes.

Administrative Purposes

We use your personal information for various administrative purposes, such as:

• Pursuing our legitimate interests such as research and development, network and information security, and fraud prevention;
• Detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity;
• Measuring interest and engagement in our Services;
• Improving, upgrading, or enhancing our Services;
• Developing new products and services;
• Ensuring internal quality control and safety;
• Authenticating and verifying individual identities;
• Debugging to identify and repair errors with our Services;
• Auditing relating to interactions, transactions, and other compliance activities;
• Sharing personal information with third parties as needed to provide the Services;
• Enforcing our agreements and policies; and
• Carrying out activities that are required to comply with our legal obligations.

With Your Consent

We may use personal information for other purposes that are clearly disclosed to you at the time you provide personal information or with your consent.

Other Purposes

De-identified and aggregated information. We may use personal information to create de-identified and/or aggregated information. Such information is not personal information, and we may use, disclose, and retain it as permitted by applicable laws, including for research, analysis, and other legally permissible purposes.

Disclosures to Provide our Services

• Service providers. We may share personal information with third-party service providers and vendors that assist us with the Services (for example hosting, authentication, email delivery, analytics if enabled, customer support tooling, and IT support).
• Business partners. We may share personal information with business partners to provide a product or service you have requested.
• Affiliates. We may share personal information with our corporate affiliates.
• Organisation administrators. Within a customer workspace, administrators and authorised users may see member and activity information appropriate to their role.

Disclosures to Protect Us or Others

We may access, preserve, and disclose information we store associated with you to external parties if we, in good faith, believe doing so is required or appropriate to: comply with law enforcement or legal process; protect your, our, or others' rights, property, or safety; enforce our policies or contracts; or assist with an investigation of suspected or actual illegal activity.

Disclosure in the Event of Merger, Sale, or Other Asset Transfers

If we are involved in a merger, acquisition, financing due diligence, reorganisation, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.

Your privacy choices. The privacy choices you may have about your personal information are determined by applicable law and are described below.

• “Do Not Track.” We do not currently respond to or honour DNT signals or similar mechanisms transmitted by web browsers.
• Cookie choices. You may stop or restrict the placement of Technologies on your device or remove them by adjusting your browser preferences. If you do so, our Services may not work properly. See our Cookie Policy.

Your privacy rights. In accordance with applicable law, you may have the right to:

• Access and portability of your personal information;
• Request correction where information is inaccurate or incomplete;
• Request deletion of your personal information;
• Request restriction of or object to our processing; and
• Withdraw consent where processing is based on consent (withdrawal does not affect prior lawful processing).

If you would like to exercise any of these rights, please contact us as set forth in “Contact Us” below. We will process such requests in accordance with applicable laws. If you use the Services through an organisation account, we may redirect certain requests to your organisation administrator.

All personal information processed by us may be transferred, processed, and stored anywhere in the world, including countries which may have data protection laws that are different from the laws where you live. We endeavour to safeguard your personal information consistent with the requirements of applicable laws.

If we transfer personal information which originates in the European Economic Area, Switzerland, and/or the United Kingdom to a country that has not been found to provide an adequate level of protection under applicable data protection laws, one of the safeguards we may use is the EU Standard Contractual Clauses (or equivalent mechanisms).

You must be 18 years or older to use the Services. The Services are not directed to children under 18 (or other age as required by local law), and we do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided personal information to us without your consent, you may contact us as described in “Contact Us” below.

We take measures to delete your personal information or keep it in a form that does not permit identifying you when it is no longer necessary for the purposes for which we process it, unless we are required by law to keep this personal information for a longer period. When determining retention periods, we take into account the type of Service provided, the nature and length of our relationship with you, and mandatory retention periods provided by law.

If you are a resident of Nevada, you have the right to opt out of the sale of certain personal information to third parties who intend to license or sell that personal information. We do not currently sell your personal information as sales are defined in Nevada Revised Statutes Chapter 603A. If you have any questions, please contact us as set forth in “Contact Us” below.

This section applies to users located in the European Economic Area (“EEA”) or the United Kingdom (“U.K.”).

Our legal bases for processing. We only process your personal information when we have a valid legal basis, which may include:

• Consent — for example, certain cookies or marketing where required;
• Contractual necessity — to provide the Services you request;
• Compliance with a legal obligation;
• Legitimate interests — such as product development, security, and improving the Services, where not overridden by your rights and interests.

Supervisory authority. You may have the right to lodge a complaint with a competent supervisory authority if you believe our processing violates applicable law (for example EEA DPAs, the Swiss FDPIC, or the UK ICO).

Third-party websites / applications. The Services may contain links to other websites or applications, and other sites may reference our Services. These third-party services are not controlled by us. We encourage you to read the privacy policies of each site or application with which you interact. Providing personal information to third parties is at your own risk.

If you have any questions about our privacy practices or this Privacy Notice, or to exercise your rights as detailed in this Privacy Notice, please contact us at hello@aetra.org.