Ontic Privacy Notice

Last updated: Nov. 2026

1. Scope and our role 

Ontic Technologies, Inc. (“Ontic,” “we,” “us,” or “our”) provides software that corporate and public sector security teams use to manage threats, mitigate risks, and protect their people and assets. We take the responsibility that comes with that seriously, and we are committed to handling personal information carefully and transparently. 

This Notice explains what personal information we collect, how we use and share it, how long we keep it, and what rights and choices you have. “Personal information” means information that identifies, relates to, or can reasonably be linked to an individual. 

Who this Notice is for. This Notice applies to you if you:

• visit our websites or interact with our marketing, communications, or events; 
• work for or represent a client, prospective client, partner, or vendor; or
• are an individual whose information appears in the services we provide to our clients.

Our two roles. Ontic handles personal information in two distinct ways, and which sections apply to you depends on which one is involved. 

For our own websites, marketing, and business relationships, we decide what information to collect and why. In privacy law terms, we are a controller or business. Sections 2 through 5 describe these activities. For the services our clients use, our clients decide what information goes into the platform and what it is used for. We handle that information on their instructions. In privacy law terms, we are a processor or service provider. Section 6 describes this, and explains where to direct a question or request about it. This Notice does not expand the rights granted to Ontic under its client agreements.

Other notices that may apply. Our Cookie Notice covers cookies and similar technologies in more detail, and our Data Processing Addendum governs our processing for clients. Job applicants and employees are covered by separate notices. Other service-specific notices may supplement this one. For Quantum, the International SOS Travel Risk and Critical Event Management Platform powered by Ontic, please review the International SOS Privacy Notice for information about International SOS’s processing.

2. Information we collect 

The information we collect depends on your relationship with us, and may include the following categories. 

Contact and professional information. Name, business email, telephone number, business address, employer, role, professional background, and other information you or your organization provide. 

Account and commercial information. Account details, preferences, inquiries, subscriptions, purchases, billing contacts, and records of our business relationship. 

Online activity and engagement information. IP address, cookie or device identifiers, browser and device details, approximate location derived from an IP address, pages and content viewed, referring pages, and interactions with our websites, emails, advertisements, and events. 

Communications and participation information. Messages, support requests, survey responses, feedback, and other material you provide. Where meetings, calls, or events are recorded, information may include your voice, image, contributions, and related transcripts or summaries. We provide notice and obtain any permissions required by law before recording. 

Inferences. Professional interests, preferences, engagement, and potential interest in our offerings, drawn from the information described above. 

Where we get it. We collect this information directly from you; from your organization and people acting on your behalf; automatically through our websites and communications; and from business partners, event organizers, referrals, publicly available professional sources, and providers of business contact, enrichment, market-interest, analytics, and advertising information. We may combine information from these sources for the purposes described in this Notice, subject to applicable law and your choices. We do not combine client-controlled service records with marketing profiles. 

Providing information to us is voluntary. Where we need information to enter into or perform a contract with you or your organization, or to meet a legal or regulatory obligation, we will tell you at the point of collection. If you choose not to provide it, we may be unable to respond to your inquiry, arrange a demonstration, give you access to a resource or service, administer an account, or complete a transaction. Information used for marketing is always optional, and you may decline or withdraw it without affecting the services available to you.

3. How we use business and website information 

We use the information described in section 2 for the following purposes, as relevant to the information and our relationship with you. 

Business relationships and service delivery. To respond to inquiries, arrange demonstrations, deliver resources and services, manage accounts, support users, administer contracts and billing, and communicate about our relationship with you or your organization. 

Marketing, business development, and personalization. To identify and develop business opportunities, establish and maintain relationships, communicate about our products, services, resources, and events, and tailor and measure our marketing and advertising. This includes maintaining and enriching contact information, understanding professional interests and organizational needs, developing and managing audiences, and assessing prospective opportunities. Section 4 explains our advertising practices and the choices available to you. 

Operations, improvement, and protection. To understand usage and feedback, improve our websites, services, and communications, conduct research and planning, maintain security, prevent misuse and fraud, meet legal obligations, and establish, exercise, or defend legal rights. We may create and use aggregated or deidentified information for analysis, service improvement, and business planning. Where required, we maintain it in deidentified form, do not attempt to reidentify it except as permitted by law, and require recipients to do the same. Where required, we provide additional notice and obtain consent before using personal information for a new purpose. 

Automated decision-making. We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing, including profiling. We use automated tools to prioritize marketing engagement, but these do not determine access to any product, service, price, or opportunity without human involvement. Section 6 describes automated processing within the services we provide to clients, which our clients control.

4. Marketing, advertising, and your choices 

We use cookies, pixels, tags, and similar technologies for website functionality, analytics, personalization, and advertising. Our Cookie Notice describes these technologies and the controls available on our websites in more detail. Where applicable law requires your consent for these technologies or for marketing communications, we obtain it, and you can withdraw your consent as easily as you gave it by using the Cookie preferences link available on every page of our website. We disclose personal information, including online identifiers, device information, and engagement information, to advertising and analytics partners so that we can provide, personalize, and measure advertising and related communications. These activities constitute a “sale” or “sharing” of personal information, and “targeted advertising,” under applicable U.S. state privacy laws. We do not exchange personal information for money, and your right to opt out is not limited to disclosures made for money.

How to opt out: 

• Browser and device-based advertising. Use the cookie banner, or the Cookie preferences link on any page. 
• All other advertising disclosures, including advertising based on business contact records that we cannot associate with your browser or device. Email privacy@ontic.co or call (512) 572-7400 and ask to opt out of the sale or sharing of your personal information. You do not need to verify your identity or create an account to opt out.

Opt-out preference signals. We honor recognized opt-out preference signals, including Global Privacy Control, as required by law. We treat these signals as requests to opt out for the browser or device sending the signal and any associated profiles, including pseudonymous profiles. When we know your identity, we also apply the request to your other personal information as required by law. You do not need to submit a separate request for information already covered by the signal. 

Do Not Track. If your browser sends a “Do Not Track” signal, our websites treat it as a request to turn off social media, functional, and targeting cookies for that browser, in the same way as a Global Privacy Control signal.

Marketing email is a separate choice. Opting out of marketing email and opting out of advertising disclosures are different things. You can unsubscribe from marketing emails using the link in the message, or ask us to stop direct marketing by contacting us. Where you exercise a right to object to direct marketing, we stop using your personal information for that purpose, including related profiling. We may still send non-marketing messages about services, security, or an existing business relationship.

5. How we disclose business and website information 

We disclose personal information to the categories of recipients described below, for the purposes described in this Notice and subject to applicable restrictions and your choices.

Service providers. Ontic affiliates and third parties that provide services to us or on our behalf, including technology, infrastructure, business administration, customer support, communications, analytics, marketing, and security services. Providers acting on our behalf are subject to appropriate contractual restrictions. 

Advertising and analytics partners. Third parties that help us deliver, personalize, and measure our advertising and related communications, as described in section 4. Some of these recipients determine their own purposes, and their own privacy notices also apply.

Business and event partners. Third parties involved in our commercial relationships and events, such as partners, resellers, event organizers, and sponsors, where relevant to your interaction, a referral, or a joint offering. Where information is provided for a partner’s own marketing, we explain that at collection and obtain any required permission.

Legal, safety, and corporate transactions. Advisers, authorities, and other parties where reasonably necessary to comply with law, respond to lawful requests, protect rights or safety, or address disputes. We may also disclose information in connection with a proposed or completed merger, financing, acquisition, or similar transaction, subject to applicable confidentiality and privacy obligations.

6. Information processed in connection with client services 

Clients use Ontic to support security, threat assessment, incident management, investigations, and risk management. In this context, our client decides what information enters the platform and why, and we handle that information on the client’s instructions.

Information processed in connection with these services depends on the client’s configuration and use, and may include identifiers, contact details, professional and employment information, physical access and location records, reports, communications, records, and associated media, including images, video, and audio, publicly available records, and related analysis and assessments. It may include information considered sensitive or otherwise protected under applicable law, including information relating to criminal offences, allegations, and proceedings. 

Clients may submit information, enable integrations, or access information from public records, licensed providers, open sources, social media, and other threat intelligence sources. These may also include client business and security systems, third-party risk and intelligence feeds, and information individuals provide directly to a client. The parties’ respective responsibilities depend on the information, service, and applicable arrangements.

Where we process information on a client’s behalf, we do so to provide, support, maintain, and secure the services in accordance with the applicable agreement, client instructions, and law. Clients are responsible for determining the purposes and applicable legal basis of their processing, for ensuring they have the right to submit or bring in the information they use, and for their required notices and decisions concerning individual rights. We assist clients as required by our agreements and applicable law.

Automated processing and AI features. The services include features that use automated processing and artificial intelligence to organize, summarize, correlate, and surface information for review by the client’s personnel. These features are designed to support human assessment and decision-making, not to replace it. Clients configure and supervise these features and remain responsible for any decision made about an individual.

We do not use personal information in client-controlled investigation, threat, incident, or other service records that we process on a client’s behalf for our own marketing or advertising, or to build or enrich marketing profiles. Separately obtained business contact information about client and prospective-client representatives is handled under the business and website sections of this Notice.

Information about individuals under 18. Client service records may, in limited circumstances, contain information about an individual under 18 where a client submits it as part of an incident, report, or assessment. Clients decide whether to submit such information and are responsible for the lawfulness of doing so. Our websites and marketing are addressed in section 12.

Questions or requests about processing controlled by a client should ordinarily be directed to that client. You may also contact us, including when you are unsure which organization to contact. We will assess our role and, where appropriate, refer the request or assist the client. A client’s privacy notice explains its own practices.

7. Legal bases for processing 

Where applicable law requires a legal basis for processing that Ontic controls, we rely on the following bases, as applicable to the relevant activity: 

Legitimate interests. We process information to manage business relationships and respond to inquiries; develop business opportunities and conduct relevant marketing; maintain and enrich business contact information; understand engagement, personalize content, and measure performance; improve our offerings; and maintain security and protect our rights. We rely on this basis only where our interests are not overridden by your rights and where consent is not required. 

Contract. We process information as necessary to perform a contract with you or take steps at your request before entering one. 

Legal obligations. We process information as necessary to comply with applicable legal, accounting, and regulatory requirements. 

Consent. We rely on your consent where required, including for certain marketing communications and uses of cookies or similar technologies. You may withdraw consent at any time without affecting earlier lawful processing. Where applicable, you may object to processing based on legitimate interests. 

You have the right to object to direct marketing, including related profiling, where that right applies. For processing carried out on a client’s behalf, the client determines the applicable legal basis.

8. Retention and security 

We retain personal information for as long as reasonably necessary for the purposes described in this Notice. We apply the following criteria to the categories of information described in section 2:

Category	Criteria and retention
Contact and professional information	Relevance of the information, nature and recency of interactions, and your preferences; for clients and vendors, the duration of the business relationship plus applicable contractual, accounting, and limitation periods
Account and commercial information	Duration of the account or business relationship, plus applicable accounting, legal, and claims requirements
Online activity and engagement information	Purpose of collection, the lifespan of the relevant technology, and analytics needs
Communications and participation information	Purpose of collection, support or security needs, and applicable obligations
Inferences	Continued relevance to the purpose for which they were created, and your preferences

We may retain limited records to honor opt-outs and document requests. Information processed on a client’s behalf is retained or deleted in accordance with the applicable agreement, instructions, and law. 

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or loss. No method of transmission or storage is completely secure.

9. International transfers and Data Privacy Framework 

Personal information may be processed in the United States and other countries where Ontic or its providers operate. Where required, we use recognized transfer safeguards, such as adequacy decisions, applicable standard contractual clauses and UK transfer arrangements, or another lawful mechanism. You may contact us for information about applicable safeguards or a copy, subject to appropriate redactions. 

Ontic Technologies, Inc. complies with the EU-U.S. Data Privacy Framework, the UK Extension to that Framework, and the Swiss-U.S. Data Privacy Framework (collectively, “DPF”), and has certified to the U.S. Department of Commerce its adherence to the applicable DPF Principles for personal information received in reliance on those frameworks. If this Notice conflicts with the applicable Principles, the Principles govern. The categories of personal information we receive in reliance on the DPF are contact and professional information, account and commercial information, online activity and engagement information, communications and participation information, and personal information contained in client service data. To view our certification, please visit the Data Privacy Framework List at dataprivacyframework.gov.

For covered information, the DPF provides access rights and, subject to its exceptions, choices concerning disclosure to third parties acting for their own purposes and use for materially different purposes. Contact us to exercise those choices. We obtain affirmative express consent for covered sensitive information when the Principles require it. Ontic remains responsible for onward transfers to agents as provided in the Principles, including liability unless we establish that we are not responsible for the event giving rise to the damage.

Direct DPF questions or complaints to privacy@ontic.co. For unresolved complaints, Ontic cooperates with the relevant EU data protection authorities or their panel, the UK Information Commissioner’s Office, and the Swiss Federal Data Protection and Information Commissioner, as applicable, and complies with their advice. These mechanisms are available without charge. Binding arbitration may be available for residual complaints under the conditions in Annex I of the DPF Principles. Ontic is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. We may disclose information in response to lawful public-authority requests, including for national security or law enforcement.

10. Your privacy rights and requests 

Depending on your location, our role, and applicable law, you may request confirmation of processing; access to information and a portable copy; information about categories, sources, purposes, and recipients, including, where applicable law provides it, a list of the specific third parties to which we have disclosed or sold your personal information; information we collected beyond the preceding 12 months, subject to applicable limits; correction; deletion; or restriction of processing. You may also have rights to object, withdraw consent, opt out of sale, sharing, or targeted advertising, limit certain uses or disclosures of sensitive information, or opt out of qualifying profiling that produces legal or similarly significant effects, and, where applicable law provides it, to be informed of the reason for such a decision, review the personal information used, correct inaccurate information, and have the analysis performed again. These rights are subject to applicable conditions and exceptions.

Submit privacy rights requests by emailing privacy@ontic.co or by calling (512) 572-7400. Advertising and marketing choices are also described in section 4. An authorized agent may submit a request through either method where permitted by law. We may request information reasonably necessary to identify the records and, where required, verify your identity or an authorized agent’s authority. We do not require a verified identity for a sale or sharing opt-out and will not require you to create an account to exercise rights. 

We respond within applicable legal timeframes and explain any permitted extension or refusal. Where a right of appeal applies, you may appeal by emailing privacy@ontic.co with “Privacy Appeal” in the subject line. If we deny your appeal, we will provide you with a method to contact the Attorney General of your state to submit a complaint. You may also complain to the appropriate regulator or data protection authority without first contacting us. We do not unlawfully discriminate against individuals for exercising their rights. For client-controlled information, the routing described in section 6 applies.

11. Additional U.S. state disclosures 

For our website and business relationship activities, sections 2, 3, 5, and 8 describe the categories and sources of personal information we collect, the purposes for which we use it, the categories of recipients to whom we disclose it, and our retention practices. Sections 4 and 10 describe applicable privacy rights and choices.

California disclosures. The disclosures below cover the 12 months preceding the “Last updated” date above and apply to personal information Ontic handles as a business, rather than personal information Ontic processes solely on behalf of a client as a service provider or contractor. For purposes of this section, “sell,” “sale,” “share,” and “sharing” have the meanings given to those terms under the California Consumer Privacy Act, as amended (“CCPA”).

Categories collected. During this period, we collected the following categories of personal information: identifiers; commercial information; internet or other electronic network activity information; geolocation data, limited to approximate location derived from an IP address; audio, electronic, visual, or similar information, where meetings, calls, or events are recorded; professional or employment-related information; and inferences. We did not collect sensitive personal information, as defined by the CCPA, for these activities.

Categories sold or shared. California law uses the terms “sale” and “sharing” broadly. They cover common advertising practices like using cookies and similar technologies to show you relevant ads and measure how they perform, and they apply even when no money changes hands. Under those definitions, during this period we sold or shared identifiers, internet or other electronic network activity information, professional or employment-related information, and inferences with advertising, social media, and analytics partners, for marketing, advertising, personalization, and measurement purposes. We do not sell personal information for money, and you can opt out at any time as described in section 4.

Categories disclosed for business purposes. During this period, we disclosed identifiers; commercial information; internet or other electronic network activity information; geolocation data; audio, electronic, visual, or similar information; professional or employment-related information; and inferences to service providers and contractors for the business purposes described in sections 3 and 5.

We do not sell or share personal information, or process it for targeted advertising, where we know the individual is under 18.

12. Third-party websites, children, and changes 

Third-party websites. Third-party websites, services, and social media features are governed by their own privacy notices, not this one. 

Children. Our websites and marketing are directed to security, risk, and business professionals. They are not directed to children, and we do not knowingly collect personal information from individuals under 18 through them. If you believe a child has provided us with personal information through our websites or marketing, please contact privacy@ontic.co and we will delete it. Information in client service records is addressed in section 6 and governed by the applicable client agreement. 

Changes to this Notice. We may update this Notice to reflect changes in our practices or in legal requirements, and will revise the date at the top. We will provide additional notice and obtain consent where required. Changes do not remove obligations arising from earlier notices, or authorize a materially different use without any required notice or permission.

13. Contact us

For privacy questions, requests, or concerns, contact our Data Protection Officer at privacy@ontic.co or write to:

Ontic Technologies, Inc.
Attention: Privacy / Data Protection Officer
1608 W. 5th St., Suite 100
Austin, TX 78703, United States