Privacy Policy

Origasoft builds and sells enterprise learning software to businesses and institutions. For the personal data described in this policy, Origasoft is the controller, which means we decide why and how that data is processed.

This policy applies to:

• visitors to origasoft.com;
• people who contact us or request a demo;
• people who create and use a customer account on our website to request quotes, place orders and view licenses; and
• contacts at our customers, prospective customers and suppliers.

It does not apply to personal data inside the learning platforms that our customers run with our software. See "Learner data in customer platforms" below.

Most of the data we hold comes directly from you. Some is generated automatically when you use the website, and some is created by our staff and systems as we handle your requests.

We do not ask for special categories of personal data, such as health data, and we ask you not to include them in messages to us. We do not receive or store payment card data, because we accept payment only by bank transfer.

We use personal data only for the purposes below. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, each purpose relies on the legal basis shown.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can ask us for details of that assessment, and you can object to the processing at any time (see "Your rights").

Fields marked as required in our forms are needed to handle your request. If you do not provide them, we may not be able to answer you, create your account or process your quote or order.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Every quote is reviewed by Origasoft staff.

We send the emails needed to run your account and our services: sign-in codes, confirmations of contact requests, and messages about your quotes, orders and licenses. These are service messages, not marketing, and they stop when your account is closed.

If we send marketing emails, we will do so only where the law allows it, and every message will include a simple way to opt out.

We use only strictly necessary cookies, which keep you signed in to your account. We do not use analytics, advertising or tracking tools. Details are in our Cookie Policy.

We do not sell personal data, and we do not share it with third parties for their own marketing or advertising. We share personal data only with the following recipients:

• Service providers that host the website and our data, deliver our emails and protect the website. They act as our processors and may use personal data only on our instructions.
• Professional advisers, such as lawyers, accountants and auditors, who are bound by duties of confidentiality, where needed for the purposes in this policy.
• Public authorities, courts and law enforcement bodies, where the law requires it or where it is needed to establish, exercise or defend legal claims.
• A buyer, investor or successor, if Origasoft is involved in a merger, acquisition, financing or sale of assets. The recipient will be required to protect the data in line with this policy.

Within Origasoft, access to personal data is limited to people who need it for their role.

We serve customers worldwide, and our service providers operate globally. Your personal data may therefore be processed in countries other than the one you live in, including countries outside the European Economic Area (EEA) and the United Kingdom whose laws may not offer the same level of protection.

When personal data is transferred out of the EEA or the UK, we rely on an adequacy decision where one applies, or we use appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum. Our service providers' data processing terms include these safeguards.

You can request more information about these safeguards, or a copy of them, at privacy@origasoft.com.

We keep personal data only for as long as we need it. Our standard retention periods are:

When a retention period ends, we delete or anonymize the data. We may keep specific data for longer where the law requires it or where it is needed for a legal claim, and only for as long as that need lasts.

If the GDPR or the UK GDPR applies to you, you have the rights below. People in other jurisdictions may have similar rights under their local law, and we will honor them as that law requires.

• Access: ask whether we process your personal data and receive a copy of it.
• Rectification: ask us to correct inaccurate data or complete incomplete data.
• Erasure: ask us to delete your data where we no longer have a valid reason to keep it.
• Restriction: ask us to limit the use of your data, for example while we check a correction you asked for.
• Portability: receive the data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organization, where the processing is based on contract or consent and carried out by automated means.
• Objection: object to processing based on our legitimate interests. If you object to direct marketing, we will stop.
• Withdrawal of consent: where we rely on your consent, withdraw it at any time. This does not affect processing that took place before you withdrew it.
• Complaint: lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe an infringement took place. In the UK, this is the Information Commissioner's Office (ICO). We would appreciate the chance to address your concern first.

These rights have limits set by law. For example, we must keep invoice records for the legally required period even if you ask us to delete them. If we cannot meet a request in full, we will explain why.

Email privacy@origasoft.com, preferably from the email address linked to your account or request, and tell us which right you want to exercise. We may ask for information to confirm your identity before we act, so that we do not disclose or change data at the request of someone who is not entitled to it.

We respond within one month of receiving your request. If a request is complex or we receive many requests, we may extend this period by up to two further months, and we will tell you within the first month. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

If your request is about learner data in a customer's learning platform, please contact that organization directly. We will help our customers respond.

We protect personal data with technical and organizational measures appropriate to the risk, including encrypted connections, sign-in with single-use email codes, access limited to staff who need it, and protection against automated attacks.

No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the competent supervisory authority and, where required, you, as the law requires.

Please help us protect your account: keep your email account secure, because we send your sign-in codes there, and tell us at privacy@origasoft.com if you think someone has accessed your account.

Our customers use Origasoft software to run their own learning platforms, with their own learners, content and results. For personal data in those platforms, such as learner profiles, enrollments, assessment results and certificates, the customer is the controller.

Where Origasoft processes that data, for example when providing support or, where agreed, hosting, we act as a processor on the customer's instructions under a Data Processing Agreement (DPA). This Privacy Policy does not apply to that processing.

If you are a learner or user of a platform run by one of our customers, please read that organization's privacy notice and contact it to exercise your rights. Customers are responsible for using our software lawfully, including where their learners are minors.

Our website and services are for businesses and institutions. They are not directed at children, and we do not knowingly collect personal data through this website from anyone under 16. If you believe a child has given us personal data, contact privacy@origasoft.com and we will delete it.

We may update this policy when our services, providers or legal requirements change. We will publish the new version on this page with a new "Last updated" date. If a change is significant, we will also tell account holders by email or in their account before it takes effect.

For questions about this policy or our handling of personal data, or to exercise your rights, contact privacy@origasoft.com. For other legal matters, contact legal@origasoft.com.