Legal Information

1. Introduction

This Privacy Policy describes how Fortanix Inc. and its subsidiaries (hereinafter: “Fortanix”, “we” or “us”) handles Personal Data of its (prospective) customers’ representatives, (website) visitors and suppliers. Fortanix takes your privacy very seriously and is committed to handling your Personal Data in a lawful, fair and transparent manner. This Privacy Policy explains in a detailed way how we do this. As we believe that the handling of your Personal Data is very important to both you and us, we encourage you to read this Privacy Policy carefully.

When we refer to "Personal Data" under this Privacy Policy, we mean any information through which we can identify you as an individual (e.g. your name, telephone number, e-mail address or other contact details). This does not include information which is related to legal entities, such as our customers’ company information (B2B data). Nevertheless, Fortanix will treat such B2B data in the same way as it would treat Personal Data.

2. Scope of this Privacy Policy

This Privacy Policy applies to the use of the Personal Data of our (prospective) customer representatives, website visitors and suppliers:

• (Prospective) customer representatives: when we do business with our customers, we collect the contact details of the (legal) representatives of the customer. We collect this Personal Data for example through forms submitted via our website or by having contact via e-mail or telephone. In addition, we collect Personal Data of our customer’s representatives to provide access to our platforms and services.
• Website visitors: when you visit our website, we collect your (contact) details when you browse through our website and when you fill in or download forms on or from our website, such as to request a demo or trial for our products.
• Suppliers: when we do business with our suppliers, we collect the contact details of the (legal) representatives of the supplier. We collect this Personal Data for example to maintain contact over the telephone or via email, or to conclude a contract.

Fortanix Inc. is responsible (as ‘data controller’) for collecting and using your Personal Data as described in this Privacy Policy. Fortanix Inc. has appointed Fortanix B.V. as its EU-representative. The contact details of both entities can be found under section 13 of this Privacy Policy.

In addition, other specific Fortanix entities could be responsible as a separate data controller if you enter into a business relationship with them. In such cases, you will be informed of this separately.

Please note that Fortanix does not process any personal data (either as data controller or data processor) which is placed onto its platforms or solutions by its customers, other than the contact details of the customer’s representatives to provide access to our platforms or solutions (as described in this Privacy Policy). Further information about how personal data is handled within Fortanix’ products and services can be found in the relevant product terms.

3. How we collect and use of your Personal Data

The exact types of Personal Data that we collect and use are outlined below and depend on the relationship we have with you and the kind of services that we provide to you.

• (Prospective) customer representatives: In order to establish business relationships with you as a client and provide you with access to the relevant products and services, we process the following Personal Data of our customer’s business representatives (acting on behalf of the company):
  • your contact details: your name, e-mail address, signature (if included on contracts) and any other contact details you provide to us.
  • your use of our services: the Personal Data that is related to the use of our services, such as information required to create user accounts.
  • any other personal data: any Personal Data that you disclose in the course of your contractual relationship with us.
• Website visitors: when you visit our website we collect the following Personal Data of you:
  • your contact details: when you fill out the contact or downloading form on our website, we collect your name, company, e-mail address and telephone number.
  • automatically collected data: when you access our website, we automatically collect some of your data through your browser or device such as through cookies (such as your IP address, analytics regarding your use of our website and other unique electronic identifiers).
• Suppliers: when we enter into a business relationship with our suppliers, we collect the following Personal Data of our supplier’s business representatives:
  • your contact details: your name, email address, signature (if included on contracts) and any other contact details you provide to us.
  • any other personal data: any Personal Data that you disclose in the course of your company’s contractual relationship with us.

4. The legal basis we have for processing your Personal Data

We will only process your Personal Data if we can rely on one of the following legal bases:

• for the performance of our agreement with you (on behalf of the company you represent);
• to comply with a legal obligation;
• to act upon your consent;
• to pursue our legitimate business interests (or those of third parties).

5. Purposes for which we use your Personal Data

We will only process your data for specific and limited purposes which are linked to the legal bases that we set out above in section 4. These purposes are:

• for the performance of our agreement with you. To carry out the agreement that we concluded or will conclude with you on behalf of your company and to provide you with the information and services you request. For instance, we will need to process your Personal Data in order to keep in contact with you, manage and handle requests, provide (technical) support or customer service and to provide essential information regarding the services. We will also need to process your Personal Data in order to provide you with access to our products or services through a user account, as agreed with you.
• to comply with our legal obligations. To fulfill legal obligations such as maintaining appropriate business records and to comply with requests from governmental agencies, supervisory bodies or fiscal authorities and to comply with applicable laws and regulations.
• based on your consent. We may send marketing or other business related communications to our prospective customers, such as newsletters via email, if you have consented thereto. For existing customers, we send e-marketing (such as newsletters via email) based on our legitimate interests, as set out below.
• for our legitimate (business) This includes the following:
• to send e-marketing (such as newsletters via email) to our existing customers for the purpose of advertising our products and services or otherwise engaging with our customers for marketing or commercial purposes, provided that you have not opted out.
• to manage our internal client database (CRM) system, in order to keep track of our financials and services.
• to operate and expand our business activities and services.
• to develop and improve the quality of our services (e.g. by conducting customer satisfaction surveys or analyzing the use of our website).
• to operate company policies and procedures, such as for training and learning purposes.
• to invite our customers’ representatives for relevant business events.
• to ensure and protect the integrity, security and safety of our systems. This includes the prevention of unauthorized persons from accessing our systems.
• to enable us to make corporate transactions, such as mergers, sales, reorganizations, transfer of our assets or business or acquisitions.

6. Sharing your Personal Data
   
   To fulfill the purposes described above, from time to time we share your Personal Data with other Fortanix group companies or external service providers that assist us in delivering our services. These companies will have access to your Personal Data, but only when strictly necessary to perform their services. We do this on a strict need-to-know basis and we ensure that we enter into contractual agreements with these companies before we share your Personal Data. These companies are:

• other entities within the Fortanix Group: we will share your Personal data internally between the responsible Fortanix entities for management purposes, internal administrative purposes, or other business related purposes as described in this Privacy Policy, such as to provide you with our services and to guarantee our contractual commitments towards our customers. You can find a list with all of our locations on our website.  
• third party service providers: such as our business partners, hosting providers and analytics and search engine providers that support us in the improvement and optimization of our website and internal systems (e.g. our IT service providers, analytics provider, cloud storage provider).
• third parties in case of legal requirement or legal claims: where required by law, we share your Personal Data with third parties such as tax authorities, supervisory bodies or governmental or judicial agencies. We may also share your Personal Data with other third parties, such as law firms, where necessary to initiate or defend ourselves against any legal claims.
• third parties in case of corporate transactions: such as companies involved in mergers, sales or reorganizations or companies that we acquire.

7. Storage location of your Personal Data

All Personal Data of our European based (prospective) customer representatives, website visitors and suppliers is primarily stored on data centers located within the European Economic Area (“EEA”). For the purposes listed in this Privacy Policy, it might be possible that your Personal Data is accessible or otherwise transferred to countries outside the EEA, such as to Fortanix group companies based in the US (e.g. Fortanix Inc.). In such cases, we will implement adequate safeguards (and, where necessary, supplementary measures) to ensure that your Personal Data is afforded a level of protection which is essentially equivalent to the level of protection guaranteed within the EEA, such as entering into Standard Contractual Clauses as approved by the European Commission.

You can request a copy of any documentation showing the adequate safeguards that have been taken by contacting our privacy team at privacy@fortanix.com.

8. Protecting your Personal Data

Effective security of your Personal Data is important to us. We have therefore taken adequate technical and organizational security measures to protect your Personal Data against unauthorized or unlawful use or access. We take steps to limit access to your Personal Data to those individuals who need to have access for one of the purposes listed in this Privacy Policy.

These measures include practices such as:

• Keeping Personal Data on a secured server behind a firewall;
• Using secure socket layer (“SSL”) technology;
• Using regular malware scanning;
• Internal reviews of our data collection practices;
• Physical security measures to guard against unauthorized access to systems where we store Personal Data.

9. Retaining your Personal Data

We ensure that your Personal Data will not be stored longer than is necessary for the purpose they were obtained (such as to provide you with our services, to answer queries or resolve issues or to fulfil our contractual obligations), unless a longer period is necessary to comply with legal obligations (such as fiscal or legal obligations) or to defend ourselves against a legal claim. Generally, we will only retain Personal Data throughout the term of our business relationship and delete it as soon as possible thereafter, unless we are legally required to retain the data for a longer period. If you would like to receive further information on how long we store your Personal Data, please contact privacy@fortanix.com.

10. Your rights with respect to your Personal Data

You have several rights in relation to the Personal Data processed by Fortanix. For example, you have the right to access, update, delete or restrict the Personal Data that we collect about you and at any time you can obtain a copy of your Personal Data that we hold or request that the information is transmitted to another data controller.

You also have the right to object to the processing of your Personal Data and if you have given us consent, for example to receive newsletters, you may withdraw this consent if you have changed your mind. Please note that a withdrawal of consent does not affect the lawfulness of any processing which has taken place prior to your consent being withdrawn and that we can only action your request in accordance with applicable law.

If you wish to exercise your rights, you can contact us by sending an e-mail to our privacy team at privacy@fortanix.com. In order for us to comply with your request in the best way possible, please indicate which Personal Data you would like to receive, have changed or removed or what limitations you would like to put on our use of the data.

If you are unsatisfied with how we process your Personal Data or if you believe that your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority in the country where you live or where you believe your rights have been infringed.

11. Additional Disclosures for California Residents: Your Rights Under CCPA

• Personal Information We Collect: Identifiers (including, name and last name) and professional information (Including business contact information).
• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: You have the right to request the deletion of your personal information.
• Right to Opt-Out: You have the right to opt-out of the sale of your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights under the CCPA.

California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of our website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@fortanix.com.

12. Children’s Personal Data

Fortanix is a business-to-business service directed to and intended for use only by those who are 18 years or age or over. We do not target Fortanix at children, and we do not authorize people under 18 years of age to directly request our services. In the unlikely event that a minor has submitted Personal Data to Fortanix, and if you are the parent or guardian of the minor who has provided personally identifiable information to Fortanix, please inform us by contacting us at privacy@fortanix.com and we will remove such information from our database. If you are concerned about your children’s use of our website, you may use web-filtering technology to supervise or limit access to our website. For more information, visit www.OnGuardOnline.gov for tips from the Federal Trade Commission on protecting kids’ privacy online.

13. CAN-SPAM Act Compliance

Fortanix complies with the CAN-SPAM Act (“Act”) regarding the transmission of commercial email. In accordance with the Act, our emails will always include a clear and conspicuous way for recipients to opt-out of receiving future messages; monitor third party email marketing services, if one is used; provide accurate “From” fields so that users know who is sending the email; provide visible and operable unsubscribe mechanisms in all of our emails; include our physical address in the body of our emails; and refrain from using harvested email addresses. If you wish to unsubscribe or have any concerns about the emails you receive from us, please contact us at privacy@fortanix.com. Please note that even if you opt out of receiving marketing emails, we may still send you transactional emails related to your use of our products or services.

14. Links to other websites

From time to time, you will find links to other websites on the Fortanix website. As these websites are owned by other parties, Fortanix is not responsible for the handling of your Personal Data on these websites or for the privacy of the information that is collected by the services these websites provide. We strongly recommend you to carefully read the privacy notices applicable to these websites and services.

15. Changes to this Privacy Policy

This Privacy Policy is subject to changes from time to time, so please make sure you check this page regularly. We will inform you separately about fundamental changes to this Privacy Policy.Your continued use of this website after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

16. Contacting us

If you have any questions or concerns about this Privacy Policy or the processing of your Personal Data in general, or if you wish to exercise any of your rights, please email Fortanix Inc. at privacy@fortanix.com indicating the nature of your query.

You can also contact Fortanix B.V., which acts as the European representative of Fortanix Inc. The European representative can be reached at eu.privacy@fortanix.com.