Notch Privacy and Data Protection Policy and Notice

‍Notch Ltd and its affiliates (“Notch”, “we”, “our” or the “Company”) respect the privacy of our customers, end-users, vendors, website visitors and others whose Personal Data we process, and are committed to protecting such information.

Notch provides a platform that enables customers to deploy AI agents and automate customer-facing, internal and back-office workflows (the “Services”). This Privacy Policy explains how we collect, use, share, store and protect Personal Data in connection with our website, Services and business activities.

For purposes of the GDPR, applicable US State privacy laws and other applicable privacy laws, Notch generally acts as a data controller in relation to Personal Data concerning our website visitors and representatives of customers and prospective customers. We generally act as a data processor for customer end-user data processed through the Services on behalf of our customers. In such cases, the relevant customer is the data controller, we process Personal Data in accordance with its instructions, and the customer’s privacy policy governs its processing.

‍

1. WHICH PERSONAL DATA DO WE COLLECT?

Summary: We collect Personal Data you provide to us, data generated through your use of our Services, and certain technical and usage data.

We may collect Personal Data that you or your organization provide to us, including your name, email address, phone number, postal address, job title, organization, country and other information you choose to provide when using our Services, communicating with us, requesting support or otherwise engaging with us.

We may also collect technical and usage information relating to your use of our website and Services, including IP address, device and browser information, approximate location derived from your device or IP address, and information regarding your use of and interactions with our Services.

You are generally not legally required to provide Personal Data to Notch. However, certain information may be necessary for us to provide the Services, respond to your requests, or enter into or perform a contract with you or your organization. 

‍

2. HOW DO WE COLLECT PERSONAL DATA?

Summary: We collect Personal Data directly from you, through your use of our website and Services, and from our customers and other third parties.

We collect Personal Data directly from you when you contact us, request information or support, register interest in our Services, enter into an agreement with us, or otherwise interact with us.

We also collect certain Personal Data automatically through your use of our website and Services, including technical and usage information. We may use cookies and similar technologies for this purpose, as described below.

Where we act as a processor, we also receive and process Personal Data provided by our customers or generated through use of the Services on their behalf.

‍

3. WHAT ARE THE PURPOSES OF PERSONAL DATA WE COLLECT?

Summary: We use Personal Data to provide and improve our Services, operate our business, communicate with you, maintain security, and comply with legal obligations.

We will use Personal Data to provide and improve our services to our customers and others and meet our contractual, ethical and legal obligations. All Personal Data will remain accurate complete and relevant for the stated purposes for which it was processed, including for example:

Processing which is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract:

• Carrying out our obligations arising from any contracts entered into between you or your employer or organization and Notch or Notch’s customers and/or any contracts entered into with Notch and to provide you with the information, products, support and services that you request from Notch and its customers;
• Verifying and carrying out financial transactions in relation to payments you make in connection with the Services.

Processing which is necessary for the purposes of the legitimate interests pursued by Notch or by a third party of providing an efficient and wide-ranging service to customers:

• Notifying you about changes to our service;
• Contacting you to give you commercial and marketing information about events or promotions or additional services offered by Notch which may be of interest to you, including in other locations;
• Soliciting feedback in connection with the services;
• Tracking use of Notch Services to analyze, maintain and improve them;
• For security purposes and to identify and authenticate your access to the Services.

Processing which is necessary for compliance with a legal obligation to which Notch is subject:

• Compliance and audit purposes, such as meeting our reporting obligations in our various jurisdictions, anti-money laundering, and for crime prevention and prosecution in so far as it relates to our staff, customers, facilities etc;
• If necessary, we will use Personal Data to enforce our terms, policies and legal agreements, to comply with court orders and warrants and assist law enforcement agencies as required by law, to collect debts, to prevent fraud, infringements, identity thefts and any other service misuse, and to take any action in any legal dispute and proceeding;

We aggregate and de-identify Personal Data (i.e., use your data in a way which no longer allows to identify you) to analyze and improve our Services, and to conduct research, and for other similar purposes. We may share non-personal aggregated information with third parties, as described below. 

Our Services use artificial intelligence technologies, including third-party AI and large language model providers. Where we process Personal Data through the Services on behalf of a customer, we do so as a processor and in accordance with the customer’s instructions and our agreement with that customer. We do not use Customer Personal Data to train general-purpose AI models, unless otherwise agreed with the customer.

‍

4. SHARING DATA WITH THIRD PARTIES

Summary: We share Personal Data with service providers and other third parties where necessary to provide our Services, operate our business, or comply with legal obligations.

We may share Personal Data with third-party service providers that assist us in providing the Services and operating our business. These may include providers of cloud hosting and databases, analytics, AI and machine learning services, customer support, document management, CRM, security and backup, project management and other business and professional services.

We endeavor to provide such service providers with Personal Data only to the extent necessary for their functions and, where appropriate, enter into agreements governing their processing of Personal Data on our behalf.

We may also disclose Personal Data to our affiliates and business partners where necessary for the purposes described in this Privacy Policy; in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business or assets; where required by law, regulation, legal process or governmental request; or where necessary to enforce our agreements or protect the rights, property or safety of Notch, our customers or others, including for fraud prevention and cybersecurity purposes.

‍

5. WHERE DO WE STORE YOUR DATA?

Summary: We store Personal Data using our systems and third-party cloud service providers.

We store your Personal Data in databases owned or controlled by us, or processed by third parties on our behalf, by reputable cloud-service providers (see the following section regarding international transfers).

‍

6. INTERNATIONAL DATA TRANSFERS

Summary: We may transfer Personal Data internationally using appropriate safeguards where required by law.

Personal Data may be transferred to and processed in countries outside the country in which it was collected. Where required by applicable law, we implement appropriate safeguards for such transfers. For transfers of Personal Data from the EEA, these may include adequacy decisions, the EU-U.S. Data Privacy Framework (where applicable), or the European Commission’s Standard Contractual Clauses. For transfers from the UK, we use applicable UK transfer mechanisms, where required.

We may transfer your Personal Data outside of the EEA to provide and support our Services, operate our business, comply with legal obligations and serve customers across multiple jurisdictions.

‍

7. DATA RETENTION

Summary: We retain Personal Data for as long as reasonably necessary for the purposes for which it was collected and as required by law or contract.

Notch retains Personal Data for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, comply with applicable legal and contractual obligations, resolve disputes, and enforce our agreements. Where we process Personal Data on behalf of a customer, retention is governed by our agreement with and instructions from that customer.

‍

8. SERVICES AND WEBSITE DATA COLLECTION AND COOKIES

Summary: We use cookies and similar technologies for website functionality, analytics and other purposes, subject to consent where required.

Notch uses cookies, pixels and similar technologies (“Cookies”) to distinguish users, operate our website and Services, understand their use and performance, and, where applicable, for advertising and similar purposes. Cookies may be placed by Notch or by third parties and may remain on your device for the duration of a browsing session or for a longer period.

We use different categories of Cookies, including: (i) strictly necessary Cookies required to operate our website and provide requested functionality; (ii) analytics Cookies used to understand website performance and usage; and (iii) advertising and other Cookies used for advertising and similar purposes.

Where required by applicable law, we obtain your consent before using non-essential Cookies, including certain analytics and advertising technologies. You may manage your preferences through our cookie management tool or browser settings. Blocking certain Cookies may affect the functionality of our website or Services.

‍

9. SECURITY AND STORAGE OF INFORMATION

Summary: We maintain technical and organizational measures designed to protect Personal Data and respond appropriately to security incidents.

We take great care in implementing, enforcing and maintaining the security of the Personal Data we process. Notch implements, enforces and maintains security measures, technologies and policies to prevent the unauthorized or accidental access to or destruction, loss, modification, use or disclosure of Personal Data. We likewise take steps to monitor compliance of such policies on an ongoing basis. Where we deem it necessary in light of the nature of the data in question and the risks to data subjects, we may encrypt data. Likewise, we take industry standard steps to ensure our website and services are safe.

Note however, that no data security measures are perfect or impenetrable, and we cannot guarantee that unauthorized access, leaks, viruses and other data security breaches will never occur.

Within Notch, we endeavor to limit access to Personal Data to those of our personnel who: (i) require access in order for Notch to fulfill its obligations, including also under its agreements, and as described in this Privacy Policy, and (ii) have been appropriately and periodically trained with respect to the requirements applicable to the processing, care and handling of the Personal Data, and (iii) are under confidentiality obligations as may be required under applicable law.

Notch maintains processes to respond to security incidents, take appropriate remedial measures, and provide notifications to authorities and affected individuals where required by applicable law.

‍

10. DATA SUBJECT RIGHTS

Summary: Depending on applicable law, you may have rights regarding your Personal Data, including rights to access, correct, delete, object to processing, and data portability.

Data subjects with respect to whose data GDPR, CCPA or other data protection or privacy laws apply, have rights under GDPR and local laws, including, in different circumstances, rights to data portability, rights to access data, rectify data, object to processing, and erase data. These rights are subject to the conditions, limitations and exceptions provided under applicable law. 

A data subject who wishes to modify, delete or retrieve their Personal Data, may do so by contacting us ([email protected]). Note that Notch may have to undertake a process to identify a data subject exercising their rights. Notch may keep details of such rights exercised for its own compliance and audit requirements. Where permitted by applicable law, we may retain information in an aggregated or de-identified form that no longer identifies an individual. Such information may continue to be used by Notch. 

Where we process Personal Data on behalf of a customer as its processor, requests relating to that Personal Data should generally be directed to the relevant customer. Where appropriate, we will assist our customers in responding to such requests in accordance with applicable law and our contractual obligations.

Data subjects in the EU, and in other locations have the right to lodge a complaint, with a data protection supervisory authority in the place of their habitual residence. If the supervisory authority fails to deal with a complaint, you may have the right to an effective judicial remedy.

‍

11. US STATE PRIVACY RIGHTS

Summary: US residents may have additional privacy rights under applicable state laws, including rights to access, correct, delete, obtain or opt out of certain uses of their Personal Data.

If you reside in a US state with an applicable comprehensive privacy law, you may have additional rights regarding your Personal Data, subject to applicable exceptions. Depending on your state, these may include rights to access, correct, delete or obtain a copy of your Personal Data, and to opt out of certain processing, including the sale of Personal Data, targeted advertising or certain profiling.

Notch does not sell Personal Data for monetary consideration.

You may exercise applicable privacy rights by contacting us at [email protected]. We may take reasonable steps to verify your identity. Where required by applicable law, you may also appeal our decision regarding a privacy request by contacting us at the same address. We will not discriminate against you for exercising your privacy rights.

Where we process Personal Data solely on behalf of a customer, Notch acts as a processor or service provider. In such cases, requests concerning that Personal Data should generally be directed to the relevant customer.

‍

12. GENERAL

Summary: This section addresses minors, updates to this Privacy Policy, and how to contact us about privacy matters.

Minors. Our website and Services are not directed to children, and we do not knowingly collect Personal Data directly from children through our website. Where our customers use the Services to process Personal Data relating to minors, we process such data on behalf of and under the instructions of the relevant customer.

Changes to this Privacy Policy. The terms of this Privacy Policy will govern the use of the Services, website, and any information collected in connection with them. Notch may amend or update this Privacy Policy from time to time. The most current version of this Privacy Policy will be available on this page. Any changes will become effective as of the “Last Updated” date indicated below.

If you have any questions or concerns regarding this Privacy Policy or our privacy practices, please contact us using the details below.

Notch’s data protection officer (DPO) may be contacted at: [email protected]

Our article 27 GDPR EU Representative is MyEDPO Limited, available at [email protected].