Privacy Notice

View OwnBackup’s response to the EU Court of Justice’s decision invalidating the EU-US Privacy Shield:

Data Transfer Impact Assessment

Effective Date: February 7, 2023
Last Reviewed: February 7, 2023

At OwnBackup, one of our key company values is building trust through transparency. We know that you care how information about you is used and shared. With this Privacy Notice, we aim to provide you transparency into the types of data we collect about you and what we do with it.

OwnBackup provides cloud-based solutions that help businesses, organizations and government agencies protect against data loss and corruption (the “Services”). The Services include backup, comparison, recovery, archiving, and management of large, complex SaaS-based data sets.

This Privacy Notice applies to the processing of information relating to an identified or identifiable natural person (“Personal Data”), collected by OwnBackup for its own purposes and in the context of operating any of the OwnBackup websites, including www.ownbackup.com and resilience.work as well as any other sites, applications, and third party plugins that may be used to access the service (the “Website”). This Privacy Notice does not cover the use of your Personal Data by OwnBackup on behalf of OwnBackup’s customers (e.g., when OwnBackup processes your Personal Data in the context of the Services) or by third parties on other OwnBackup branded websites. To learn more about the privacy practices of OwnBackup’s customers, please visit their respective websites.

This Privacy Notice describes the types of Personal Data we collect, the purposes for which we collect that Personal Data, the other parties with whom we may share it and the measures we take to protect the security of the data. It also tells you about your rights and choices with respect to your Personal Data, and how you can contact us to update your contact information or get answers to questions you may have about our privacy practices.

Personal Data We May Collect

How We May Use Your Personal Data

How We Share Your Personal Data

Your Rights and Choices

How We Protect Your Personal Data

Data Transfers

Features and Links to Other Websites

Privacy of Children

Updates to This Privacy Notice

How to Contact Us

We may collect the following Personal Data:

• • Personal Data collected via cookies and similar technologies.
  • Personal Data we obtain when you apply for a job with us.
  • Personal Data we obtain in the context of the use of the Services.
  • Personal Data we collect in the context of our business relationship with customers.

We obtain Personal Data relating to you from various sources described below.

Where applicable, we indicate whether and why you must provide us with your Personal Data, as well as the consequences of failing to do so. If you do not provide Personal Data when requested, you may not be able to use the relevant service or submit your job application with OwnBackup if that information is necessary or if we are legally required to collect it.

a. Personal Data Obtained from Your Interaction with the OwnBackup website

A cookie is a small piece of data that a website asks your browser to store on your computer or mobile device. The cookie allows the website to “remember” your actions or preferences over time. Most browsers support cookies, but users can set their browsers to decline them and can delete them whenever they like.

When you use the Website, we may collect certain information by automated means (e.g., via cookies, plugins, and similar technologies), including for example IP address, browser type, operating system, referring URLs and information on actions taken or interaction with our Website, and other mobile trackers. We may use third-party plugins and/or web analytics services on our Website. The providers that administer these services use technologies such as cookies and web beacons to help us communicate with visitors and analyze how visitors use our Website.

We use this information to improve our Website by assessing how many users access or use our Website, which content, products, and features most interest our visitors, what types of offers our customers like to see, and how our service performs from a technical point of view.

b. Personal Data We Obtain when You Apply for a Job with Us

If you are applying for a job at OwnBackup, we may collect certain Personal Data from your job applications, such as your contact information (including name, postal address, email address and phone number), job history, resume or CV, contact details of your references and any other Personal Data you choose to submit along with your application.

c. Personal Data We Obtain in the context of the Services

i) We may obtain Personal Data about you when we (as a Data Processor) process data uploaded by our customers (as Data Controllers) for use in the Services (“Customer Owned Data”). The Data Controller which collected your data can provide you with information as to why they use our service.

This information typically may include, the following elements:

• First and last name
• Title
• Position
• Employer
• Contact information (company, email, phone, physical business address)
• ID data
• Professional life data
• Personal life data
• Localization data

ii) We may obtain Personal Data about you when we (as a Data Controller) collect data from you for the purpose of providing certain components of the Services, for example, when you sign up as an administrator during the service onboarding process.

d. Personal Data We Collect in the Context of our Business Relationship with Customers

We may collect Personal Data from individuals working for one of our customers, partners or suppliers, including name, job title, department and name of organization, business email address, business postal address and business telephone number. We may use this information to manage our business relationships, for marketing and to comply with applicable law, as well as for accounting, auditing and billing purposes.

We may use your Personal Data to:

• Operate, support, improve, and develop our Services.
• Perform accounting, bookkeeping, auditing, and billing activities.
• Anonymize Personal Data, prepare and furnish aggregated data reports showing anonymized information.
• Evaluate your interest in employment and contact you regarding possible employment.
• Protect against fraud and ensure safety and security.
• Enforce our Terms and Conditions (including our Master Subscription Agreement) and comply with our legal obligations.
• Comply with our own legal and regulatory obligations.

We may use Personal Data we obtain about you for the purposes set below. Depending on the country in which you are located, we will only process your Personal Data, when we have a legal basis for processing as listed below:

We may share Personal Data with:

• Our affiliates and partners.
• Our service providers acting on our behalf.
• Third parties for legal compliance, or other lawful purposes.
• Third parties in the event of a sale or transfer of our business or assets.

We do not share or otherwise disclose Personal Data we collect about you, except as described in this Privacy Notice or otherwise disclosed to you at the time the data is collected. Additionally, we do not sell the Personal Data we collect about you, as defined by the California Consumer Privacy Act (CCPA).

We share Personal Data with our affiliates and partners, subject to the terms of this Privacy Notice or as otherwise disclosed to you at the time the data is collected.

We also may share Personal Data with our service providers who perform services on our behalf and in relation to the purposes described in this Privacy Notice. We require these service providers by contract to only process Personal Data in accordance with our instructions and as necessary to perform services on our behalf or comply with legal requirements. We also require them to safeguard the security and confidentiality of the Personal Data they process on our behalf by implementing appropriate technical and organizational security measures and confidentiality obligations binding employees accessing Personal Data.

We also may disclose data about you: (i) if we are required to do so by law or legal process, (ii) in response to a request from a court, law enforcement authorities, or government officials, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

We also reserve the right to transfer Personal Data we have about you in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use Personal Data you have provided to us in a manner that is consistent with this Privacy Notice. Following such a sale or transfer, you may contact the entity to which we transferred your Personal Data with any inquiries concerning the processing of that information.

Subject to applicable law(s), you have the right to:

• Access your Personal Data, rectify it, restrict its processing, or request its deletion.
• Receive the Personal Data you provided to us to transmit it to another company.
• Withdraw any consent provided.
• Where applicable, lodge a complaint with your Supervisory Authority.

You may also submit a request as described in the “How to Contact Us” section.

Subject to applicable law(s), you have certain rights regarding the Personal Data we maintain about you and certain choices about what Personal Data we collect from you, how we use it, and how we communicate with you. Those include your rights to:

• Request access to and receive information about the Personal Data we maintain about you, to update and correct inaccuracies in your Personal Data, to restrict the processing of your Personal Data, to have the information anonymized or deleted, as appropriate, or to exercise your right to data portability to easily transfer information to another company. In addition, you may also have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work or where an incident took place.
• Withdraw any consent you previously provided to us regarding the processing of your Personal Data, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before your consent withdrawal.

Additionally, if you are located in California, we will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights, except where the different price or level of quality of good or service is reasonably related to the value of the data that we receive from you. In some instances, we may not be able to provide you with the good or service that you request if you choose to exercise certain rights.

If you are located in California, you may also choose to exercise the following right(s):

• Not to provide Personal Data to OwnBackup by refraining from submitting Personal Data directly to us. When we collect Personal Data from you, we indicate whether and why it is necessary to provide it to us, as well as the consequences of failing to do so. If you do not provide Personal Data, you may not be able to benefit from the full range of OwnBackup’s products and services, and we may not be able to provide you with the OwnBackup products or services if that information is necessary to provide you with them, or if we are legally or contractually required to collect it in relation to the provision of such product or service.
• To opt out of the collection and use of certain information, which we collect about you by automated means, when you visit our websites or use our apps. In certain jurisdictions, you can exercise your choice regarding the use of cookies and similar technologies via the Cookie Consent tool displayed at the bottom of our Website. Your browser may tell you how to be notified of and opt out of having certain types of cookies placed on your device. Note that without certain cookies you may not be able to use all of the features of our websites, apps or online services. 
• To opt out of certain uses of information, which we collect about you by automated means when you visit third-party websites and interact with our ads. We may use service providers to serve ads on those third-party websites. These ads may be customized and served based on the use of data we and our partners have collected on our websites and apps. In addition, some of our service providers and partners may collect information about your online activities over time and across third-party websites to customize and serve these ads. OwnBackup’s ads are sometimes delivered with icons that help consumers (i) learn more about how their data is being used and (ii) exercise choices they may have regarding the use of their data.
• To tell us not to send you marketing emails by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us as indicated below.

The above rights may be limited in some circumstances by local law requirements.

You may submit a request to exercise your rights or update your preferences, by contacting us as specified in the “How to Contact Us” section below. Subject to applicable law, you may also have the option to exercise your choice via the cookie consent tool displayed at the bottom of our Website. If available your browser may tell you how to be notified and opt out of receiving certain types of cookies. In addition, we may provide you with other choices regarding the use of cookies. Please note, however, that without cookies you may not be able to use all the features of our Website or online services.

If we fall short of your expectations in processing your Personal Data or you wish to make a complaint about our privacy practices, please tell us because it gives us an opportunity to fix the problem. To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time and, in any event, within the legal time limit for responding, where applicable.

We maintain appropriate security safeguards to protect your Personal Data and only retain it for a limited period.

We maintain appropriate administrative, technical, and physical safeguards to protect Personal Data against accidental or unlawful destruction, accidental loss, unauthorized alteration, unauthorized disclosure or access, misuse, and any other unlawful form of processing of the Personal Data in our possession. We use SSL encryption on our Website and restrict access to your Personal Data to only those employees who need access to that data, in accordance with this notice.

We also take measures to delete your Personal Data or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we processed it or when you request their deletion, unless we are required by law to keep the information for a longer period. We complete periodic reviews of our databases, and have established specific time limits for data deletion, taking into account the type of data collected, the type of services provided, and the length of the customer relationship, possible re-enrollment with the Services, mandatory retention periods, regulatory requirements and the statute of limitations.

OwnBackup is a global business. We may transfer your Personal Data to the United States and other countries which may not have the same data protection laws as the country in which you initially provided the information, but we will protect your Personal Data in accordance with this Privacy Notice, or as otherwise disclosed to you.

If you are located in the EEA, the UK or Switzerland, we will transfer your Personal Data in accordance with this Privacy Notice and make use of accepted data transfer mechanisms, such as data transfer agreements that incorporate Standard Contractual Clauses approved by the European Commission or the corresponding mechanisms applied under UK and Swiss data protection laws.

OwnBackup is a global business. We may transfer or disclose Personal Data we collect about you to recipients in countries other than your country, including to the United States. These countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer or disclose your Personal Data to other countries, we will protect that information in compliance with applicable laws as described in this Privacy Notice.

We comply with applicable legal requirements providing adequate safeguards for the transfer of Personal Data to countries other than the country where you are located. We may also transfer Personal Data to countries for which adequacy decisions have been issued, and use contractual protections for the transfer of Personal Data to third parties, such as the European Commission’s Standard Contractual Clauses (SCCs). You may contact us as specified in the “How to Contact Us” section below to obtain a copy of the safeguards we use to transfer Personal Data outside of the EEA, UK and Switzerland.

You may choose to use certain features for which we partner with other entities that operate independently from OwnBackup.

On our Website, you may choose to use certain features that can be accessed through, or for which we partner with, other entities that are not otherwise affiliated with OwnBackup. These features, which may include, social networking, geo-location, security, and spam filtering tools, are operated by third parties, including social networks, and are clearly identified as such. These third parties may use or share Personal Data in accordance with their own privacy policies. We strongly suggest you review these third parties’ privacy policies if you use these features.

OwnBackup’s products and services are not directed to or intended for children.

OwnBackup does not offer services to minors and does not knowingly collect Personal Data from children under the age of 13. If you believe we have collected information from your child in error or have questions or concerns about our practices relating to children, please notify us using our contact details below.

While no longer considered a valid transfer mechanism in the wake of Schrems II, OwnBackup nonetheless still subscribes to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks.

OwnBackup complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland to the United States. OwnBackup has certified to the U.S. Department of Commerce that it adheres to the Privacy Shield Principles.  If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.  To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

In compliance with the Privacy Shield Principles, OwnBackup commits to:

a) resolve questions or complaints about our collection or use of your personal information under the Privacy Shield Frameworks by following the Dispute Resolution process set out here;

b) cooperate with the panel established by the EU data protection authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved Privacy Shield complaints concerning data transferred from the EU and Switzerland;

c) submit to binding arbitration before the Privacy Shield Panel if this option has been invoked by you, as is your right under certain circumstances;

d) cooperate with the DPAs and comply with the advice given by such authorities with regard to human resources data transferred from the EU in the context of any applicable employment relationship; and

e) accept responsibility (including any potential liability) for onward transfers of personal data to third parties.

In addition, it is important for you to be aware that, with respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, OwnBackup is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission and U.S. Department of Transportation.

This Privacy Notice may be updated periodically to reflect changes in our privacy practices.

This Privacy Notice may be updated periodically to reflect changes in our Personal Data practices. We will notify you of any significant changes to our Privacy Notice by indicating at the top of the notice when it was most recently updated. If we update this Privacy Notice, in certain circumstances, we may seek your consent. This Privacy Notice will be reviewed at least once every twelve months and accordingly we will indicate at the top of this notice the last time that this review occurred, even if that review did not result in a change to the Privacy Notice.

You can e-mail us at privacy@ownbackup.com with any questions, comments, or concerns around our privacy practices and policies. 

You may submit a request to exercise your rights or share any questions, comments, or complaints about this Privacy Notice or our privacy practices by e-mailing us at privacy@ownbackup.com, or at the contact below:

OwnBackup Inc.
Attention: Privacy
940 Sylvan Ave
Englewood Cliffs, NJ 07632