Privacy Policy

1. Name and contact details of the Data Controller

• Company name: Western Tactics
• Address: Willem Wilminkplein 9, 7511PG Enschede, The Netherlands
• Chamber of Commerce (KvK) number: 42064690
• Email address for privacy matters: info@westerntactics.com

2. Processing of personal data and categories of personal data

Western Tactics processes personal data because you use our Services, visit our Website and/or because you provide this data to us yourself. Depending on how you interact with us, we process the following categories of personal data:

2.1 Organization and Customer Data

• Name of the organization and billing details
• Business contact details (first and last name, business email address, job title, telephone number)

2.2 Platform (Orbit) User Data

• First and last names of users / employees
• Email addresses of users
• Preferred language and settings
• Progress, training results, and interactions within awareness training
• Technical integrations (if configured via Enterprise SSO/SCIM): Identity Provider group IDs and user IDs

2.3 Technical and session data

• IP address, browser information, and operating system (temporarily stored for debug logs, security, and performance optimization)
• Email performance data (e.g., open and click rates of simulations or notifications)

3. Purposes and Legal Bases for Processing

We only process personal data for specific purposes and when there is a valid legal basis under Article 6 of the GDPR.

• Performance of a contract: for providing our B2B SaaS Services, managing licenses and accounts, and performing billing. Where applicable, the basis is the performance of a contract or taking steps prior to entering into one.
• Business communication and support: for answering questions, providing support, and sending necessary service and platform messages. Depending on the situation, we base this processing on the performance of a contract or our legitimate interest in providing good service.
• Improvement of our Services: for analyzing usage and interaction data to improve the operation, security, and user-friendliness of our Services. Where Western Tactics is the data controller for this, we base this on our legitimate interest in improving and securing our services.
• Business marketing: for informing business relations about relevant Services and developments, insofar as legally permitted. Where consent is required, we request this in advance.
• Website analysis and security: for analyzing generic usage statistics, securing our Website, the Application, and systems, and preventing and investigating abuse. We base this, where applicable, on our legitimate interest in a secure and well-functioning service.
• Legal obligations: insofar as processing is necessary to comply with tax, administrative, or other legal obligations.

4. Integrated Cookie Statement

In addition to the data mentioned above, we use cookies and similar technologies on our Website and the Platform (Orbit).

Website analysis

For analyzing the use of our Website, we use privacy-friendly analysis techniques where possible, in which no or as little personal data as possible is processed. If prior consent is required for the use of cookies or similar techniques, these are only used after this consent has been obtained.

Strictly necessary and functional cookies

For the technical operation and security of our Website and Orbit, we use strictly necessary and functional cookies and similar techniques. These can be used, for example, for session management, authentication, security, and remembering necessary user settings. Insofar as no consent is required for these techniques under applicable law, they are used without prior consent.

We do not use tracking or advertising cookies without prior consent when such consent is legally required.

Form security

For the security of our forms against spam and automated abuse, we use Google reCAPTCHA v3. When using this, Google may process technical data, including IP address, browser and device information, and data about the interaction with the form.

5. Processors, sub-processors, and international transfers

Western Tactics may engage external service providers for hosting, infrastructure, email, authentication, security, and other supporting services. When these parties process personal data on behalf of Western Tactics, appropriate contractual agreements are made in accordance with the GDPR.

For personal data that Western Tactics processes on behalf of a Customer, Western Tactics may engage sub-processors in accordance with the applicable data processing agreement.

If personal data is transferred to a country outside the European Economic Area, Western Tactics ensures a valid transfer mechanism in accordance with Chapter V of the GDPR, insofar as legally required. This may be, for example, an adequacy decision by the European Commission, including where applicable the EU-US Data Privacy Framework, or the use of Standard Contractual Clauses (SCCs) approved by the European Commission.

More information about applicable processors, sub-processors, and transfer safeguards can be requested via info@westerntactics.com.

6. Retention Periods

Western Tactics does not store personal data for longer than is necessary for the purposes for which it was collected, unless a longer retention period is necessary or required by applicable laws and regulations. In doing so, we essentially apply the following principles:

• Administrative and tax data: during the applicable statutory retention period, generally seven (7) years.
• Business contact and correspondence data: for as long as reasonably necessary for the business relationship, service provision, or the handling of inquiries and potential legal claims.
• Website and security data: generally a maximum of 30 days, unless longer retention is necessary for investigating a security incident, preventing abuse, or complying with a legal obligation.
• Personal data within Orbit processed on behalf of a Customer: for the duration of the service provision and thereafter in accordance with the DPA, the agreements with the relevant Customer, and, where applicable, the statutory obligations regarding the transfer and retrieval of data.
• Data processed on the basis of consent: until consent is withdrawn or the data is no longer necessary for the purpose for which consent was given, unless another legal basis justifies further processing.

After the applicable retention period, personal data will be deleted or, where appropriate, irreversibly anonymized, unless further retention is legally required.

7. Data Security

Western Tactics takes appropriate technical and organizational measures to protect personal data against loss, unauthorized access, alteration, and other unlawful processing. These measures include access security, data encryption during transport and storage, and appropriate authentication measures.

8. Your Rights as a Data Subject

You have a number of legal rights against us regarding your personal data:

• Access: Upon your request, we will inform you in writing whether we process personal data about you, including a copy and an explanation of the purposes and recipients.
• Rectification: You can request the correction of inaccuracies or completion of incomplete data.
• Erasure: You can request the deletion of your personal data when it is no longer necessary, upon withdrawal of consent, or in the case of unlawful processing.
• Restriction: You can request to temporarily restrict processing pending the handling of your request.
• Data Portability: Insofar as the right to data portability applies, you can request to receive the eligible personal data in a structured, commonly used, and machine-readable format or, where technically feasible, have it transmitted directly to another party.
• Objection: You can object to the processing of your personal data at any time, provided you have a reasoned basis.
• Withdrawal of consent: When we process personal data based on your consent, you can withdraw this consent at any time. This does not affect the lawfulness of the processing prior to the withdrawal.

If you wish to exercise your rights, please contact us at info@westerntactics.com. We aim to respond within one month of receiving your request, in accordance with the applicable statutory timeframe.

9. Questions or Complaints?

Do you have questions about this privacy policy or how we process personal data? Please contact us at info@westerntactics.com.

You also have the right to file a complaint with the Data Protection Authority (Autoriteit Persoonsgegevens in the Netherlands) if you believe that the processing of your personal data violates the GDPR.

We may amend this privacy policy from time to time, for example, when our services or applicable laws and regulations change. The most current version will be published on this page, stating the date of the last modification.