Admin By Request (“us”, “we”, or “our”) operates the Admin By Request Zero Trust Platform, the www.adminbyrequest.com website, and related mobile applications (collectively the “Service”).

This Privacy Policy explains how and why we collect and process your data in connection with the use of our Service and describes your rights and choices under applicable data protection laws.

We use your personal data to operate, provide and maintain the Service, and where appropriate, to improve its functionality and security. By using our Service, you agree to the collection and processing of the data in accordance with this policy. Unless otherwise defined, the terms used in this Privacy Policy shall have the same meaning as set out in our Data Processing Agreement, available at https://www.adminbyrequest.com/en/data-processing-agreement.

Purpose and Legal Basis

We may use your data for various purposes:

• To provide, operate and maintain the Service
• To enable your use of interactive features of our Service upon your request
• To provide customer support and assistance
• To notify you of changes to our Service
• To provide analysis, insights and valuable information so that we can improve the Service
• To monitor the use and performance of the Service
• To detect, prevent and address technical issues

We process your personal data based on the following legal basis under Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”):

• GDPR Article 6(1)(a) – Where you have provided your consent
• GDPR Article 6(1)(b) – To the extent necessary to provide the Service
• GDPR Article 6(1)(f) – Pursuant to our legitimate interests

Categories of Data

We collect and process various types of data in connection with the Service, including personal data and non-personal data.

Personal Data

While using our Service, we may collect and process personal data, meaning information that can be used to identify or relate to an identified or identifiable natural person (personal data). Personal data may include, but is not limited to:

• Name and last name
• E-mail address
• Phone number
• Computer account name
• Cookies and Usage Data

Usage Data

We may also collect and process information on how the Service is accessed and used (“Usage Data”). This Usage Data may include information such as your computer’s internet protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

Tracking & Cookies Data

We use cookies and similar tracking technologies to operate and improve the Service, to analyze usage, and to store certain information.

Cookies are small files with limited amounts of data that are stored on your device when you visit a website. Cookies may include an anonymous unique identifier and are sent to your browser from a website and stored on your device. We also use similar tracking technologies such as beacons, tags, and scripts to collect and track information related to the use of our Service for analytics and related purposes.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, certain parts of the Service may not function as intended or may be unavailable.

Examples of Cookies we use:

• Session Cookies – to operate and maintain our Service during your session.
• Preference Cookies – to remember your preferences and settings.
• Security Cookies – to support and maintain the security of the Service.

Additional information on our use of Cookies is set out in our Cookie Policy, available at https://www.adminbyrequest.com/en/legal.

Storage of Data

Your data is stored in the geographic region associated with your location, unless you select a different region. You may select a different region when using the Services. Available regions include data centers located in:

• European Union and European Economic Area (“EU/EEA”)
  • EU Central (Germany)
  • EU West (Netherlands)
• United States
  • US East (Virginia)
  • US West (California)
• United Kingdom
  • London
• Asia-Pacific
  • Singapore

We store your data for 12 months by default. You can change the data retention period in your settings from a minimum of 3 months to a maximum of 5 years.

Transfer Of Data

Your information, including personal data, may be accessed by, transferred to, and maintained on, computers located outside of your state, province, country or other governmental jurisdiction where the data protection and privacy laws may differ from those in your own jurisdiction.

If you are located outside the EU/EEA and the United States, we transfer the data, including personal data, to the EU/EAA or the United States to process it there.

Your consent to this Privacy Policy, followed by your submission of such information, represents your agreement to that transfer.

Admin By Request will take all steps reasonably necessary to ensure that your data is handled securely and in accordance with this Privacy Policy, and that no transfer of your personal data will take place to an organization or a country unless there are appropriate safeguards and controls are in place to secure your information personal data.

Disclosure Of Data

Legal Requirements

We may, in good faith, disclose your personal data where such disclosure is required and permitted under applicable law, and is necessary to:

• Comply with legal obligations
• Protect and defend the rights or property of Admin By Request
• Prevent or investigate possible wrongdoings in connection with the Service
• Protect the personal safety of the users of our Service or the public
• Protect against legal liability

What are your Personal Data rights?

We want to ensure that you are aware of the rights you have in accordance with GDPR and other laws that may apply concerning the personal data we collect and process.

In accordance with GDPR, you’re entitled to the following rights:

• The right to access – You have the right to request confirmation of whether we process your personal data and, if we do, to request access to that data, primarily in the form of a copy of the data we hold about you
• The right to rectification – You have the right to request that your personal data shall be corrected if it is inaccurate
• The right to erasure – You have the right to request erasure of parts of – or all – of your personal data, also known as the right to be forgotten. However, this is only possible under certain conditions
• The right to restrict processing – You have the right to request that we restrict the processing of your personal data. However, this is only possible under certain conditions
• The right to object to processing – You have the right to object to our processing of your personal data. However, this is only possible under certain conditions
• The right to data portability – You have the right to request that we transfer certain data you have provided to us to another organization, or directly to you, in a structured, commonly used and machine-readable format, where technically feasible

Security Of Data

The security of your data is of utmost importance to us, but no method of transmission over the internet, or method of electronic storage is 100% secure. Therefore, while we use commercially acceptable measures, aligned with recognized information security and privacy standards to protect your personal data, we cannot guarantee its absolute security.

Admin By Request app for Slack

(Applicable if you integrate Admin By Request with Slack)

How does the ABR app for Slack collect your personal data?

The Admin By Request app for Slack uses your Admin By Request API Key to connect and collect data. It does only collect personal data to the extent necessary to fulfill its purpose (which is described further at https://www.adminbyrequest.com/en/docs/slack).

The personal data is collected from the data already existing in Admin By Request. However, one value is fetched from Slack solely for identification purposes in case a user should open a support ticket with us regarding the use of the Admin By Request app for Slack.

Which data does the ABR app for Slack store?

Usage of the Admin By Request app for Slack stores the following information:

• Team Id
• Team Name
• Channel Id
• Channel Name
• Access token
• Incoming webhook UR

Furthermore, approving or denying a request via Slack will store the username of the user performing the action.

How long does the ABR app for Slack store my data?

• Data is stored until the ABR app for Slack is uninstalled.

How does the Admin By Request app for Slack manage your personal data?

• The ABR SlackApp is managed under the same strict technical, organizational and contractual measures as any data managed as a part of Admin By Request. Furthermore, the data processing in the Admin By Request app for Slack is subject to the same regulatory requirements as the data processed in Admin By Request.

How does the Admin By Request app for Slack store your personal data?

• The Admin By Request app for Slack uses Microsoft Azure SQL to store your data in the same region and data centers as we use already for your Admin By Request tenant.

How do I request access to or deletion of my personal data?

• All users have the right to request access to and deletion of their individual data. To make a request, please do so by creating a support ticket in the Admin By Request portal or at https://www.adminbyrequest.com/support. We will respond to your request in a timely manner in accordance with applicable law. Please note that in certain circumstances, we may not be able to fully comply with your request, such as if it is prohibited by law or if it conflicts with our legitimate interests as a business.

Service Providers

We may use third-party companies and individuals to facilitate our Service (“Service Providers”) to provide the Service on our behalf, to perform Service-related services, or to assist us in analyzing how our Service is used.

These third-parties are granted access to your personal data solely as necessary to perform services on our behalf and are contractually obligated to process your data in accordance with our instructions and applicable data protection and privacy laws.

Analytics

We may engage third-party Service Providers to monitor and analyze the use of our Service.

Google Analytics

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network. You can opt-out of having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visits activity. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en

Chatbot

We may engage third-party Service Providers to provide and operate our website’s chatbot functionality.

Zoho SalesIQ

We offer a chatbot experience on our website (the “Chatbot”), powered by Zoho SalesIQ. The Chatbot is operated by our authorized regional sales partners based on the region you connect from.

When you use the Chatbot, the information you submit in the chat (including any personal data you choose to provide) and, where relevant, any contact details requested during the conversation are processed by the relevant regional sales partner to respond to your enquiry and follow up with you, and may be retained in the partner’s systems for the purpose of responding to and managing your request.

Using the Chatbot requires your prior consent and acknowledgement of this Privacy Policy. For more information on the privacy practices of Zoho SalesIQ, please visit: https://www.zoho.com/privacy.html.

Links To Other Sites

Our Service may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services

Children’s Privacy

Our Service does not address anyone under the age of 18 (“Children”).

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your Children has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers

Changes to our Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Information of our Data Protection Office

If you have any questions about this Privacy Policy, please contact our DPO via the following e-mail address: dpo@adminbyrequest.com.

How to Contact the Appropriate Authority

Should you wish to report a complaint if you believe that Admin By Request has not addressed your concern in a satisfactory manner, or if Admin By Request have not acted in a lawful manner in regard to a request concerning your Personal Data Rights, you may contact the Danish Data Protection Agency (“Datatilsynet”), at the following website: https://www.datatilsynet.dk/english.