PRIVACY POLICY

1.1. The controller is OTCHO BV, with its registered office at Wolfaardstraat 11, 8800 Roeselare, Belgium, registered with the Crossroads Bank for Enterprises under number BE1002225279 ("OTCHO").

1.2. Questions and requests regarding the processing of personal data can be addressed to OTCHO through the contact details at the end of this policy.

2.1. This policy applies to the personal data of visitors of otcho.co, contact persons, prospects, clients, subscribers and users of the free 8 P's of Work™ profile, for which OTCHO acts as controller.

2.2. This policy does not apply to the personal data of participants that OTCHO processes on behalf of a client in the context of an assignment. For that processing, OTCHO acts as processor within the meaning of Article 28 GDPR and the client is the controller, as set out in Article 7.

3.1. Website visitors. OTCHO processes technical data, such as the IP address, the browser type and the pages consulted, for the provision and security of the website. The legal basis is the legitimate interest of OTCHO (Article 6(1)(f) GDPR). The use of cookies is described in the cookie notice.

3.2. Scheduling of conversations. OTCHO processes identification and contact data and the information provided when scheduling a conversation, for the planning and preparation of that conversation. The legal basis is the taking of steps at the request of the data subject prior to entering into an agreement (Article 6(1)(b) GDPR). The embedded scheduling tool is only loaded after the data subject has given consent through the cookie banner.

3.3. Contact persons and prospects. OTCHO processes identification and contact data, company, position, the content of correspondence and notes of conversations, for responding to requests, follow-up and relationship management. The legal basis is the legitimate interest of OTCHO (Article 6(1)(f) GDPR) or, where applicable, the performance of an agreement (Article 6(1)(b) GDPR).

3.4. Subscribers. OTCHO processes the name, the email address and data on the opening of and clicks in emails, for sending the newsletter and mail trainings. The legal basis is consent (Article 6(1)(a) GDPR). Consent can be withdrawn at any time through the unsubscribe link in each email.

3.5. Users of the free 8 P's of Work™ profile. OTCHO processes the name, the email address, the answers given and the results, for generating and delivering the personal report and, after anonymisation, for research. The legal basis is the request of the data subject (Article 6(1)(b) GDPR) and, where requested, consent (Article 6(1)(a) GDPR).

3.6. Clients. OTCHO processes the identification and contact data of contact persons, contractual data, and invoicing and payment data, for the performance of the agreement, invoicing and compliance with legal obligations. The legal bases are the performance of the agreement (Article 6(1)(b) GDPR) and compliance with a legal obligation (Article 6(1)(c) GDPR).

4.1. OTCHO does not request special categories of personal data within the meaning of Article 9 GDPR, such as data concerning health, religious or philosophical beliefs or political opinions.

4.2. Where such data is nevertheless provided, either party notifies the other and the data is erased without undue delay.

5.1. OTCHO does not engage in automated individual decision-making, including profiling, within the meaning of Article 22 GDPR. The 8 P's of Work™ is not used to predict whether a person will leave an organisation.

5.2. Individual results are only accessible to the data subject. Aggregated reporting is only provided for groups of ten participants or more.

6.1. OTCHO uses anonymised and aggregated data for research and benchmarking. Such data cannot be traced back to a natural person or to an organisation. Benchmark figures are only published for segments covering at least three organisations.

7.1. Where a client uses 8 P's of Work™ with its participants, OTCHO processes the personal data of those participants on behalf of and on the instructions of the client.

7.2. The environment in which that data is stored is determined jointly by the parties: an environment managed by OTCHO, or an environment provided and hosted by the client, under the client's responsibility.

7.3. When the parties enter into an agreement, a data processing agreement ("DPA") forms an integral part of it. The DPA governs the instructions of the client, the security measures, the use of sub-processors, the handling of personal data breaches and the return or erasure of the data at the end of the assignment. The DPA is available on request.

8.1. OTCHO does not sell, rent or otherwise make personal data available for commercial purposes.

8.2. OTCHO engages the following processors, with which a data processing agreement has been concluded:

• Lovable and Cloudflare: hosting and security of the website
• Google Workspace: email, calendar, documents and Google Sheets, including the storage of the free 8 P's of Work™ profiles
• Calendly: scheduling of conversations
• Kit: newsletter and mail trainings
• Granola: notes of calls and meetings
• Anthropic (Claude): management of contacts and follow-up
• Yuki (Visma): accounting and invoicing

8.3. Personal data may be disclosed to public authorities where OTCHO is legally obliged to do so.

9.1. Certain processors are established outside the European Economic Area, in particular in the United States. Such transfers take place on the basis of an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework, or of standard contractual clauses (Article 46 GDPR).

10.1. Personal data is not retained for longer than necessary for the purposes for which it is processed. Unless a longer period is required by law, the following periods apply:

11.1. OTCHO implements appropriate technical and organisational measures to protect personal data against loss and unauthorised access, in accordance with Article 32 GDPR. Access to personal data is limited to what is necessary.

11.2. In the free 8 P's of Work™ profile, names and email addresses are stored separately from answers, and access is restricted so that each record remains linked to the correct data subject only.

12.1. Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection, in accordance with Articles 15 to 21 GDPR. Where processing is based on consent, consent can be withdrawn at any time, without affecting the lawfulness of processing before its withdrawal.

12.2. Requests can be addressed to OTCHO through the contact details at the end of this policy. OTCHO may request proof of identity. OTCHO responds within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests (Article 12(3) GDPR).

12.3. Data subjects have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be.

13.1. OTCHO may amend this privacy policy. The applicable version is the one published on this page, with the date of the last update. Material changes are communicated to data subjects where possible.

Questions about this privacy policy or the processing of your personal data: get in touch.

OTCHO BV · Wolfaardstraat 11, 8800 Roeselare · VAT BE1002225279