OpenExO Privacy and Cookies Policy

1. Data Controller

• Data Controller: OpenExO, Inc.
• Postal Address: 3500 S DuPont Highway, Suite YY 102, Dover, DE 19901, United States
• Email: [email protected]
• Data Protection contact: OpenExO, Inc., [email protected]

2. Processing Activities

OpenExO, Inc. processes only the personal data indicated below.

A. Data gathered via the website and contact channels

• Purpose: Replying to requests for information, support requests and contacts sent via email, contact forms on the website, telephone or text message.
• Retention: The personal data of the interested party will be kept until they request its erasure, and in all cases for a maximum of five years.
• Legal basis for processing: Consent of the interested party.
• Recipients: Our service providers acting on our behalf (see Section 4). No personal data will otherwise be communicated except where required by law.
• How data are obtained: Directly from the interested party.
• Data categories: identification data; contact details, including email address and, where provided, mobile phone number; the content of your messages.

As this is a community-driven platform, your full profile will be visible to community members and a less detailed profile will be public on our website. Please do not publish or add personal data that you do not want to be public.

B. Clients

• Purpose: Provision of the contracted consultancy services.
• Retention: 5 years.
• Legal basis for processing: Performance of the contract to provide the services requested by the interested party.
• Recipients: Our service providers acting on our behalf (see Section 4). No personal data will otherwise be communicated except where required by law.
• How data are obtained: Directly from the interested party.
• Data categories: identification data; contact details. No special categories of data are processed.

C. Personnel selection

• Purpose: Participation in our company's personnel selection processes.
• Retention: Until the candidate requests erasure, and in all cases for a maximum of two years.
• Legal basis for processing: Consent of the interested party.
• Recipients: No personal data of candidates will be communicated to third parties, other than service providers that host our recruitment tools.
• How data are obtained: Directly from the interested party, via CVs, our forms and our interviews.
• Data categories: identification data; personal characteristics; academic information; employment history. No special categories of data are processed.

D. Suppliers

• Purpose: Managing suppliers.
• Retention: 5 years.
• Legal basis for processing: Performance of the contract with the supplier.
• Recipients: No personal data will be communicated except where required by law.
• How data are obtained: Directly from the interested party.
• Data categories: identification data; contact details; goods and services provided by the supplier. No special categories of data are processed.

E. Consultants

• Purpose: Management of relationships with consultants.
• Retention: 5 years.
• Legal basis for processing: Performance of the contract with the consultant.
• Recipients: The data will be communicated to the clients of the entity that contracts the consulting services in which the consultant participates. Occasionally, these data may be transferred to countries outside the European Economic Area, where required for the provision of the consultant's services (see Section 5).
• How data are obtained: Directly from the interested party.
• Data categories: identification data; contact details; services provided by the consultant. No special categories of data are processed.

3. SMS / Text Messaging

OpenExO uses text messaging only as a customer care channel. We may collect your mobile phone number when you text our business number, when you provide it through a form on our website, or when you contact us. We use your mobile number solely to receive and respond to the messages and support requests you send us. We do not send marketing or promotional text messages.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Your mobile number and message content are processed only by the service providers that enable us to deliver messages (such as our CRM and messaging platform and telecommunications carriers), solely to provide the messaging service and never for their own marketing purposes.

You can opt out at any time by replying STOP to any message. Reply HELP for help, or contact us at [email protected]. Message frequency varies. Message and data rates may apply. See the SMS Terms in our Terms of Service (openexo.com/terms) for more information.

The legal basis for processing your mobile number for text messaging is your consent, which you may withdraw at any time by replying STOP, without affecting the lawfulness of processing carried out before withdrawal.

4. Service Providers and Sharing

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. We use carefully selected service providers that process personal data on our behalf and under our instructions, for example for website hosting, customer relationship management and messaging (including HighLevel / LeadConnector), email, analytics, payment processing (Stripe) and video conferencing. These providers are bound by confidentiality and data protection obligations and may not use your data for any other purpose. We may also disclose personal data where required by law, or to protect our rights, users or the public.

5. International Transfers

OpenExO, Inc. is based in the United States, and some of our service providers are located in other countries. Where personal data are transferred to a country that does not provide an adequate level of protection under the law applicable to you, we implement appropriate safeguards as required by applicable data protection law. You may request further information about these safeguards by writing to [email protected].

6. Rights of the Interested Party

You have choices regarding our use and disclosure of the personal data you give us.

• Unsubscribing from electronic communications. If you no longer wish to receive our emails and commercial communications, you may opt out via the unsubscribe link included in those emails. We will promptly comply with your request. If you unsubscribe from commercial communications, we may still send you important administrative messages required to provide our Services. To stop text messages, reply STOP.
• Rectifying or modifying your data. You may review, correct or update the personal data you disclosed to us by signing in to your OpenExO account and editing your profile settings, or by emailing [email protected] with the subject "I want to modify my personal data".
• Your data protection rights. Subject to applicable law, you have the right to:
  • request confirmation of whether OpenExO processes personal data relating to you and, if so, a copy of that data;
  • request that OpenExO rectify or update personal data that is inaccurate, incomplete or outdated;
  • request that OpenExO erase your personal data;
  • request that OpenExO restrict the use of your personal data in certain circumstances, such as while we consider another request you have submitted;
  • object to processing based on our legitimate interests;
  • receive the personal data you provided to us in a portable format, or have it transmitted to another company where technically feasible;
  • withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, email [email protected]. We will not discriminate against you for exercising them. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority (in Spain, the Agencia Española de Protección de Datos, www.aepd.es). Residents of certain U.S. states may have additional rights under their state privacy laws, which you can exercise through the same email address.

7. Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure. No method of transmission over the Internet is completely secure, but we work to protect your data using commercially reasonable means.

8. Children

Our Services are not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it.

9. Cookies

What are cookies?

A cookie is a file downloaded to your computer when you visit certain websites. Among other things, cookies let websites store and retrieve information on a user's browsing habits or equipment and manage user access to restricted areas of the website.

What types of cookies does this website use?

• Technical cookies: let users browse the website and use its options or services, for example to monitor traffic and data transfer, log in, access restricted areas, complete an order, register for or participate in an event, use security features, or share content on social networks.
• Personalization cookies: let us adapt the navigation of our website to your preferences (e.g. language or browser).
• Analytical cookies: let us monitor and analyze user behavior on our website to measure activity and improve the website and our products and services.
• Advertising cookies: let us manage advertising spaces efficiently, based on criteria such as content or frequency of display.
• Behavioral advertising cookies: let us manage advertising spaces based on user behavior obtained from continuous observation of browsing habits, enabling a specific profile for advertising display.
• First-party cookies: sent to your device from our own website.
• Third-party cookies: sent to your device from a domain not managed by us, but by another entity that processes the data it obtains through cookies.
• Session cookies: gather and store information while you are visiting our website.
• Persistent cookies: store information on your device that can be accessed and processed for a set period, from a few minutes to several years.

Except for technical cookies, which are necessary for the website to work, we only use cookies with your consent, which you can give or withdraw at any time through the cookie banner or your browser settings.

Who uses cookies?

The cookies on this website are used by OpenExO and by the following service providers:

• Google Analytics: website analytics. Privacy policy: https://policies.google.com/privacy
• HubSpot: marketing and analytics. Privacy policy: https://legal.hubspot.com/privacy-policy
• AdRoll: advertising and analytics. Privacy policy: https://www.adrollgroup.com/privacy
• Stripe: payment processing and fraud prevention. Cookie policy: https://stripe.com/legal/cookies-policy
• HighLevel / LeadConnector: forms, chat and customer relationship management. Privacy policy: https://www.gohighlevel.com/privacy-policy

How can I disable or delete cookies?

You can allow, block or delete cookies by configuring your web browser. More information for each browser:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
• Apple Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
• Microsoft Edge: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

10. Changes and Version

This Privacy and Cookies Policy was last updated on September 29, 2026 and replaces the version dated May 25, 2023. Any change to its terms will be published on this page. For questions, contact [email protected].