Privacy Statement OCAI.pro

1. Responsible organization

The data controller for the personal data to which this Privacy Statement relates is:

K&S KnowledgeLab BV
Trading under the name OCAI.pro
Bolderweg 2, building E, office 15
1332 AT Almere
Netherlands
Chamber of Commerce number: 60271477
VAT number: NL853837302B01
E-mail privacy: privacy@ocai.pro
General e-mail address: info@ocai.pro

For questions about this Privacy Statement, the processing of your personal data or the exercise of your privacy rights, you can contact us via privacy@ocai.pro.

2. Scope

This Privacy Statement applies, among other things, when you:

• visit OCAI.pro or an associated webpage;
• use the AI search function or the digital product advice;
• view, compare, select or order products;
• use a shopping cart, checkout or payment process;
• create or manage an account;
• contact our customer service;
• submit a return, complaint, warranty or withdrawal request;
• sign up for commercial or service communications;
• maintain business contact with OCAI.pro.

Links on OCAI.pro may lead to websites or services of other organizations. Their own privacy policy applies to the processing by those organizations. OCAI.pro is not responsible for the way independent third parties process personal data.

3. Key definitions

In this Privacy Statement we understand the following terms to mean:

• Personal data: any information about an identified or identifiable natural person.
• Processing: any operation with personal data, such as collecting, recording, organizing, consulting, using, disclosing, securing or deleting.
• Customer: the person who places an order, uses an account or enters into an agreement with OCAI.pro.
• User: any visitor or user of the website, AI functions or other OCAI services.
• AI functions: functions by which OCAI.pro analyzes questions, preferences and product information to compile selections, comparisons or recommendations.
• Supplier: an external party that supplies products, stock information, fulfilment, shipping or other services.

4. Which personal data do we process?

Which data we process depends on how you use OCAI.pro. We may process the following categories.

4.1 Identity and contact details

• first and last name;
• title and, where relevant, company name;
• email address and telephone number;
• billing address, delivery address, city and country;
• contact and communication preferences.

4.2 Account data

• account identification and login credentials in a secure form;
• account status, language and country settings;
• stored preferences, wish lists and shopping cart data;
• order history and account activities.

4.3 Order, product and transaction data

• ordered products, quantities and prices;
• order number, date, payment and order status;
• discounts, shipping costs, tax and invoice details;
• returns, cancellations, refunds and warranty claims;
• information necessary for fulfilment and delivery.

4.4 Payment data

Payments may be processed via a specialized payment service provider. OCAI.pro may process data such as the payment amount, chosen payment method, payment status, transaction identification and possibly limited account- or card-related data returned by the payment service provider.

Full card details or security codes are in principle processed directly by the payment service provider and are not stored by OCAI.pro.

4.5 Communication and customer service data

• emails, forms and other correspondence;
• questions, complaints, return and service requests;
• information you provide to customer service;
• internal records of handling and outcome.

4.6 AI search queries and preferences

• the search query or product need you enter;
• responses to additional choice or preference questions;
• budget, intended use and desired product characteristics;
• selected filters, comparisons and recommendations;
• feedback on the usefulness of recommendations.

Do not enter special categories of personal data, confidential business information, passwords, full payment details or other information in an AI search query that is not necessary for a product recommendation.

4.7 Technical and usage data

• IP address and approximate location based on the IP address;
• browser, device type, operating system and screen details;
• date, time, duration and technical details of a visit;
• requested pages, referring URL and interactions;
• cookie identifiers and session data;
• log, error, performance and security data.

4.8 Fraud and security data

• signals of unusual or potentially fraudulent use;
• failed login or payment attempts;
• technical indicators of abuse or attacks;
• information necessary to investigate incidents.

4.9 Business contact data

For suppliers, advisers and other business relationships we may process name, position, organization, business contact details, correspondence and contract information.

4.10 Special categories of personal data

OCAI.pro does not intend to collect special categories of personal data, such as health data, biometric data, religious beliefs or data about race or ethnic origin. Provide such data only when it is necessary, a valid legal basis exists and OCAI.pro has expressly requested it.

5. How do we obtain personal data?

We may obtain personal data:

• directly from you, for example when placing an order;
• through your use of our website and AI functions;
• from a person who places an order on your behalf;
• from payment, logistics and fulfilment partners;
• from suppliers who provide order or stock status;
• from technically generated log and security data;
• from public sources when lawful and necessary.

When you provide personal data of another person to us, for example for delivery of a gift, you are responsible for informing that person and ensuring the provision is lawful.

6. Purposes and legal bases

6.1 Performance of a contract

We process personal data in order to:

• display and make products and services available;
• enable a shopping cart and checkout;
• process orders, payments and refunds;
• deliver products and track orders;
• provide accounts and order overviews;
• handle returns, complaints and warranty requests;
• provide customer service and necessary communications.

6.2 Legal obligation

We process data when necessary to comply with tax, administrative, consumer law, accounting, supervisory or other legal obligations.

6.3 Legitimate interest

Where permitted, we process data based on our legitimate interests, including:

• securing the website, accounts and infrastructure;
• preventing and investigating fraud and abuse;
• improving performance and usability;
• managing and defending legal claims;
• business operations, quality control and internal reporting;
• improving product selection and service.

When processing is based on legitimate interest, we balance our interest against your interests, rights and freedoms.

6.4 Consent

Where consent is required, for example for certain cookies or electronic marketing, we request it in advance. You may withdraw given consent at any time. Withdrawal is not retroactive.

6.5 Protection of interests and legal claims

In exceptional situations data may be processed to protect vital interests or to establish, exercise or defend legal claims.

7. AI and automated processing

7.1 Purpose of the AI functions

OCAI.pro uses AI and automated analysis techniques to interpret product questions, ask additional questions, rank products, summarize product information and substantiate recommendations.

7.2 Processed information

For this purpose your search query, stated preferences, budget, intended use, selected options and available product, price, stock and supplier information may be processed.

7.3 Limitations of AI

An AI recommendation is supporting product information and not a guarantee that a product is suitable in every situation. AI may process incomplete, outdated or incorrect information. Always check the product description, price, availability, delivery time and terms before ordering.

7.4 No solely automated legal decisions

OCAI.pro does not make decisions based solely on automated processing from the described AI product advising that have legal effects for you or otherwise significantly affect you.

If in the future a process is introduced to which artikel 22 AVG applies, you will receive appropriate prior information, including information about human intervention and the possibility to contest the decision.

7.5 Improvement and quality control

Interactions may be used in limited form for quality control, security and improvement of the service, insofar as a valid basis exists. Where possible, data are minimized, aggregated or stripped of directly identifying characteristics.

8. Orders, payments and delivery

For the fulfilment of an order we process the data necessary for acceptance, payment, fulfilment, shipping, status communication, returns and customer service.

Necessary data may be shared with, among others:

• payment service providers for payment and refunds;
• suppliers for processing and fulfilment;
• carriers for delivery and tracking;
• communication services for transactional messages;
• fraud and security services when necessary.

These parties receive only the data reasonably necessary for their task and process it according to their role and applicable legal obligations.

9. Accounts and customer service

When you use an account, we process data to verify your identity, manage access, remember preferences, display orders and prevent abuse.

We ask you to use a strong and unique password and not to share login details with others. If you suspect abuse, contact us immediately.

Correspondence with customer service may be retained as long as necessary to handle the request, monitor quality, demonstrate agreements and comply with legal obligations.

10. Marketing and communication

OCAI.pro may send necessary service messages about accounts, orders, payments, security, changes and customer service. These messages are not commercial newsletters and may be necessary for the performance of the agreement.

Commercial email is only sent when there is a valid legal basis. You can unsubscribe via the opt-out option in the message or via info@ocai.pro.

Unsubscribing from marketing does not prevent us from sending necessary service or transactional messages.

11. Cookies and similar techniques

OCAI.pro may use cookies, local storage and similar techniques to make the website function technically, support security, remember settings, measure performance and — when permitted — analyze use.

11.1 Necessary techniques

Techniques that are strictly necessary for functionality, security, session management, shopping carts or the performance of a requested service may be used without prior consent insofar as the law permits.

11.2 Non-essential techniques

For analytical, personalization or marketing techniques that require consent, we ask for consent in advance. You can change or withdraw your choice later via the available cookie settings.

11.3 Browser settings

You can delete or block cookies via your browser. Disabling necessary cookies may cause parts of OCAI.pro to not function properly.

12. Sharing with suppliers and service providers

OCAI.pro does not sell your personal data as a standalone commercial product. Personal data may only be shared when necessary and lawful with categories of recipients such as:

• hosting, cloud, database and infrastructure providers;
• payment service providers and financial institutions;
• product suppliers, fulfilment parties and carriers;
• email, customer service and communication services;
• software, maintenance, monitoring and security parties;
• analytics and AI service providers insofar as used;
• accountants, lawyers, insurers and professional advisers;
• government agencies or supervisors when legally required;
• parties involved in a merger, acquisition or restructuring.

When a party processes personal data on behalf of OCAI.pro, we where required make agreements about purpose limitation, confidentiality, security, subprocessors, assistance with privacy rights and deletion after termination.

Some parties, including payment institutions, carriers or government agencies, may be independent data controllers for their own processing.

13. International data transfers

OCAI.pro aims to process personal data within the European Economic Area. For certain suppliers, technical services or international fulfilment, processing outside the European Economic Area may be necessary.

If personal data are transferred to a country for which no adequacy decision exists, we will where required ensure an appropriate transfer mechanism, such as standard contractual clauses adopted by the European Commission, supplemented with appropriate technical and organizational measures.

For international product delivery other legal rules may apply to name, address, contact, order and customs data. We limit disclosure to what is necessary for delivery and legal handling.

14. Retention periods

OCAI.pro does not retain personal data longer than necessary for the purpose for which they were collected, unless a legal retention obligation, dispute, investigation or legal claim makes a longer period necessary.

When determining a retention period, we consider:

• the duration of the customer or contractual relationship;
• the necessity for order, service and warranty;
• tax, financial and administrative retention obligations;
• fraud, security and incident investigations;
• statute of limitations and complaint periods;
• the sensitivity and volume of the data;
• the possibility to anonymize data.

Financial and administrative data may be retained for the applicable statutory retention period. Non-essential account, search and communication data are deleted or anonymized when the purpose expires.

Back-ups may still contain data for a limited additional period. These are secured and overwritten or deleted according to the applicable backup cycle.

15. Security

OCAI.pro takes appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration or unlawful disclosure. Which measures are appropriate is determined based on risk, nature of the processing, state of the art and implementation costs.

Measures may include, among others:

• encrypted connections for data transfer;
• access control and limitation according to necessity;
• management of accounts, roles and authorizations;
• logging, monitoring and investigation of security signals;
• patch, configuration and vulnerability management;
• secure development, test and change processes;
• backup, recovery and continuity measures;
• assessment of relevant suppliers and processors;
• incident and data breach procedures;
• data minimization and limitation of retention periods.

No digital environment can guarantee absolute security. If an incident occurs, we investigate it and take appropriate measures. When the GDPR requires it, we report a personal data breach to the Autoriteit Persoonsgegevens and inform affected individuals.

More information can be found in our Security Statement.

16. Minors

The services of OCAI.pro are not specifically directed at children under sixteen years of age. We do not intend to collect personal data of children without valid consent.

Parents and legal guardians are advised to be involved in the online activities of minors. If you suspect that we are processing a minor’s data unlawfully, please contact us via privacy@ocai.pro. We will investigate the request and delete data when necessary.

17. Your privacy rights

Depending on the circumstances, under the AVG you have the following rights:

17.1 Right to information and access

You can ask whether we process personal data about you and request an overview or copy of that data.

17.2 Right to rectification

You can have incorrect personal data corrected and incomplete data completed.

17.3 Right to erasure

You may under certain circumstances request deletion of personal data. This right is not unlimited, for example when data are necessary for a statutory retention obligation or legal claim.

17.4 Right to restriction

In certain cases you can request that processing be temporarily restricted, for example when you contest the accuracy.

17.5 Right to object

You can object on grounds relating to your particular situation to processing based on legitimate interest. You can always object to processing for direct marketing.

17.6 Right to data portability

When the legal conditions are met, you can receive data you have provided in a structured, commonly used and machine-readable form or have them transferred to another controller.

17.7 Withdraw consent

You may withdraw given consent at any time. The lawfulness of prior processing remains unaffected.

17.8 Automated decision-making

When artikel 22 AVG applies, you may among other things request human intervention, present your point of view and challenge the decision.

17.9 Submitting a request

Send your request to privacy@ocai.pro. Clearly state which right you wish to exercise and which data the request concerns.

We may request additional information to verify your identity. Do not send an unsolicited full copy of your identity document. When identification is necessary, we will indicate which secure and proportionate information is required.

We will in principle respond within one month. For complex requests or multiple simultaneous requests this period may be extended in accordance with the AVG. We will inform you in a timely manner.

A privacy request is in principle free of charge. For manifestly unfounded or excessive requests we may in accordance with the AVG charge a reasonable fee or refuse the request.

18. Complaints and supervision

If you have a complaint about the processing of your personal data, we ask that you first contact us via privacy@ocai.pro. We will attempt to handle your complaint carefully and promptly.

You also have the right to lodge a complaint with the competent supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

Autoriteit Persoonsgegevens
P.O. Box 93374
2509 AJ The Hague
Website: autoriteitpersoonsgegevens.nl

If you live in another member state of the European Union, you can also contact the supervisory authority in that member state.

19. Changes to this Privacy Statement

OCAI.pro may amend this Privacy Statement when services, law, technology or processing change. The most recent version will be published on this page. The revision date at the top indicates when the text was last updated.

For material changes we will inform you additionally where appropriate, for example via the website, your account or email.

20. Contact

For questions, comments, complaints or privacy requests you can contact:

K&S KnowledgeLab BV / OCAI.pro
Attention: Privacy
Bolderweg 2, building E, office 15
1332 AT Almere
Netherlands
E-mail: privacy@ocai.pro

See also our Terms and Conditions, Security Statement and information about returns.