Ora Privacy Policy
This Privacy Policy describes how Ora collects, uses and discloses information, and what choices you have with respect to the information. To make the Privacy Policy clearer and more understandable we organized it in sections and defined and capitalized a few terms for simplicity and clarity.
When we refer to “Ora”, “we”, “us”, we mean the Ora entity that acts as the controller or processor of your information, as explained in more detail in the “Identifying the Data Controller and Processor” section below. Ora offers collaborative tools, including our web, desktop, and mobile products, which help you stay organized and communicate with others. We also own and operate a number of websites and offer related services, like support. We refer to all of these products, together with our other services and websites as “Services” in this policy.
Table of Contents
Identifying The Data Controller And Processor
Ora is a service provided to you by ORA PM Ltd. Data protection law in certain jurisdictions differentiates between the “controller” and “processor” of information. In general, Customer is the controller of Customer Data. In general, Ora is the processor of Customer Data and the controller of User Content and Account Information. Ora PM Ltd. is the controller of User Content and Account Information and a processor of Customer Data relating to Authorized Users who use Projects and Organizations established for Customers.
Ora PM, OOD.
1700 Osmi Dekemvri 1
Sofia, Bulgaria
TAX ID / VAT: BG204927003
What information we collect about you
In order to provide you with the Services we collect both Personally Identifiable Information and Non-Personally identifiable information in 2 ways — either information provided by you or collected automatically when you use the Services.
INFORMATION YOU PROVIDE TO US
- Account Information — We collect information about you when you register for an account, create or modify your profile, set preferences, sign-up for or make purchases through the Services. You also have the option of adding a profile photo, bio, and other details to your profile information to be displayed in our Services. We keep track of your preferences when you select settings within the Services.
- User Content — Any content that you post, send, receive and share. This content includes any information about you that you may choose to include. Content also includes the files and links you upload to the Services. Example of such content is projects, tasks, comments.
- Information on support tickets — The Services also includes customer support, where you may choose to submit information regarding a problem you are experiencing with a Services or a feature request. No matter which way you contact us you will be asked to provide contact information, a summary of the problem you are experiencing, and any other documentation, screenshots or information that would be helpful in resolving the issue.
- Payment Information — We collect certain payment and billing information when you register for certain paid Services. You might also provide payment information, such as payment card details, which we don't store ourselves but we collect via secure payment processing services.
INFORMATION WE COLLECT WHEN YOU USE THE SERVICES
- Your use of the Services — We keep track of certain information about you when you visit and interact with any of our Services. We do this to provide a better service to you. This information includes the features you use; the projects, tasks, organizations and other links you click on; frequently used search terms; and how you interact with others on the Services.
- Device and Connection Information — We collect information about your computer, phone, tablet, or other devices you use to access the Services. This device information includes your connection type and settings when you install, access, update or use our Services. We also collect information through your device about your operating system, browser type, IP address, URLs of referring/exit pages, device identifiers, and crash data. We use your IP address and/or country preference in order to approximate your location to provide you with a better Service experience.
- Cookies and Analytics — Ora and our third-party partners, such as our advertising and analytics partners (Google Analytics), use cookies and other tracking technologies to provide functionality and to recognize you across different Services and devices.
INFORMATION WE RECEIVE FROM OTHER USERS OR SERVICES
- Other Ora users — Other users of our Services may provide information about you when they mention you in a project or invite you to join a project or organization. For example, if a user invites you to join a project he/she will provide us with your email so that we can send an automatic email invite. Users can also mention you in a project or task that you are a member of.
- Services you or an administrator links — We receive information about you when you link a third-party service or integration to Ora. For example, if you link or signup with your Google/GitHub account we will use that to collect your name, email and profile picture. We receive different information from different integrations but the purpose remains the same, to provide you with a good service and enable features that boost your productivity. The information we receive when you link or integrate our Services with a third-party service depends on the settings, permissions and privacy policy controlled by that third-party service. You should always check the privacy settings and notices in these third-party services to understand what data may be disclosed to us or shared with our Services.
How do we use the information we collect
- To provide the Services to you — We use information about you to provide the Services to you, to authenticate you when you log in, provide customer support, and operate and maintain the Services. For example, we use the name and picture you provide in your account to identify you to other Ora users.
- To provide, update, maintain and protect our Services and business — This includes the use of Profile Information and User Content to support delivery of the Services, prevent or address service errors, security or technical issues, analyze and monitor usage, trends and other activities or at an Authorized User’s request.
- As required by applicable law, legal process or regulation
- To communicate with you by responding to your requests, comments and questions — If you contact us, we may use information about you to respond.
- To protect our legitimate business interests and legal rights — Where required by law or where we believe it is necessary to protect our legal rights, interests and the interests of others, we use information about you in connection with legal claims, compliance, regulatory, and audit functions, and disclosures in connection with the acquisition, merger or sale of a business.
- With your consent — We use information about you where you have given us consent to do so for a specific purpose not listed above. For example, we may publish testimonials or featured customer stories to promote the Services, with your permission.
- To send emails and other communications — We may send you service, technical and other administrative emails, messages and other types of communications. We may also contact you to inform you about changes in our Services, our Services offerings, and important Services-related notices, such as security and fraud notices. These communications are considered part of the Services and you may not opt out of them. In addition, we sometimes send emails about new product features, promotional communications or other news about Ora. These are marketing messages so you can control whether you receive them.
- For billing, account management, and other administrative matters — Ora may need to contact you for invoicing, account management and similar reasons and we use account data to administer accounts and keep track of billing and payments.
- To investigate and help prevent security issues and abuse
- Legal bases for processing (for EEA users) — If you are an individual in the European Economic Area (EEA), we collect and process information about you only where we have legal bases for doing so under applicable EU laws. The legal bases depend on the Services you use and how you use them. This means we collect and use your information only when:
- We need it to provide you the Services, including to operate the Services, provide customer support and personalized features and to protect the safety and security of the Services;
- It satisfies a legitimate interest (which is not overridden by your data protection interests), such as for research and development, to market and promote the Services and to protect our legal rights and interests;
- You give us consent to do so for a specific purpose; or
- We need to process your data to comply with a legal obligation.
How We Share And Disclose Information
This section describes how Ora may share your information. Users determine their own policies and practices for the sharing and disclosure of Information, and Ora does not control how they or any other third parties choose to share or disclose Information.
- User's instructions — Ora will solely share and disclose User Content and Account Information in accordance with a User's instructions, including any applicable terms in the Terms of Use functionality, and in compliance with applicable law and legal process.
- Displaying the Services — When an Authorized User submits User Content or Account Information, it may be displayed to other Authorized Users in the same or connected Project or Organization. For example, an Authorized User’s email address may be displayed with their Profile to other authorized users from the same project or organization.
- Collaborating with Others — The Services provide different ways for Authorized Users working in Private/Public or Secret Projects to collaborate. If a project is Public, User Content and Some Profile Information can be seen publicly by Others. Publicly visible Profile information includes Profile picture username and name but does NOT include your email.
- Third Party Service Providers and Partners — We may engage third party companies or individuals as service providers or business partners to process Profile Information and support our business. These third parties may, for example, provide virtual computing and storage services. See Sub-processors for a list of sub-processors we use to provide you with our services.
- Third Party Services — You or an Administrator may enable or permit Authorized Users to enable Third Party Services. When enabled, Ora may share Personal Information or User Content with Third Party Services. Third Party Services are not owned or controlled by Ora and third parties that have been granted access to Personal Information or/and User Content may have their own policies and practices for its collection and use. Please check the privacy settings and notices in these Third Party Services or contact the provider for any questions.
- Aggregated or De-identified Data — We may disclose or use aggregated or de-identified Other Information for any purpose. For example, we may share aggregated or de-identified Usage Information with prospects or partners for business or research purposes.
- To enforce our rights, prevent fraud, and for safety — * To protect and defend the rights, property or safety of Ora or third parties, including enforcing contracts or policies, or in connection with investigating and preventing fraud or security issues.
- With Consent — Ora may share Information with third parties when we have consent to do so.
Data Retention
We will retain your User Content, Account Information in accordance with your instructions, including any applicable terms in Terms of Service and as required by applicable law. Deletion of User Content, Account and profile information is entirely under your control and covered in more details in Your Rights section below.
- Account information — We retain your account information until you delete your account. We also retain some of your information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations and to continue to develop and improve our Services. Where we retain information for Service improvement and development, we take steps to eliminate information that directly identifies you, and we only use the information to uncover collective insights about the use of our Services, not to specifically analyze personal characteristics about you.
- User Content — If your account is deleted, some of your information and the content you have provided may remain in order to allow your team members or other users to make full use of the Services. For example, we continue to display comments and content you provided to projects or tasks but we change your name with “Deleted Account”. Based on your role in a project or organization we choose whether to delete this project or organization with your account. For your convenience, the project and organizations that will be deleted/not deleted are presented to you one step before you delete your account. For example, if you are the only admin the project will be deleted. If there are other admins the project will not be deleted. If you are the only member the project will deleted and so on...
Your Rights
You have the right to request a copy of your information, to object to our use of your information (including for marketing purposes), to request the deletion or restriction of your information, or to request your information in a structured, electronic format. Below, we describe the tools and processes for making these requests.
- Access and update your information — Ora gives you the ability to update and change your information. For example, you can edit all personal information on your profile page under account settings. You can also edit, change or delete any User Content if you have the necessary member rights.
- Leave a project or organization — you or an administrator can deactivate your access to a project or organization. This can be done in the project or organization settings > members.
- Delete your information — You can delete User Content such as tasks and projects if you have the necessary rights you may also delete your account. Please note, however, that we may need to retain certain information for record keeping purposes, to complete transactions or to comply with our legal obligations. For example, we may need to keep invoices and support ticket conversations we had with you.
- Request that we stop using your information — In some cases, you may ask us to stop accessing, storing, using and otherwise processing your information where you believe we don't have the appropriate rights to do so. For example, if you believe a Services account was created for you without your permission or you are no longer an active user, you can request that we delete your account.
- Opt out of communications — You may opt out of receiving promotional communications from us by using the unsubscribe link within each email, updating your email preferences within your Service account notifications settings menu, or by contacting us as provided below to have your contact information removed from our promotional email list or registration database. Even after you opt out from receiving promotional messages from us, you will continue to receive transactional messages from us regarding our Services. You can opt out of some notification messages in your account settings.
- Turn off Cookie Controls — We use cookies for Google Analytics and log-in information. To opt-out of our use of cookies, you can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from websites you visit. If you do not accept cookies, however, you may not be able to use all aspects of our Services.
- Do Not Track — Some browsers have incorporated "Do Not Track" (DNT) features that can send a signal to the websites you visit indicating you do not wish to be tracked. Because there is not yet a common understanding of how to interpret the DNT signal, our Services do not currently respond to browser DNT signals. You can use the range of other tools we provide to control data collection and use, including the ability to opt out of receiving marketing from us as described above.
- Data portability — Data portability is the ability to obtain some of your information in a format you can move from one service provider to another. Depending on the context, this applies to some of your information, but not to all of your information. Should you request it, we will provide you with an electronic file of your basic account information and the information you create on the spaces under your sole control, like your own projects. You can also use the export CSV, TEXT of timers and timers to export data out of Ora.
Age Limitations
The Services are not directed to individuals under 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information. If you become aware that a child has provided us with personal information, please contact our support services.
International data transfers
We use data hosting service providers in the United States to host the information we collect, and we use technical measures to secure your data. While we implement safeguards designed to protect your information, no security system is impenetrable and due to the inherent nature of the Internet, we cannot guarantee that data, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others. You are responsible for keeping the password you use for accessing our Services confidential; we will not ask you for your password (except when you log in to our website, change your password, or performing an irreversible operation like deleting your account.).
Security
Ora takes the security of data very seriously. We work hard to protect Account Information and User Content you provide from loss, misuse, and unauthorized access or disclosure. These steps take into account the sensitivity of the Personal Information and User Content we collect, process and store, and the current state of technology. Read our security policy for more details.
Changes
We may change this Privacy Policy from time to time to reflect changes to our privacy practices for our Services. The revised Privacy Policy will be effective as of the published Effective Date. If we make a material change to the Privacy Policy, we will notify you by posting notice of the change on the Services. We also may notify you of the change using email or other means.
If you have general questions about our Privacy Policy and practices or questions about your Personal Data, you may contact us. Users in the European Economic Area (EEA) and Switzerland have the right to lodge a complaint with the Supervisory Authority for data protection in their country, should they find that we did not appropriately address their question or concern contact us.
Data Protection Officer
To communicate with our Data Protection Officer, please email dpo@ora.pm