Privacy Policy

The data controller responsible for your personal data is:

For all data protection matters, you can contact us at info@consono.ai.

We may collect and process the following categories of personal data:

We process your personal data for the following purposes and on the following legal bases under Art. 6(1) GDPR:

We may share your personal data with the following categories of recipients:

• Service providers: Third-party companies that perform services on our behalf, such as hosting, analytics, customer support, and email delivery. These providers act as data processors and process your data only on our instructions under a data processing agreement (Art. 28 GDPR).
• Legal and regulatory authorities: Where required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, reorganisation, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your data.
• With your consent: We may share your data with other third parties when you have given us your explicit consent to do so.

We do not sell your personal data to third parties.

Your personal data is stored and processed within the European Economic Area (EEA). We do not transfer your personal data outside the EEA.

All our service providers who process personal data on our behalf are established within the EEA or are subject to appropriate safeguards ensuring an adequate level of data protection.

Should this change in the future, we will ensure that any transfer of personal data outside the EEA is carried out in compliance with Chapter V of the GDPR, using appropriate safeguards such as Standard Contractual Clauses (SCCs) adopted by the European Commission, adequacy decisions, or other legally recognised mechanisms. We will update this Privacy Policy accordingly.

We retain your personal data only for as long as is necessary for the purposes for which it was collected. The criteria used to determine our retention periods include:

• The duration of our contractual relationship with you
• Whether there is a legal obligation to retain the data (e.g., tax or accounting requirements)
• Whether retention is necessary for the establishment, exercise, or defence of legal claims
• Our legitimate business interests (e.g., fraud prevention)

When personal data is no longer necessary for the purposes for which it was collected, we will securely delete or anonymise it.

Our Service uses cookies and similar technologies. Cookies are small text files placed on your device when you visit our website.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, in accordance with Art. 32 GDPR. These measures include, but are not limited to:

• Encryption of data in transit (TLS/SSL) and at rest where appropriate
• Access controls and authentication mechanisms
• Regular security assessments and testing
• Employee training on data protection and security
• Incident response and breach notification procedures

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. In the event of a personal data breach, we will comply with the notification requirements under Articles 33 and 34 of the GDPR.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access the data and receive a copy.
• Right to rectification (Art. 16): You have the right to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure (Art. 17): You have the right to request the deletion of your personal data in certain circumstances (e.g., the data is no longer necessary, you withdraw consent, or processing is unlawful).
• Right to restriction of processing (Art. 18): You have the right to restrict the processing of your personal data in certain situations.
• Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to a decision based solely on automated processing.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time.

Our Service is not directed at children under the age of 16 (or such lower age as applicable in the relevant EU Member State under Art. 8 GDPR; in Belgium, the age is 13). We do not knowingly collect personal data from children under this age. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at info@consono.ai, and we will take steps to delete such data.

We do not currently engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR. Should this change, we will update this Privacy Policy and, where required, obtain your explicit consent.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email (to the address associated with your account) or by a prominent notice on the Service at least thirty (30) days before the changes take effect.

Where changes affect the legal basis for processing or introduce new purposes, we will ensure compliance with applicable GDPR requirements, including obtaining your consent where necessary.

We encourage you to review this Privacy Policy periodically. The "Last updated" date at the top of this policy indicates when the last revisions were made.