PRIVACY POLICY

OmniMinds Technologies B.V. ("OmniMinds", "we", "us", or "our"), operating the MetroMinds platform, is committed to protecting the privacy and security of personal data in compliance with the General Data Protection Regulation (GDPR) (EU 2016/679) and applicable national data protection legislation.

1. OUR ROLES UNDER THE GDPR

1.1 OmniMinds as Data Controller: OmniMinds acts as Data Controller when it determines the purposes and means of processing personal data relating to registered accounts, website visitors, business contacts, contract administration, billing, platform security, support and service communications.

1.2 OmniMinds as Data Processor: When a Client submits or manages Customer Data through MetroMinds, the Client generally acts as Controller and OmniMinds acts as Processor. This includes personal data contained in use cases, portfolios, AI Readiness evaluations, notes, workflows, role mappings, uploaded materials and other organization-specific content. Such processing is governed by the applicable Data Processing Agreement and the Client's documented instructions.

Contact Details:

OmniMinds Technologies B.V.
KVK number: 42130269
Website: metrominds.io
Privacy questions: use the contact form and choose the topic Security and privacy.

2. CATEGORIES OF PERSONAL DATA COLLECTED

We collect and process personal data that is necessary to provide, secure, administer and improve the platform and related services:

• Account and identity data: Name, business email address, job title, organization name, account role, authentication details, password hashes and Single Sign-On tokens where applicable.
• Technical and usage data: IP address, browser and device information, timestamps, session activity, authentication events, login attempts, security events and application logs.
• Readiness and participation data: Public AI Readiness Snapshot submissions, AI Readiness invitations, participant names and email addresses, organization context, evaluation progress, responses, calculated scores and participant status.
• Workspace and portfolio data: Use cases, portfolio proposals, acceptance or rejection decisions, comments, notes, workflows, capability mappings, workforce mappings, rationales, scores and organization-specific adjustments.
• Uploaded and submitted content: Documents, text, requirements, enterprise context and other materials supplied by or on behalf of a Client.
• Billing and administrative data: Corporate billing address, tax identification numbers, order information and contact details of administrative personnel.
• Communications: Information submitted when contacting sales, customer support, technical support or the privacy contact.
• Appointment scheduling data: Information you enter when booking a demo or working session, including your name, contact details, selected service, preferred time and any information you add to the booking.

3. PURPOSES AND LEGAL BASES FOR PROCESSING

• Performance of Contract (Art. 6(1)(b) GDPR): To create and administer accounts, provide platform access, deliver subscribed functionality, manage invitations, provide support and administer the contractual relationship.
• Legitimate Business Interests (Art. 6(1)(f) GDPR): To protect the platform, investigate misuse, prevent fraud, maintain operational reliability, improve usability, understand which campaigns lead to enquiries, communicate service information and establish, exercise or defend legal claims.
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with financial, tax, corporate, security and other statutory obligations.
• Consent (Art. 6(1)(a) GDPR): Where consent is specifically requested for an optional activity. Consent may be withdrawn at any time without affecting processing that occurred before withdrawal.
• Processing on behalf of a Client: Customer Data is processed under the Client's documented instructions and the Data Processing Agreement rather than for OmniMinds' independent purposes.

4. DATA SHARING AND SUB-PROCESSORS

OmniMinds does not sell, rent or trade personal data. Personal data may be disclosed only where necessary to provide or protect the Service, comply with law, or act on a Client's documented instructions.

• Hosting and infrastructure providers: Production hosting, database, storage, backup and network services.
• Email delivery providers: Transactional emails such as invitations, password messages, access notifications and reminders.
• Payment and administration providers: Billing, accounting and payment services where applicable.
• Professional advisers and authorities: Legal, security, audit or regulatory recipients where disclosure is necessary and lawful.

Sub-processors that process Customer Data are subject to written data protection obligations. Current sub-processor information will be made available to Clients through the applicable agreement, service documentation or upon request. Where a sub-processor changes, OmniMinds will provide notice as agreed with the Client and allow the Client to raise reasonable data protection objections.

5. INTERNATIONAL DATA TRANSFERS

OmniMinds seeks to configure its primary production hosting and database services within the European Economic Area (EEA). Some support, email, security or infrastructure services may involve processing outside the EEA. Where personal data is transferred outside the EEA, OmniMinds will use a lawful transfer mechanism, such as an adequacy decision or approved Standard Contractual Clauses, together with supplementary measures where required.

6. SECURITY

OmniMinds maintains technical and organizational measures appropriate to the nature of the Service and the risks of processing. Measures may include HTTPS/TLS for data in transit, password hashing, role-based access controls, access logging, security headers, protection against common web attacks, controlled secrets management, backups, vulnerability management and incident response procedures. Encryption at rest is applied where supported and enabled by the relevant hosting, database or storage service. Security measures are reviewed and may evolve as the Service and associated risks change.

7. COOKIES AND LOCAL STORAGE

Necessary. MetroMinds uses a strictly necessary session cookie named metrominds_session to keep forms secure and, for Authorized Users, to keep them signed in and protect access to authenticated functionality. It expires when the browser session ends or the user signs out, and is configured with HttpOnly, SameSite=Lax and Secure. We also store your cookie choice in your browser (mm_consent) so we do not ask again for twelve months. These do not require consent.

Campaign details. When you arrive on the public website through a link with campaign details, such as UTM tags or an advertising click ID (for example gclid from Google Ads or msclkid from Microsoft Ads), we keep those details, the page you landed on and the website that referred you on our server, linked to the session cookie above. We do not place an extra cookie for this. If you send us an enquiry, request a report or complete the AI Readiness Snapshot, we store these details with that request so we can see which campaigns lead to enquiries; otherwise they are deleted when your browser session ends. We do this on the basis of our legitimate interest and do not use these details for advertising profiles.

Analytics, only with your consent. On the public website we use Google Analytics through Google Tag Manager to understand how the site is used and which pages help visitors. Google Analytics cookies (such as _ga) are only set after you click Accept in the cookie banner. Until then, Google Tag Manager runs with Consent Mode set to denied. With your consent the website also keeps the campaign details in your browser's session storage for the rest of your visit. We do not use advertising cookies.

Interface preferences. The website and the Service may use local storage or session storage to remember interface state, such as a chosen industry or which articles you have read. This information stays in your browser and is not used for advertising, cross-site tracking or user profiling.

Changing your choice. You can change or withdraw your consent at any time with Cookie settings at the bottom of every page of the public website. If you withdraw consent, we stop setting analytics cookies and remove the existing ones where the browser allows it.

8. RETENTION

Personal data is retained only for as long as necessary for the relevant purpose, contractual relationship, security requirement or legal obligation. Retention periods may differ by category:

Backups may retain deleted data for a limited rotation period. Data in backups is protected from ordinary use and is overwritten or deleted according to the backup lifecycle.

9. DATA SUBJECT RIGHTS

Subject to applicable law, individuals may have the right to access, rectify or erase their personal data; restrict or object to processing; receive portable data; withdraw consent where processing is based on consent; and lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Requests may be submitted through the contact form, with the topic Security and privacy. Where OmniMinds processes personal data solely on behalf of a Client, the request may be referred to that Client and OmniMinds will provide reasonable assistance under the DPA.

10. REQUIRED INFORMATION AND AUTOMATED DECISION-MAKING

Certain account and business contact information is required to enter into or perform the service relationship. If required information is not provided, access to relevant functionality may not be available. MetroMinds provides assessment, scoring, categorization and decision-support functionality, but OmniMinds does not use account personal data to make solely automated decisions that produce legal or similarly significant effects on individuals.

11. CHANGES TO THIS POLICY

OmniMinds may update this Privacy Policy to reflect changes in the Service, processing activities or applicable law. Material changes will be communicated through the Service, by email or through another appropriate channel before they take effect where required.