Privacy en cookiestatement

Oribi Groep B.V. ('Oribi' or 'we') operates the website http://www.oribi.nl . As part of the IT services we provide, we
process personal data. This Privacy and Cookie Statement explains which personal data we process, for what
purposes, and how we handle them. The following legal entities fall under Oribi and are covered by this
statement:

Entity Trade name Chamber of Commerce number Registered office address
Oribi Software B.V. Oribi Identity 17252317 Schijfstraat 8 Unit 2.05
5061 KB in Oisterwijk
JanusID Services B.V. Oribi Identity Mobile 84772840 Schijfstraat 8 Unit 2.05
5061 KB in Oisterwijk
Compu Act Software B.V. Oribi Compliance 60412763 De Klugt 8
2141 AS in Vijfhuizen
SmartAIM Nederland B.V. Oribi Access 54687969 Meidoornkade 22
3992 AE in Houten
CertWell B.V. Oribi Compliance
Qualifications
51501856 Schijfstraat 8 Unit 2.05
5061 KB in Oisterwijk

Your privacy is very important to us. We comply with the General Data Protection Regulation (GDPR). This means
that we:
Clearly state our purposes through this Privacy and Cookie Statement, before processing your personal
data.
Store as little personal data as possible and only what is necessary.
Request explicit consent when required.
Apply appropriate security measures and require the same from our processors.
Respect your rights, including your right to access, correction, and deletion.

We may collect various types of personal data from you. Below, we explain for each purpose which data we
collect, why we collect it, and how long we retain it. If you have any questions or would like to know exactly which
data we hold about you, please contact us. Our details can be found at the end of this statement.

Organizations can use our IT services.
To deliver these services, we process the following personal data:
First and last name of the contact person
Organization name (optional)
(Business) telephone number
(Business) email address
Business address
Payment details
Invoice details
Any correspondence content
We process this data based on our legitimate interest in performing the contract with your organization and
maintaining the resulting business relationship with the contact persons. We retain the data for the duration of
the agreement and up to two years afterward in our CRM system. Certain data may be retained longer if required
by law (for example, the seven-year tax retention period).

We provide in-house training sessions and workshops through the Oribi Academy.
To organize and deliver these training sessions and workshops, we process the following personal data.
First and last name of participant
Organization name (optional)
(Business) telephone number
(Business) email address
Business address and location
(Business) billing details
(Business) payment details
Job title and background of participant(s)
Purchase order/reference number
Any correspondence content
When your employer books an in-house training session, we process your data on the basis of our legitimate
interest in fulfilling the contract with your employer. We retain this data until the training or workshop has been
completed and payment has been received. Some data may be retained longer if legally required (for example,
due to the seven-year fiscal retention period).

When you become a customer of Oribi (for example, by registering for a training or workshop), you gain access
to our online learning environment, where we will provide you with an account.
To set up your account, we process the following personal data.
First and last name
Date of birth
Email address
Password
Your account data will be retained only as long as necessary to provide access to the online environment,
calculated from the start of your training or workshop.

The mobile application Oribi ShowID functions as a personal identity vault, allowing employees to securely store
and manage identity documents, diplomas, certificates, and access credentials. The employer sends an
activation link to the employee.
To activate the account, we process the following personal data:
First and last name
Email address
Date of birth
These account details are processed based on your consent. We retain this data for as long as the service is
used or as required by applicable law.

When uploading documents to Oribi ShowID, you will be asked to provide certain personal details.
We process the following types of data:
Personal information
First and last name
Gender
Date and place of birth
Privacy and Cookie Statement Oribi 5
Nationality
Personal identification number
Residence permit details (if applicable)
Identification document details
Type of identification document
Document number
Date of issue and expiry data
Issuing authority
Signature
Image on the front and back of the identification document
Chip data
Public NFC chip data
Biometric verification data
Passport photo (analog or chip)
Selfie
Verification results
Verification date and time
Other (optional or additional) data
Images of other personal documents uploaded by user
Email address invitee
Metadata such as verification time, type of document, session ID, client reference, IP address, device
information
We process these data based on your consent. If you withdraw your consent or no longer use the service, the
data will be deleted. Some data may be retained longer if required by law.

The Oribi SmartID application automates identity and access management within organizations. SmartAIM reads
identity information from HR systems such as AFAS or Youforce and manages the creation, modification, and
revocation of accounts and authorizations in connected target systems such as AD, Entra, or HiX. Thanks to its
modular design and powerful RBAC/ABAC structure, Oribi SmartID ensures control, transparency, and
compliance with laws and regulations.
To create, manage, and enable access through Oribi SmartID, we process at least the following personal data:
Employer
First and last name
(Business) email address
(Business) telephone number
Privacy and Cookie Statement Oribi 6
Date of birth
User role
Organizational unit
These data are processed on the basis of performance of a contract. They are retained for up to two years after
the end of the employment agreement.

The mobile app Oribi MobileID helps organizations verify identities reliably. The app allows users to scan an
identification document, verify authenticity via NFC, and – if desired – perform a facial comparison. The results
are instantly displayed in the user’s own system or in the Oribi MobileID portal.
To activate the account, we process the following personal data:
First and last name
Email address
Date of birth
Account information
Usage information
Organization details
These data are processed on the basis of performance of a contract and retained for as long as the account
remains active.

To secure and monitor Oribi MobileID accounts, we process:
IP addresses
User IDs
Session information
Audit logs
Browser information
These data are processed on the basis of legitimate interest and are retained for up to 90 days, unless required
longer for incident investigation.

To manage contracts and billing for Oribi MobileID, we process:
Email address
Business payment details
Privacy and Cookie Statement Oribi 7
Organization details
These data are processed on the basis of performance of a contract and retained for seven years.

To perform product analytics and assess usage statistics, we process:
IP addresses
User IDs
Session information
Audit logs
Account details
Email address
Telephone number
Usage data
These data are processed on the basis of performance of a contract and retained as long as the account
remains active.

Oribi GuestID is a visitor management platform that automates the entire registration process—from check-in to
check-out—ensuring a secure and professional reception experience.
To enable the use of Oribi GuestID, we process the following personal data:
Gender
Initials
First name
Prefix(es)
Last name
Company
Job title
Email address
Telephone number
Mobile telephone number
License plate number
Photo
Data of birth
Place of birth

Employee number
Street name
House number
Postcal code
City
Nationality
Identification document
Type of identification document
Passport number
These data are processed on the basis of performance of a contract. We retain them for as long as the service is
used or as required by law.

The C-Register system enables organizations to quickly and securely verify whether employees hold the
required certifications.
To create and manage user accounts within C-Register, we process:
First and last name
Email address
Telephone number
These data are processed on the basis of performance of a contract and retained for as long as the service is
used or as required by law.

Oribi CertifID is a qualification management system that helps organizations manage staff qualifications, ensure
compliance, and streamline certification processes.
To create and manage user accounts in Oribi CertifID, we process:
First and last name
Email address
IP address
These data are processed on the basis of performance of a contract and retained for up to 90 days after
account termination.

Oribi ExpertID is an identity verification platform that assists organizations in managing and validating identity
data. With the connected document reader, the user can easily scan an identification document, verify
Privacy and Cookie Statement Oribi 9
authenticity via NFC, and – if desired – perform a facial comparison. The results are instantly displayed on the
display of the document reader or can be later viewed in the portal.
To provide customer support within Oribi ExpertID, we process:
Identification data
Contact details
Account information
Usage data
Organization information
These data are processed on the basis of performance of a contract and retained as long as the account
remains active. Personal data obtained from identity documents are anonymized within 28 days.

To manage billing and contracts within Oribi ExpertID, we process:
Email address
Telephone number
Business payment details
Organization information
These data are processed on the basis of performance of a contract and retained for up to seven years.

Oribi ExpertID maintains logs for auditing, security, and incident analysis.
For this purpose, we process:
Username
System usage or error timestamps
Technical meta data like version number, error codes, and system Ids
These data are processed on the basis of legitimate interest and retained for up to six months.

Oribi WorkPassID is a digital platform that supports companies across sectors by providing a complete solution
for chain and workforce registration. This way it ensures safe, fair, and efficient operations.
To create and manage accounts and access permissions, we process:
Email address
Telephone number
Privacy and Cookie Statement Oribi 10
Name
IP address
These data are processed on the basis of performance of a contract and are retained for up to 12 months.

In certain cases, the Oribi WorkpassID app uses your device's location. We use this information for security
purposes, to determine whether you are present at the work site, as part of reliable workforce and supply chain
registration. The location data is processed solely locally on your device: it is not sent by the app to Oribi or third
parties, is not stored by us, and is not used for any other purposes such as tracking or profiling.
This processing is based on our legitimate interest (Article 6(1)(f) GDPR), namely the interest of secure and
accurate registration at the work site. You can withdraw location access for the app at any time via your phone's
settings. Please note that certain functionalities will then no longer be available.

You can contact our customer service with questions about our applications, products, or any other matters.
To handle your inquiry, we process the following personal data:
First and last name
Organization name
(Business) email address
(Business) telephone number
Your inquiry
We process these data based on your consent. Recorded phone calls are retained for three months, support
tickets for up to 12 months.

You can request additional information about a specific product.
To handle your request, we process the following personal data:
First and last name
Organization name
(Business) email address
(Business) telephone number
Areas of interest (optional)
Questions and/or comments (optional)
We process these data based on your consent and retain them until we believe your inquiry has been resolved,
or for a maximum of four weeks if we receive no response to our follow-up.

Through our website, you can sign up for a demo of our products.
To process your request, we process the following personal data:
First and last name
(Business) email address
(Business) telephone number
Questions and/or comments (optional)
We process these data based on your consent and retain them for up to two years in connection with any
quotation process resulting from the demo.

If you request a consultation about a specific product, we process your personal data to contact you regarding
our solutions.
To contact you, we process the following personal data:
First and last name
Organization name
(Business) email address
(Business) telephone number
Areas of interest (optional)
Questions and/or comments (optional)
These data are processed based on your consent and retained for two years following the request, to support
any quotation process that may arise.

Businesses and government organizations can request a quotation from us.
To prepare a quotation, we process the following personal data:
Organization name
Business details
Email address
Telephone number
Any additional information you provide during the quotation process
We process these data on the basis of performance of a contract and retain them for two years after the
request. Certain data may be retained longer if required by law (for example, the seven-year tax retention
period).

If you apply for one of our vacancies or submit an open application, we process your data to handle your
application and, where applicable, prepare an employment agreement.
We process the following personal data:
First and last name
Address and place of residence
Email address
Telephone number
Curriculum Vitae (CV)
Motivation letter
Photograph
Salary indication
References
Any additional information you include in your application
Your application data are retained for up to six weeks after the position is filled. We retain these data so we can
contact you if the position opens up again within the probation period. With your consent, we may retain your
data for one additional year to consider you for future opportunities. You can withdraw your consent at any
moment by sending us an email. If you are hired, your application data are stored in your personnel file and kept
as long as necessary, and for recruitment data up to two years after employment begins.
A social-media and internet screening may form part of the recruitment process. This is necessary in order to
ensure that, when hiring new staff, the suitability of candidates can be assessed and any risks to the
organisation and its customers can be limited. We do this on the basis of legitimate interest. To conduct this
review, we do a Google search on the candidate’s name and view any publicly available profiles on social media.
We will discuss the results of this review with the candidate. You may object to such screening at the time of
application.

You can subscribe to our quarterly Oribi Newsletter, containing updates about new products, developments, and
upcoming events.
To send this newsletter, we process the following personal data:
First and last name
Email address
These data are processed based on your consent and retained until you unsubscribe. You may withdraw your
consent at any time using the unsubscribe link in the email.

We use reCAPTCHA to prevent misuse of our contact forms.
When you confirm you’re not a robot, the following data is analyzed:
The speed at which the form is completed
Mouse movements while completing the form
The IP address of the person submitting the form
This helps determine whether a form is being submitted by a human or a bot. For more information, please
consult Google’s Privacy Policy.

Our website may display images or videos produced by Oribi or its business partners.
To display such material, we process the following personal data:
First and last name
Email address
Telephone number
Image or video material
Any information you voluntarily disclose in that material
We process these data based on your consent, which you may withdraw at any time by contacting us. We retain
these data until you withdraw your consent.

When you contact us by email or phone, you accept our offer to communicate.
To process your request, we process the following personal data:
First and last name
Business information (if applicable)
Email address
Telephone number
Social media account (if used for contact)
Any message content you provide
We process this based on the performance of a contract or consent and retain it for as long as necessary to
handle your inquiry, or up to two years after our last contact.

When you visit one of our offices, we register your personal data to manage the appointment.
When you visit one of our offices, we process the following personal data:
First and last name
Email address
Telephone number
Apointment details
We process this based on our legitimate interest in ensuring the security of our staff and visitors. We retain
these data in our digital calendar for up to two years.

We purchase products and services from various suppliers.
To manage orders, we process:
Company name
Business address
Contact person’s name
Email address
Telephone number
Financial details
Any other information you share with us
We process these data based on our legitimate interest in performing the contract with your organization and
retain them for the contract duration, or longer if required by law (for example, the seven-year fiscal retention).

Oribi shares your data only when permitted by law, for example when:
We engage another party to process data on our behalf;
We are legally obliged to share data (e.g., with law enforcement);
There is another valid legal ground for transfer.
Third parties processing your personal data on our behalf:
Type third party Receiving country Purpose transfer
IT service providers Netherlands Identity verification via document & selfie
Privacy and Cookie Statement Oribi 15
Luxembourg Data hosting in the cloud
Netherlands Data hosting in the cloud
Netherlands Technical maintenance and management of IT systems
France Sending and receiving of email communication
Netherlands Sending newsletters
Netherlands Hosting and managing website
Netherlands Managing customer data (CRM)
Payment service providers / debt
collectors
Netherlands Digital processing of work order
This Privacy and Cookie Statement applies only to Oribi’s services. We are not responsible for the privacy policies
of other websites linked from ours.

Some of our suppliers are located outside the European Economic Area (EEA). When sharing your personal data
with these parties, we take appropriate safeguards to protect your privacy.
The European Commission has adopted an adequacy decision for 15 countries. Based on an adequacy decision,
personal data can be transferred securely from the EEA to companies in these countries without the need for
additional data protection safeguards.
If we share data with companies in other countries without an adequacy decision (or American companies that
are not covered by the EU-US Data Privacy Framework), we take additional protective measures in the form of
so-called appropriate safeguards. This means that we take additional action to protect your personal data. We
use standard contractual clauses (‘SCCs’) for this purpose, among other things.
When we transfer your personal data to parties outside the EEA on the basis of SCCs, you have the following
rights:
Request information about the transfer, including a copy of the SCCs.
Contact both us and the receiving party for information.
Lodge complaints with the receiving party, the Data Protection Authority, a competent court in the EEA or
an independent dispute resolution body.
Claim compensation in the event of a breach of the SCCs.
These rights are in addition to your general privacy rights under the GDPR.

We use the lead generation service provided by Leadinfo B.V. (Rotterdam, Netherlands). This service recognises
business website visits based on IP addresses and shows us publicly available company information, such as
company name and address. Leadinfo places two first-party cookies that analyse visitor behaviour on our
website. Leadinfo also processes domains entered in forms (e.g. ‘http://company.com ’) to correlate IP
addresses with companies and improve its service.
We use Leadinfo to identify potential business leads and optimise our marketing and sales activities. The
processing is based on our legitimate interest (marketing). We have weighed up the interests involved and
concluded that the impact on visitors' privacy is limited. Leadinfo only identifies business website visits based on
IP addresses and links these to publicly available company information. Individual visitors are not directly
identified. In addition, an opt-out option is available.
More information about data processing is available at http://www.leadinfo.com . You can unsubscribe via this
page: https://www.leadinfo.com/en/opt-out . When you do so, your data will no longer be recorded by Leadinfo.

Our website includes social-media buttons that redirect you to the relevant platforms, allowing you to follow us
or share content. These buttons use code provided by the platforms themselves.
Please consult the privacy policies of the respective platforms:
Facebook (Privacy Policy)
X (Privacy Policy)
Instagram (Privacy Policy)
Pinterest (Privacy Policy)
YouTube (Privacy Policy)
LinkedIn (Privacy Policy)

Our website uses first-party and third-party cookies. Cookies are small data files stored or read from your device
(PC, tablet, smartphone) via your web browser. We use the following cookies:
Functional cookies
These cookies have a functional role within the website. They ensure the website properly functions, for
example by making sure the website is optimally displayed on your screen. These cookies don’t require consent.
Privacy and Cookie Statement Oribi 17
Analytical cookies
These cookies help make the website more user friendly. They provide insight into web usage, for example:
The amount of visitors
Popular pages
Average session duration
Used devices and browsers
This information helps us improve the website. We use these cookies in a privacy-friendly manner. When these
cookies process personal data, we ask your consent.
Marketing cookies
These cookies Allow us and our partners to show you personalized ads.
These cookies may collect data such as:
Display preferences
IP address
Cookie ID
Click and website behaviour
Referrer URL
In-app behaviour
Our advertising partners may combine this data with information from their own services, for example when you
are logged in with them.
We require your consent for these cookies. When you visit our website for the first time, we display a cookie
notification. In this notification, we ask for your consent to place marketing cookies (and, in some cases, certain
analytical cookies). You can still use our website if you do not consent to these cookies: only the functional
cookies will be placed. You can withdraw your consent at any time. For more information about exercising your
privacy rights, please refer to the section ‘What privacy rights do you have?’. The table below provides an
overview of the cookies we use.

Name Type(s) Cookies Retention period
Google Analytics Analytical _ga 2 years
Google Analytics Analytical _ga_H1WSLST0ML 2 years
Google Analytics Analytical _gat_gtag_UA_12056943_1 End of session
Google Analytics Analytical _gid 23 hours
Privacy and Cookie Statement Oribi 18
These cookies are placed by Google Analytics. These cookies give us a better understanding of visitor behaviour on the
website. This information is then used to improve the user experience on the website. This processing takes place in the
United States of America. Read here how Google handles your data: https://business.safety.google/
Vimeo Analytisch, Tracking vuid 2 years
These cookies are placed by http://vimeo.com and http://player.vimeo.com . They ensure that the videos can be played.
They also analyse the IDs of visitors.
Leadinfo Analytisch, Tracking _li_id 2 years
Leadinfo Analytisch, Tracking _li_ses End of session
Leadinfo places two cookies that only provides Oribi insights into the behaviour on the website. These cookies will not be
shared with other parties.
Vimeo (functional) Functional __cf_bm End of session
Vimeo (functional) Functional _cfuvid End of session
These functional cookies ensure that the Vimeo video player works.
YouTube Tracking VISITOR_INFO1_LIVE 6 months
YouTube Tracking VISITOR_PRIVACY_METADATA 6 months
YouTube Tracking YSC End of session
Managing cookies
In your web browser, you can set it to only accept the storage of cookies when you give your consent. For more
information on how to do this, please refer to your browser’s manual. Note: many websites may not function
properly if cookies are disabled.
Deleting cookies
Most cookies have an expiration date. When an expiration date is set, the cookie will be automatically deleted
once that date has passed. You can also choose to delete cookies manually before they expire. For instructions
on how to do this, please refer to your browser’s manual. Below you will find a link for each browser to the
provider’s website, where step-by-step instructions are provided on how to block or delete cookies.
Internet Explorer
Privacy and Cookie Statement Oribi 19
Google Chrome
Firefox
Edge
Safari

Oribi takes appropriate security measures to minimize misuse of and unauthorized access to your personal data.
We implement the following security measures:
We comply with the ISO 27001 standard for information security and are certified accordingly. This ensures
that your data are well protected.
Only authorized employees have access to personal data. Access is limited based on role and is reviewed
periodically.
All data traffic between our website and your browser is encrypted via HTTPS.
Data are stored in secure data centers with physical and digital access protection.
Strong passwords are mandatory and are changed regularly.
Access to personal data is logged and actively monitored to quickly detect unusual behavior.
Data are backed up regularly, and these backups are stored in encrypted form.
We regularly perform vulnerability scans and penetration tests to identify and resolve security risks.
Employees receive periodic training on data protection and information security.
We have a clear process in place to respond quickly and effectively to security incidents.
New features or systems are designed with privacy and security in mind by default.
We verify that our suppliers also implement adequate security measures.

Right of access: You have the right to access the personal data we process about you
Right to rectification: You have the right to correct or supplement your personal data if they are inaccurate
or incomplete.
Right to object: You can object to the processing of your personal data, including for direct marketing
purposes.
Right to erasure: You can request that we delete your personal data.
Right to withdraw consent: If you have given us consent to process your personal data, you can withdraw
this consent at any time.
Right to data portability: Where technically feasible, you have the right to have the personal data we
process about you transferred to a third party.
Right to restriction of processing: In certain cases, you can request that we temporarily or permanently
restrict the processing of your personal data.
Privacy and Cookie Statement Oribi 20
When you submit a request, we may ask you to identify yourself. We do so to ensure that the personal data
belong to the right person.
We will generally respond to your request within one month. However, this period may be extended by two
months for reasons related to the specific privacy rights involved or the complexity of your request. If we extend
this period, we will inform you in a timely manner.
If you wish to exercise any of your rights, please send a message to fg@oribi-groep.nl.

If our services change, we will need to update this privacy and cookie statement. Therefore, always check the
date at the top of this document and review regularly to see if new versions are available

If you have any questions, or if you wish to file a complaint about the use of your personal data, you can send an
email to privacy@oribi-groep.nl. We address all questions and complaints internally and will inform you of the
outcome. If you are not satisfied with how we have handled your concern, you may file a complaint with the
supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).