1. Scope of this Policy
This Privacy and Cookie Policy applies to people who visit our website, contact us, or use the Platform on behalf of a Customer. For those activities, OffConversion generally acts as the data controller.
When Customers submit lead and conversion data for Advertisers, OffConversion normally processes that data on the Customer's documented instructions as a processor or subprocessor. That processing is governed by the applicable Data Processing Agreement ("DPA"), rather than this Policy.
2. Who we are
The controller is OFFCONVERSION, LDA, a Portuguese private limited company with registered office at Rua do Pinheiro, Edifício Belo Horizonte, Bloco A, Entrada E, no. 208, 1.º Esq., 4835-093 Creixomil, Guimarães, company and tax number 519640721. Privacy enquiries may be sent to contact@offconversion.com. We have not appointed a Data Protection Officer; privacy requests are handled through that address.
3. Information we process
Depending on how you interact with us, we may process:
- Account information: name, business email, telephone number, company and account role.
- Billing information: legal entity, billing address, tax number, subscription, invoices, payment status, card brand and last four digits. Complete payment-card and bank details are processed by Stripe and are not stored by OffConversion.
- Authentication and security information: login records, IP address, browser and device information, security events and session identifiers.
- Platform usage: workspace selections, feature interactions, configuration, diagnostic information and support history.
- Communications: messages, meeting details, feedback and support requests.
- Business prospect information: professional contact details and records of B2B commercial communications.
- Contract records: the identity, time and version associated with acceptance of our legal terms, where recorded.
4. Why we use information
We process account and authentication data to create and administer accounts, provide the Platform, perform our contract and protect the service. We process billing data to collect payment and meet accounting and tax obligations. We use support communications to respond to requests and perform the service.
We may process security logs, usage information and limited B2B contact information where necessary for our legitimate interests in preventing fraud, maintaining and improving the Platform, supporting Customers and developing business relationships. We consider the impact on individuals and provide a right to object where applicable. Where processing requires consent, it may be withdrawn at any time without affecting earlier lawful processing.
5. How long we keep information
We retain information only for as long as reasonably necessary for its purpose and any legal, accounting or dispute requirements. Our standard periods are:
- account and contract records: for the contract and up to five years afterwards;
- billing and tax records: up to ten years where required by law;
- security and access logs: normally up to 12 months;
- Platform usage information: normally up to 24 months;
- support communications: normally up to three years;
- B2B prospect information: until objection or for a maximum of two years without meaningful engagement.
We may keep specific information longer where reasonably necessary to establish, exercise or defend legal claims, comply with law, investigate abuse or enforce our agreements.
6. Who receives information
We disclose information only where necessary to operate the business, provide the Platform, process payments, communicate with users, protect our rights or comply with law. Relevant providers currently include Stripe for payments, Google Workspace for business email, Railway for application and database infrastructure, and Cloudflare for domain, network and security services. Each provider receives only information relevant to its service and acts under its own terms or a data-processing agreement, as applicable.
We may also disclose information to professional advisers, public authorities or courts where legally required, or in connection with a corporate transaction subject to appropriate confidentiality protections. We do not sell personal data.
7. Google, Meta and connected services
When a Customer connects Google, Meta or another service, we access and use information from that service only to provide the features the Customer activates and as otherwise described during connection. The Customer's use of those services remains subject to the provider's terms and privacy notices.
OffConversion's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
8. International transfers
Some providers are established in or may access information from countries outside the European Economic Area. Where required, we rely on a valid transfer mechanism such as an adequacy decision, the EU-US Data Privacy Framework for certified recipients, or European Commission Standard Contractual Clauses, together with supplementary measures where appropriate. You may contact us for further information about the safeguards relevant to your data.
9. Your data-protection rights
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests or direct marketing, and withdraw consent. To exercise a right, email contact@offconversion.com. We may need to verify your identity before responding.
We normally respond within one month. That period may be extended by up to two further months for complex or numerous requests, in which case we will explain the delay. You may complain to the Portuguese Data Protection Authority (CNPD) or the competent supervisory authority in your country.
If your request concerns lead data submitted by one of our Customers, please contact that Customer first. We will assist it as required under the DPA.
10. Security
We use technical and organisational measures designed to protect personal data, including encrypted connections, access controls, authentication safeguards, environment separation, logging and backup procedures appropriate to the service. No online service can guarantee absolute security. Users must protect their credentials and notify us promptly of suspected unauthorised access.
11. Cookies and local storage
We currently use only technologies needed to provide, secure and remember settings for the website and Platform. We do not currently place advertising or third-party analytics cookies through the public website.
| Technology | Purpose | Typical duration |
|---|---|---|
| Session cookie | Authentication, account security and maintaining a signed-in session. | Session; the associated authentication token expires after a limited period. |
| Local storage | Remembering functional choices such as language, theme, active workspace and profile display settings. | Until removed by the user, cleared by the application or replaced. |
| Session storage | Remembering temporary interface state, such as whether an introductory animation has already been shown. | Until the browser tab or session is closed. |
These technologies are used for requested functionality and security, rather than advertising. You can clear cookies and local storage using browser settings, but doing so may sign you out or reset preferences. If we introduce optional analytics or advertising technologies, we will update this Policy and request consent before activating them where required.
12. Children
The Platform is a business service and is not directed to children. Customer users must be adults with authority to act for their organisation. Customers must not submit children's personal data as Customer Data unless expressly permitted by the DPA and applicable law.
13. Changes to this Policy
We may update this Policy to reflect legal, technical or business changes. We will update the effective date and provide appropriate notice of material changes, including by email or within the Platform where reasonable.