Privacy at Onpipeline

Privacy Notice

Simple navigation and consultation of the website do not generally involve the gathering of users personal data and only relate to the processing in anonymous form of so-called navigation data.

This Notice applies to the processing of Personal Data collected by us when you:

• Use our Service(s) – Applicable to our Customers, and their Users
• Visit our websites
• Receive communications from us
• Register for, attend or take part in events, webinars or contests

This Privacy Notice describes our privacy practices and addresses certain privacy and data protection frameworks relevant to our Services, including, where applicable, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).

References to these laws do not mean that every provision applies to every individual or processing activity. The applicability of a particular law depends on the circumstances and the scope of that law.

Data controlled and processed by us

Where we are required to identify a legal basis for processing Personal Data, we rely on one or more of the following:

1. Performance of a contract, including providing the Services and managing customer accounts and support.
2. Compliance with legal obligations, including accounting, tax and lawful governmental requests.
3. Our legitimate interests, including improving and securing the Services, preventing fraud and misuse, operating our business and protecting or defending legal rights, provided such interests are not overridden by the rights and freedoms of individuals.
4. Consent, where consent is required for the relevant processing activity, including for certain marketing communications.

Where identifying a legal basis in this manner is not required, we process Personal Data for the purposes described in this Privacy Notice.

Data collected and entered by Clients

Customers may submit or upload Personal Data relating to third parties into the Services (“Customer Data”). Customers are responsible for ensuring that they are authorized to collect, use and submit Customer Data to the Services and for providing any notices or obtaining any permissions required for their processing activities.

Onpipeline processes Customer Data only for the purpose of providing, operating, maintaining and securing the Services requested by the Customer, and does not independently determine the purposes for which Customer Data is collected or used by the Customer.

Integrated Services

Our Clients have the option to integrate certain services provided by third parties (i.e. calendars provided by Google, Microsoft, etc.). By authorizing us to connect with a third party, Clients authorize us to access and store information that the Integrated Service makes available to us, and to use and disclose it in accordance with this Policy. We consider data from integrated services as “data collected and entered by Clients”. Please refer to privacy settings and terms of use of each Integrated Service to understand what information they make available to us.

Data processors

We may work with external providers for development, hosting, systems maintenance, etc. Real data is not accessible in case of external developers, but third parties may have access to data as part of providing their services. We always limit the information provided to what is reasonably necessary, and our agreements ask them to maintain confidentiality. Third parties that have access to data and might potentially process personal information are listed in the processors section.

California Residents (CCPA)

The rights described in the section “Rights of the User” apply to all users, including California residents. In accordance with the California Consumer Privacy Act (CCPA), California residents have the right to:

• know and access certain Personal Information collected about them;
• request correction of inaccurate Personal Information;
• request deletion of Personal Information, subject to the exceptions provided by law;
• limit certain uses and disclosures of Sensitive Personal Information, where such right applies;
• exercise their privacy rights without unlawful discrimination.

Onpipeline does not sell or share Personal Information as those terms are defined under the CCPA.

California residents may exercise their rights using the same contact details and procedures indicated in the “Rights of the User” section. We may need to verify the requester’s identity before responding, in accordance with the CCPA.

Healthcare Data and HIPAA

We offer HIPAA-compliant processing, including the execution of a Business Associate Agreement (“BAA”), only under the Advanced plan.

If a Client requires Onpipeline to process Protected Health Information (“PHI”) as a Business Associate, a BAA must be executed before the Client uses the Services to store, transmit or otherwise process PHI. Unless a BAA is in place, Clients must not upload, store or process PHI within the Services. In such circumstances, Onpipeline does not act as a Business Associate and does not assume Business Associate obligations under HIPAA.

If Clients connect third-party services, including cloud storage, communication or other software, through APIs or integrations, Clients are responsible for determining whether those services satisfy any legal, regulatory or contractual requirements applicable to the Client’s use of those services. Onpipeline does not guarantee the HIPAA compliance of third-party services and is not responsible for processing performed independently by those providers outside Onpipeline’s controlled environment.

Rights of the User

Individuals may exercise the privacy rights provided by the legal framework applicable to the relevant processing. Depending on that framework, such rights may include:

• access to Personal Data concerning them;
• correction of inaccurate Personal Data;
• deletion of Personal Data, subject to any permitted or required retention;
• restriction of certain processing activities;
• objection to certain processing activities;
• data portability, where provided;
• withdrawal of consent where processing is based on consent;
• opt-out rights relating to certain uses.

Where Personal Data must be retained for legal, regulatory, accounting, security, dispute-resolution or similar purposes, such data will be retained only for the relevant purpose and for the period required or permitted for that purpose.

Privacy requests may be submitted to: privacy@onpipeline.com – Onpipeline may request information reasonably necessary to verify the identity of the requester and to process the request in accordance with the relevant legal framework.

Security

Onpipeline undertakes to maintain the security of all data gathered using technical and organisational tools. The safety measures are aimed at reducing to the minimum the risk of destruction or loss of data and the risk of unauthorised access, and they include the possibility of limiting access to the data to authorised Onpipeline personnel alone. Onpipeline employees acknowledge that they are bound by standards of data security and data confidentiality.

Cancellation of data

All data is held only for a period of time strictly necessary for the purposes for which the data was gathered. Without prejudice to the right to immediately block the use of data for commercial and marketing purposes, it may prove necessary to hold the data for a further period of time for purposes of satisfying legal provisions or for accounting and administrative purposes.

Upon termination of the Service, “data collected and entered by Clients” is deleted from active systems within 30 days from the effective date of termination. Residual copies may be retained in encrypted and access-restricted backup systems for a limited period of up to 180 days, after which they are permanently deleted or irreversibly overwritten.

Modifications

In the future, modifications to this Privacy Policy may be introduced for purposes of ensuring ongoing compliance with applicable legal rules. We invite Users to carefully read the rules applied by ourselves for the gathering and processing of personal data.

Contact information

For questions regarding this Privacy Notice or our privacy practices, please contact:

privacy@onpipeline.com

Onpipeline Limited
The Black Church,  St. Mary’s Place
Dublin 7 (Ireland), Reg. No. 679560

Last update: June 4, 2026