Privacy Policy and Personal Data Processing

PRODUCTIVITY BASE TECHNOLOGIES LLC ("Oula"), a limited liability company organized under the laws of the State of Delaware, United States, with its address at 8 The Green, Suite B, Dover, DE 19901, United States, acts as the data controller for the personal data described in this policy.

This policy is issued in accordance with the data protection regulations applicable to Oula, including United States federal and state privacy laws and, where applicable based on the data subject's residence, the data protection rules of their jurisdiction. It also develops the data processing commitments already set out in Oula's Terms and Conditions of Use.

When Oula processes information contained in the mailboxes, channels or workspaces that a Client connects to the Platform, Oula acts as a data processor on that Client's behalf, and the Client remains the controller vis-à-vis the data subjects.

This policy applies to the processing of personal data carried out by Oula through its website, platform, applications, APIs, integrations, support channels, and contact and registration forms.

By registering, filling in a form, connecting an integration, electronically accepting the Terms, or using the Platform, you acknowledge this policy and authorize the processing of your personal data as described herein.

This policy complements the Terms and Conditions of Use. In the event of any discrepancy regarding the processing of personal data, this policy prevails.

For the purposes of this policy:

Oula processes only the data necessary for the purposes described in this policy. Depending on your relationship with Oula, we process the following categories:

Oula processes personal data for the following purposes:

• To manage the registration, activation and administration of accounts and users.
• To provide, operate, maintain and improve the Platform's features.
• To identify requests, incidents, tasks and commitments within the communications the Client connects, and to classify, summarize, prioritize, route and follow up on them.
• To respond to information requests, commercial contact, proposals and onboarding processes.
• To provide technical support and handle inquiries, requests and complaints.
• To send operational, service, security and billing communications.
• To send commercial communications about Oula, where authorized, with an opt-out mechanism in every message.
• To invoice, collect payment and manage the contractual relationship.
• To prevent fraud, abuse, misuse and unauthorized access, and to ensure the security of the Platform.
• To comply with legal obligations, requests from competent authorities and evidentiary retention duties.
• To produce aggregate analytics and internal statistics on Platform usage.

Oula will not use personal data for purposes other than those described here without obtaining a new authorization from the data subject, where one is required.

Processing is based, as applicable, on the data subject's prior, express and informed authorization, on performance of the contractual relationship, on compliance with legal obligations, or on Oula's legitimate interest in the security of the Platform.

Authorization may be granted by electronic means. As set out in the Terms, acceptance clicks, checkbox activation, onboarding flows, email confirmations and technical traces generated by Oula constitute valid evidence of the authorization granted.

In forms where authorization is mandatory, Oula keeps a record of the date and time it was granted. Authorization may be withdrawn at any time through the channels indicated in this policy, without retroactive effect and subject to any applicable legal retention obligations.

The Platform includes AI-assisted features. Where the consents granted allow it, Oula may automatically analyze the information available in the Platform to identify requests and commitments, classify and summarize communications, generate drafts and suggestions, and create or update follow-up records.

• We do not sell personal data or transfer it to data brokers.
• We do not use personal data for advertising or ad profiling.
• We do not use data obtained from integrations to train generalized, non-personalized artificial intelligence or machine learning models.
• We do not make automated decisions with legal effects on the data subject without human intervention.

AI-generated output is supporting guidance and may contain inaccuracies. Review and the final decision always rest with the Client and its users.

Oula may integrate with third-party services such as Gmail, Google Workspace, Outlook, Microsoft 365, Slack, WhatsApp and Jira, in order to enable the contracted productivity and follow-up features.

Integrations are activated only with the express authorization of the user or the Client's administrator, and are limited to the permissions, scopes and consents actually granted during the connection process. Oula accesses, transmits, stores and processes only the information reasonably necessary to provide the contracted feature.

The Client is responsible for obtaining the internal, corporate and regulatory authorizations required to connect mailboxes, accounts, workspaces, channels or tenants to Oula, and for informing the data subjects involved.

The Client may at any time request the disconnection of an integration, the deletion of specific data or the export of information, subject to technical, legal, contractual and security limitations, as well as to the policies of the relevant third-party provider.

To the extent Oula processes data obtained through Google Workspace APIs, such processing will be limited to features visible to the user within the Platform and to the purposes described in this policy.

Oula's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

• We do not sell data obtained from Google APIs.
• We do not use it for advertising or ad profiling.
• We do not use it to train generalized, non-personalized artificial intelligence or machine learning models.
• We do not allow humans to read it, except for security, support, abuse prevention, legal compliance, or with the user's express authorization.

Where Oula accesses data through Microsoft Graph or Microsoft 365 integrations, such access will be carried out in accordance with the permissions granted by the user or by the tenant administrator, as applicable.

Oula applies reasonable minimization, retention and deletion criteria to such data, and makes available to the user and the administrator the mechanisms to revoke access or request deletion, in accordance with the rights section of this policy.

Where Oula integrates with Slack, access to messages, metadata, channels or users will be limited to the scopes and permissions granted by the workspace and by its administrators or authorized users.

Oula will not grant any user access to, visibility of, or the ability to extract Slack content beyond what that user is already entitled to see within Slack or what the workspace administrator has validly authorized.

Oula relies on providers acting as data processors to operate the Platform: cloud infrastructure and hosting, databases, transactional email, analytics, fraud prevention and support tools.

Oula discloses to these providers only the strictly necessary information, under appropriate confidentiality and security duties, and prohibits them from using the data for their own purposes.

Oula operates from the United States and some of its providers are located in other countries, so processing may involve international data transfers, including storage and processing outside the data subject's country of residence. In such cases Oula adopts the safeguards required by applicable regulations, including contractual clauses imposing on the recipient protection standards equivalent to those set out in this policy.

Oula may disclose personal data to competent authorities upon a legal request, court order or regulatory obligation, and to its advisors or auditors where necessary to defend its rights.

Oula implements technical, administrative and organizational measures appropriate to the nature of the service and to its internal risk management criteria, including role-based access control, encryption of communications, environment segregation, activity logging and restriction of staff access to what is strictly necessary.

No system is completely immune. Oula does not guarantee absolute security, invulnerability or the total absence of incidents.

The Client and its users are responsible for safeguarding their credentials and for adopting complementary security measures over their devices, networks, access, roles and integrations.

In the event of a security incident affecting personal data, Oula will adopt the applicable containment and remediation measures and will notify data subjects and the competent authority as required by applicable regulations.

Oula retains personal data for as long as necessary to fulfill the purposes that justified its collection and, thereafter, for the periods required to meet legal, accounting, tax and legal defense obligations.

• Registration and commercial interest data: while a relationship or active interest exists and until the data subject requests deletion.
• Account and usage data: for the duration of the account and for the statutory retention period following its termination.
• Data from integrations: while the integration is active and in accordance with the retention policies agreed with the Client.
• Authorization, security and audit records: for the period necessary to evidence compliance and exercise legal defense.

Once the applicable periods have elapsed, Oula securely deletes or anonymizes the data. Aggregate or anonymized information that does not allow a person to be identified may be retained for statistical purposes.

As a data subject, you have the right to:

• Access, update and rectify your personal data.
• Request evidence of the authorization granted, except where the law exempts that requirement.
• Be informed about the use made of your personal data.
• File a complaint with the data protection authority with jurisdiction over your place of residence.
• Withdraw your authorization or request deletion of your data, where no legal or contractual duty prevents it.
• Access your personal data free of charge.
• Request portability or export of the information, subject to technical and security limitations.

Where the data comes from an integration connected by an organization, Oula acts as a processor: in those cases the request must be addressed to the Client acting as controller, and Oula will support the Client in handling it to the extent technically possible.

You may exercise your rights by writing to hola@oula.co, stating your name, your identification, the data concerned, a description of your request and a contact channel for our response.

Before acting on a request, Oula must reasonably verify the identity of the requester or their authority to act on the data subject's behalf. If verification is not possible, Oula may decline the request and will explain why.

The response times Oula commits to are:

• Acknowledgment of receipt within ten (10) business days.
• A substantive response within forty-five (45) calendar days of receipt, extendable by a further forty-five (45) calendar days where the complexity or volume of the request warrants it, informing the requester of the reasons for the extension.

If a request is incomplete, Oula will ask the requester for the missing information and the response period will be suspended until it is received. If two (2) months elapse without the requester providing it, the request will be deemed withdrawn.

Withdrawal of authorization or deletion of data will proceed where no legal, contractual or evidentiary duty requires Oula to retain the data. Oula will not discriminate against any data subject for having exercised the rights described in this policy.

The Platform is intended for adults acting in a professional or business capacity. Oula does not intentionally collect personal data from children or adolescents through its public forms.

If Oula becomes aware that it has collected data from a minor without their legal representative's authorization and where the processing does not serve the minor's best interests, it will delete such data. You may notify us of any such situation by writing to hola@oula.co.

Oula may amend this policy to reflect regulatory changes, new features, new processors or adjustments to the purposes of processing.

The version in force will always be the one published on this site, with its last updated date visible. Where a change materially affects the purposes or scope of processing, Oula will communicate it through a reasonable channel and, where regulations require, will request a new authorization.

To exercise your rights or for any matter relating to the processing of your personal data: