Onoal Website Privacy Policy

1. Who is responsible for your personal data?

Onoal is the controller responsible for the processing described in this Privacy Policy. In this policy, “Onoal”, “we”, “us”, and “our” refer to Onoal.

2. Scope of this policy

This Privacy Policy applies to the public Onoal website, including:

• the homepage;
• Identis marketing pages;
• the Identis Business marketing page;
• the STEL marketing page;
• the Fabric marketing page;
• the Company page;
• the Contact page;
• public waitlist pages;
• legal and informational pages;
• website analytics;
• technical delivery, operation, and security.

This policy does not automatically apply to:

• Identis product accounts or private runtime services;
• STEL product accounts or private computing environments;
• customer-specific pilots;
• business agreements;
• third-party websites or applications.

Separate or supplementary privacy information will be provided when another Onoal product processes additional categories of personal data.

3. Our infrastructure

The Onoal website may use several infrastructure layers. These layers serve different technical purposes and do not all necessarily process every request in the same way.

Cloudflare

Cloudflare may provide domain name resolution, encrypted connections, content delivery, edge caching, traffic routing, denial-of-service protection, firewall functionality, bot and abuse detection, technical request logging, website availability, and security.

A visitor’s request may first pass through Cloudflare before reaching the infrastructure on which the website is hosted.

Astreal

Astreal provides or coordinates infrastructure used by Onoal. Depending on the final legal and contractual structure, Astreal may provide infrastructure orchestration, application hosting, deployment infrastructure, network routing, service monitoring, operational logging, backup coordination, incident response, infrastructure security, and connections to underlying cloud providers.

Where Astreal is a separate legal entity, it processes personal data for Onoal under a data-processing agreement. Where Astreal is only an internal infrastructure name or division of Onoal, it is not treated as a separate recipient.

Amazon Web Services

Amazon Web Services may provide underlying cloud infrastructure used directly by Onoal or through Astreal, including computing, storage, databases, backups, network services, logging, monitoring, application deployment, disaster recovery, and security tooling.

Where possible and appropriate, Onoal or Astreal selects European infrastructure regions for website workloads.

Google Cloud

Google Cloud Platform may provide underlying cloud infrastructure used directly by Onoal or through Astreal, including computing, storage, databases, network services, logging, monitoring, deployment, backups, infrastructure security, and operational support.

Google Cloud infrastructure is separate from Google Analytics. Google Analytics is used only for optional website analytics as explained later in this policy.

4. Roles of our infrastructure providers

Onoal determines why and how personal data is processed through the public website. Onoal is therefore generally the controller.

Cloudflare, Astreal, AWS, and Google Cloud generally act as processors or subprocessors when they process website data on Onoal’s documented instructions. The exact contractual chain may differ by service.

Onoal

Controller

Cloudflare

Direct processor

Astreal

Direct processor or internal infrastructure operator

AWS

Direct processor or Astreal subprocessor

Google Cloud

Direct processor or Astreal subprocessor

When Onoal contracts directly with AWS or Google Cloud, that provider acts as a processor for Onoal. When Astreal contracts with AWS or Google Cloud to provide infrastructure to Onoal, AWS or Google Cloud may act as a subprocessor beneath Astreal.

Onoal remains responsible for selecting suitable providers, documenting the processing, and ensuring that appropriate contractual safeguards are in place.

5. Our general privacy approach

The public Onoal website is designed to collect as little personal data as reasonably possible.

We do not use the public website to:

• sell personal data;
• trade personal data;
• create advertising profiles;
• display personalized advertising;
• conduct remarketing;
• follow visitors across unrelated websites;
• combine website analytics with Identis identity data or private product account data;
• identify anonymous visitors by name;
• make solely automated decisions with legal or similarly significant effects;
• collect sensitive personal data intentionally;
• create hidden product accounts.

Google Analytics is the only non-essential analytics service used on the public website. Google Analytics is activated only after you give consent.

6. Personal data we process

The personal data we process depends on how you use the website.

6.1 Technical website data

When you visit the website, technical information must be processed to deliver and secure it.

• your IP address;
• date and time of a request;
• requested domain, page, file, or URL;
• HTTP request and response information;
• browser type and version;
• device category;
• operating system;
• preferred language;
• referring page;
• network and routing information;
• TLS and connection information;
• approximate geographic routing information;
• error messages;
• security events;
• firewall events;
• indicators of automated or abusive traffic.

This information may be processed by Cloudflare, Astreal, AWS, Google Cloud, or a combination of these providers. We do not use ordinary infrastructure logs to build commercial visitor profiles.

6.2 Website security data

When a request appears unusual, unsafe, or abusive, additional information may be processed, including IP reputation information, traffic patterns, request frequency, bot indicators, challenge results, firewall rule matches, suspected attack information, authentication or form-abuse indicators, and incident investigation records.

We process this information to protect the availability and integrity of the website and related infrastructure.

6.3 Google Analytics data

When you consent to analytics, Google Analytics may process a pseudonymous browser identifier, session identifier, pages viewed, navigation between pages, visit duration, approximate location, browser type, operating system, device category, screen size, language, referring website, campaign information, selected button or link interactions, and your analytics-consent status.

We do not intentionally send names, email addresses, telephone numbers, postal addresses, contact-form contents, waitlist answers, account credentials, identity documents, Identis account information or other private product account information, directly identifying user identifiers, or private message contents to Google Analytics.

Onoal does not use Google Analytics User-ID on the public website.

6.4 Contact information

When you contact Onoal, we may process your name, email address, organization, role or job title, reason for contacting us, message contents, attachments you choose to provide, relevant correspondence, and internal notes needed to answer your request.

Please do not send passwords, private keys, recovery codes, identity documents, health information, payment-card information, or other sensitive information through a general contact form.

6.5 Waitlist information

When you join an Onoal waitlist, we may process your name, email address, organization if provided, role if provided, the Onoal product in which you are interested, intended use case, preferred form of access, registration date, page or campaign source, communication preferences, and relevant waitlist correspondence.

Joining a waitlist does not create an Identis, STEL, or other Onoal product account and does not guarantee access to a product.

6.6 Privacy preference data

We may store information needed to remember and demonstrate your privacy choices. This may include whether you accepted or rejected analytics, the date and time of your choice, the version of the privacy or cookie notice, a random consent record identifier, and when consent was withdrawn or changed. This information is not used for advertising.

7. Why we process personal data

Website delivery

We process technical data to deliver requested pages, establish encrypted connections, route traffic, serve static and dynamic content, maintain website functionality, and diagnose technical problems.

Legal basis: our legitimate interest in operating a functional public website.

Website and infrastructure security

We process security data to detect attacks, block abusive traffic, prevent form abuse, investigate incidents, protect infrastructure, maintain service availability, and protect Onoal and website visitors.

Legal basis: our legitimate interest in protecting our services, infrastructure, visitors, and organization. Where processing is required by law, the legal basis may also be compliance with a legal obligation.

Google Analytics

We use Google Analytics to understand which pages are used, identify general navigation patterns, measure broad interest in Onoal products, identify usability problems, improve content and website structure, understand which campaigns or referrals bring visitors to the website, and evaluate website performance.

Legal basis: your consent. Google Analytics is not loaded before you provide consent.

Contact requests

We process contact information to answer your message, understand your inquiry, route the request to the appropriate person, discuss a potential relationship, provide requested information, and maintain an appropriate record of the communication.

Legal basis: our legitimate interest in responding to genuine inquiries or taking steps at your request before entering into an agreement.

Waitlist administration

We process waitlist information to register your interest, understand which Onoal product is relevant, provide relevant product updates, assess suitability for early access, manage invitations, prevent duplicate or abusive registrations, and plan product access and pilots.

Legal basis: your request to join the waitlist and, where required for non-essential communications, your consent.

Legal claims and obligations

We may process relevant information to comply with legal obligations, respond to valid legal requests, maintain financial or corporate records, establish, exercise, or defend legal claims, and investigate fraud or serious misuse.

8. Google Analytics and cookies

The public website uses Google Analytics 4 only after analytics consent is provided. Google Analytics may use first-party cookies to distinguish pseudonymous visitors and sessions.

The precise Analytics cookie name includes the identifier of the relevant Google Analytics property.

Our intended Google Analytics configuration is: analytics denied by default, no Google Analytics code loaded before consent, no analytics cookies before consent, no cookieless Analytics pings after rejection, no Google Signals, no Google Ads connection, no remarketing, no advertising personalization, no directly identifying User-ID, no contact or waitlist data sent to Analytics, no Identis account information or other private product account information sent to Analytics, user- and event-level retention set to two months, and Analytics cookies limited to a maximum of thirteen months.

We may measure selected website events, such as page views, navigation between product pages, opening a waitlist page, clicking a contact button, or clicking a product CTA. We do not include contact-form contents, names, email addresses, or free-text waitlist answers in Analytics events.

9. Your analytics choice

When you first visit the website, you may be asked to accept analytics, reject analytics, or review your privacy choices. Rejecting analytics must be as accessible as accepting it.

When you reject analytics, Google Analytics is not loaded, Google Analytics cookies are not placed, Analytics events are not sent, and your access to the website is not restricted. A rejected analytics preference is stored for 14 days. When that preference expires, analytics does not turn on automatically; the website may simply ask you to choose again.

When you accept analytics, your accepted preference is stored for up to 13 months. You can change or withdraw your choice at any time through the permanent Cookie settings link in the website footer. Withdrawing consent affects future processing, replaces the accepted preference with a rejected preference, and removes Google Analytics cookies where technically possible.

10. Necessary cookies and local storage

We may use strictly necessary cookies or browser storage to remember your privacy choice, provide website security, prevent abuse, maintain essential traffic routing, complete a security challenge, or ensure basic website functionality.

Cloudflare may use short-lived security mechanisms when needed to distinguish legitimate traffic from automated or harmful traffic. Necessary security and preference mechanisms are not used for advertising or cross-site profiling and may operate without analytics consent where strictly necessary.

11. Cloudflare

Cloudflare processes technical request and security information to provide edge, network, and security services. Depending on the enabled Cloudflare services, Cloudflare may process IP addresses, request information, browser information, routing information, firewall events, security indicators, cached website content, and error information.

Cloudflare does not determine the general purpose for which Onoal operates the website. Cloudflare processes relevant website data to provide its contracted services and to maintain the security and integrity of those services.

12. Astreal

Astreal operates or coordinates infrastructure used by Onoal. Astreal may process technical request logs, application logs, deployment information, infrastructure metrics, error information, security events, encrypted backups, contact or waitlist data stored in website systems, and operational metadata.

Astreal processes this information only as needed to host and operate website components, deploy updates, maintain infrastructure, monitor availability, investigate failures, create backups, respond to security incidents, and coordinate underlying cloud services.

Access by Astreal personnel must be restricted to authorized persons who require access for infrastructure, security, or support purposes. Where Astreal is a separate legal entity, Onoal will maintain a data-processing agreement with Astreal.

13. Amazon Web Services

AWS may process personal data when website components, databases, files, logs, or backups are placed on AWS infrastructure. Depending on the services used, this may include technical request data, contact information, waitlist information, operational logs, encrypted backups, infrastructure metadata, and security records.

AWS processes this information to provide the cloud services selected and configured by Onoal or Astreal. Onoal and Astreal remain responsible for selecting suitable AWS services, configuring access controls, selecting regions, determining retention, protecting credentials, encrypting data where appropriate, and determining what data is placed on AWS.

14. Google Cloud Platform

Google Cloud may process personal data when website components, databases, files, logs, or backups are placed on Google Cloud infrastructure. Depending on the services used, this may include technical request data, contact information, waitlist information, operational logs, encrypted backups, infrastructure metadata, and security records.

Google Cloud processes this information to provide the cloud services selected and configured by Onoal or Astreal. Onoal and Astreal remain responsible for selecting suitable Google Cloud services, configuring access controls, selecting regions, determining retention, securing credentials, encrypting data where appropriate, and determining what information is stored.

Google Cloud infrastructure processing is separate from Google Analytics processing.

15. Who receives personal data?

We may share personal data with infrastructure providers including Cloudflare, Astreal, Amazon Web Services, and Google Cloud Platform where necessary to deliver, host, secure, monitor, and maintain the website.

Google Analytics receives analytics data only after consent. Communication providers may process information needed to deliver contact requests or manage waitlist communications once they have been added to our internal processing register and contractual documentation.

We may share limited information with professional advisers where reasonably necessary and subject to confidentiality. We may disclose information where required by applicable law, a valid court order, or another legally binding request. Information may also be reviewed or transferred as part of a merger, financing, restructuring, acquisition, or sale of relevant business assets under appropriate safeguards.

16. International data transfers

Cloudflare, AWS, Google Cloud, Google Analytics, their affiliates, and their subprocessors may operate internationally. Personal data may therefore be processed outside the Netherlands or the European Economic Area.

Where personal data is transferred to a country outside the EEA, we use an appropriate transfer mechanism where required, such as an adequacy decision of the European Commission, the EU–US Data Privacy Framework where applicable, Standard Contractual Clauses approved by the European Commission, and supplementary technical, contractual, or organizational safeguards.

Selecting a European cloud region reduces unnecessary international storage but does not always mean that every support, security, routing, or administrative activity occurs exclusively within the EEA.

17. Data location and infrastructure flexibility

Onoal may move website workloads between Astreal-managed infrastructure, AWS, and Google Cloud where reasonably necessary for availability, resilience, maintenance, migration, security, performance, disaster recovery, cost-efficient operation, or service development.

Such changes do not permit Onoal to use personal data for a new purpose. Before a material infrastructure change, Onoal must assess the processing role of the provider, data location, contractual safeguards, security measures, retention settings, subprocessor relationships, and international data transfers.

18. How long we retain personal data

We retain personal data only for as long as it is reasonably necessary.

Ordinary technical logs

Ordinary website, application, and infrastructure logs are generally retained for up to 30 days. A shorter or longer period may apply where required for troubleshooting, system reliability, security investigations, abuse prevention, or legal obligations.

Security information

Information connected to a suspected attack, fraud attempt, or security incident may be retained for up to 24 months, or longer where necessary for legal claims or an ongoing investigation.

Google Analytics

Our intended Analytics retention is user- and event-level information for 2 months and Google Analytics cookies for a maximum of 13 months. An accepted analytics preference is stored for up to 13 months. A rejected analytics preference is stored for 14 days, after which the website may ask again while keeping Analytics off unless you accept.

Contact messages

Contact information is generally retained for up to 24 months after the last meaningful communication. Information may be retained longer where a contractual relationship develops, there is an ongoing inquiry, legal retention obligations apply, or the information is needed for a legal claim.

Waitlist information

Waitlist information is retained until the earliest of: withdrawal from the waitlist, closure of the relevant waitlist, access being offered and the waitlist purpose being complete, or 24 months passing since the last meaningful interaction. Where continued communication is appropriate and permitted, we may ask you to renew your interest.

Consent records

Records needed to demonstrate consent or withdrawal may be retained for up to five years after the relevant consent expires or is withdrawn. They are retained only for accountability and legal protection.

Backups

Deleted information may remain temporarily in encrypted backups until the relevant backup cycle expires. Backups are not used to restore individually deleted information unless required for disaster recovery or legal reasons.

19. Security

Onoal, Astreal, and the relevant infrastructure providers use technical and organizational measures intended to protect personal data. These may include encrypted connections, encryption at rest where appropriate, access controls, least-privilege permissions, multi-factor authentication, network segmentation, infrastructure monitoring, secure deployment procedures, logging and alerting, backup controls, incident-response procedures, provider and subprocessor reviews, and retention controls.

No website or internet service can guarantee absolute security. Please report suspected security problems through the security contact listed on this page and do not send passwords, private keys, recovery codes, or other authentication secrets through ordinary email.

20. No advertising or sale of data

Onoal does not sell website visitor personal data and does not use the website for targeted advertising, cross-site advertising profiles, Google Ads remarketing, personalized advertising, data-broker activity, commercial sale of visitor profiles, or combining Analytics identifiers with Identis identities or other private product identities.

Google Analytics data is used only to understand and improve the public website.

21. Automated decision-making

The public website does not use personal data to make solely automated decisions that produce legal effects or similarly significant consequences for an individual.

General analytics may influence decisions about website design, navigation, content, product communication, campaign effectiveness, and development priorities. These are general website or product decisions and not automated decisions about an identifiable visitor.

22. Your rights

Depending on the circumstances, you may have the right to:

• receive information about processing;
• request access to your personal data;
• request correction;
• request deletion;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent;
• lodge a complaint with a supervisory authority;
• receive information about international-transfer safeguards.

To exercise a right, contact the privacy email listed on this page and state which right you wish to exercise, how you interacted with Onoal, the email address or other information connected to your request, and any information needed to locate the relevant records. We may request information reasonably necessary to verify your identity.

23. Withdrawing analytics consent

You may withdraw analytics consent at any time by opening Cookie settings through the permanent link in the website footer and changing Analytics to Rejected. You may also delete Google Analytics cookies through your browser.

After withdrawal, Google Analytics will no longer be loaded for future visits while your 14-day rejection preference remains stored, new Analytics events will not be sent, Google Analytics cookies are removed where technically possible, the website will remain available, earlier lawful processing is not made unlawful, and aggregated information that can no longer be connected to you may remain available.

24. Children

The public website is intended for a general audience and is not designed to intentionally collect personal data from young children.

A person below the applicable age of independent digital consent should not submit a contact or waitlist form without appropriate involvement from a parent or legal guardian. If you believe a child has submitted personal data improperly, contact us so that we can investigate and, where appropriate, delete it.

25. External links

The website may link to GitHub, social platforms, documentation, status pages, partner websites, and other external resources.

Independent websites are responsible for their own processing. This Privacy Policy does not govern how an external website processes personal data after you leave onoal.com.

26. Complaints

Please contact Onoal first so that we can review your concern. You also have the right to lodge a complaint with a competent supervisory authority.

For Onoal, the Dutch supervisory authority is the Autoriteit Persoonsgegevens. You may also contact the supervisory authority in the EU or EEA country where you live, work, or believe an infringement occurred.

27. Changes to this Privacy Policy

We may update this Privacy Policy when the website changes, a new form is introduced, infrastructure changes, Astreal’s legal role changes, AWS or Google Cloud services change, a new provider is introduced, Analytics settings change, legal requirements change, our company details change, or the text requires clarification.

The current version will be published with a revised effective date. Where a change affects consent-based processing, we will request new consent where required.

We will not introduce additional analytics providers, session-recording software, advertising cookies, remarketing, visitor fingerprinting, Google Signals, Google Ads integration, or direct identification through Analytics without reviewing and updating our privacy documentation where necessary.

28. Contact

For privacy questions, requests, or complaints, contact Onoal using the contact details shown on this page.

Appendix A — Provider overview

Appendix B — Processing overview

Appendix C — Required website configuration

Analytics provider

Google Analytics 4 only

Analytics default

Denied

Analytics before consent

Not loaded

Cookieless analytics pings

Disabled

Google Signals

Disabled

Google Ads connection

Disabled

Remarketing

Disabled

Advertising personalization

Disabled

Analytics User-ID

Not used

Contact data in Analytics

Prohibited

Waitlist contents in Analytics

Prohibited

Private product account data in Analytics

Prohibited

Analytics user/event retention

2 months

Analytics cookie lifetime

Maximum 13 months

Accepted analytics preference

Up to 13 months

Rejected analytics preference

14 days

Preference control

Permanent Cookie settings link

Primary edge provider

Cloudflare

Infrastructure operator

Astreal

Underlying cloud providers

AWS and Google Cloud

Preferred workload regions

European regions where appropriate

Ordinary technical log retention

30 days

Security incident retention

Up to 24 months where necessary