Privacy Statement of OneSpace Security B.V.
20 October 2026
During the processing of personal data OneSpace Security B.V. works conform the requirements of the applicable data protection legislation, like the General Data Protection Regulation. This means we:
- clearly specify our purposes before we process personal data, by using this privacy statement;
- limit our collection of personal data to only the personal data needed for legitimate purposes;
- first ask for explicit permission to process your personal data in cases where your permission is required;
- take appropriate security measures to protect your personal data and we demand the same from parties who process personal data on our behalf;
- respect your right to access, correct or delete your personal data held by us.
OneSpace Security B.V. is the party responsible for all data processing. In this privacy statement, we will explain what kind of personal data we collect and for which purposes within our website OneSpace. We recommend that you read it carefully.
If you have any questions regarding the processing of personal data, you can find the contact details of OneSpace Security B.V. at the end of this privacy statement.
Registration
Certain features of our service require you to register beforehand. You will have to provide some information about yourself and choose a username and password for the account that we will set up for you.
For this purpose, we use your name and address details, email address, nickname, profile picture and IP address. We do this on the basis of your consent. We store this information until you close your account. We will retain this data so that you do not have to re-enter it every time you visit our website, and in order to contact you in connection with the execution of the agreement, invoicing and payment, and to provide an overview of the products and services you have purchased from us.
During registration for our App you can choose to synchronize your contacts with our application. This simplifies adding OneSpace contacts to your contact list. When enabling this feature, contacts are synchronized locally on your device. We do not upload your address book to our servers. When sharing files, destination details are shared with our services to make sure the file is sent to the right person.
If you invite someone who does not have OneSpace yet, we send that person's email address or phone number to our server once, to deliver a single invitation by email or SMS through our email and SMS providers. We keep that identifier with your account until you delete your account.
When you send a file, we keep the recipients' email addresses or phone numbers with the record of that transfer for up to 12 months.
Handling your order
We will use your personal data when handling your order. We may share your data with the delivery service to have your order delivered. We may also obtain information on your payment from your bank or credit card company.
For this purpose, we use your name and address details, invoice address, email address, payment details, nickname and IP address. We need this data because of our agreement with you. We store this information until your order has been completed. Certain types of personal data will be retained for a longer period with regards to the legal tax retention. (the legal retention period).
Newsletter and offers by email
We send a newsletter with news about OneSpace, tips and offers. You get it if you signed up for it, for example in a pop-up on our website, when you asked for one of our checklists, or by ticking the newsletter box when you bought from us or created an account for our web demo. In that case we send it on the basis of your consent. Some sign-ups ask you to confirm your address first: we send you an email with a link, and the sign-up only counts once you confirm. If you were already on our mailing list before we moved it to a new email system in July 2026, for example because you created an account for our web demo before then, your address came over with that list and you may get the newsletter too. You can unsubscribe at any time.
If you buy from us, we may also email you about OneSpace products similar to the one you bought, even if you did not sign up for the newsletter. For example, we may offer to renew your license before or after it runs out, or offer you an extra license. If you bought from us before we moved our mailing list to a new email system in July 2026, you may also get our newsletter about products like the one you bought, because your address came over with that list, and you can unsubscribe from it at any time. Since that move, buying from us does not sign you up for the newsletter itself. To get it, sign up for it, for example with the newsletter box at checkout on our website. Our basis for these emails is our existing customer relationship with you and our legitimate interest in telling customers about products like the one they bought. You can object at any time, free of charge: every one of these emails has an unsubscribe link, and you can also reply to the email or write to [email protected]. About a month before a license runs out, we also send you a service message with its expiry date and a link to renew it. Unsubscribing from the newsletter and our offers does not stop that message, but unsubscribing from all our emails does. You can also stop it by replying to it or by writing to [email protected]. Other service emails about your order and license are separate, and we send them because we need them to deliver what you bought.
If you enter your email address at checkout and leave without finishing your order, we may send you one email about what you left in your cart. We keep that cart, together with the email address and your IP address, for up to 30 days. After we send that email, we keep a record that we sent it to your email address, so that we never send it twice. For all of this we use your email address and, if you gave them to us, your name and country. If you bought from us, we also keep how many orders you placed and when you first bought. If you signed up, we keep how, when and where you did so, including the IP address you used, as a record of your consent. We also keep a record of which of our emails we sent you and whether they were delivered, opened or clicked. If you unsubscribe or object, we stop sending you the newsletter, our offers and cart reminders, and we keep your email address on a list of addresses that must not get them, so that we do not send them to you again by mistake. We keep your other details in our email system until you ask us to delete them, which you can do at [email protected].
Access to portal
Within our portal, you can access a management environment where you can set, specify and change settings. We will keep track of your activities for proof.
For this purpose, we use your email address, nickname, profile picture and IP address. We do this on the basis of your consent. We store this information until our services to you have ended.
Subscription
Via OneSpace you can take out a paid subscription. We use your personal data to complete the payment.
For this purpose, we use your name and address details, invoice address, email address, payment details, nickname and IP address. We need this data because of our agreement with you. We store this information for one year after you cancelled your subscription. Certain types of personal data will be retained for a longer period with regards to the legal tax retention.
Adding a purchase to your app account
When you buy OneSpace on our website, we keep a record of the purchase so that it can be added to your OneSpace app account once you confirm the same email address in the app.
This record does not contain your email address. It holds a keyed hash of it instead: a code we calculate from the address with a secret key. We cannot read the address back from that code. We can only check whether an address you later confirm in the app matches it. Next to the hash we keep what you bought, the order reference, the month of purchase, the dates and status we need to process it and, for a lifetime license, the license code until the purchase has been added to your account.
Our webshop and our payment provider already hold your order, including your email address (see "Handling your order" and "Subscription" above). The webshop sends the address to our account server once, over an authenticated connection, and the account server stores only the hash.
When the purchase has been added to your account, we delete the hash, the order reference and the license code from this record. What remains is the month of purchase, the product and the date it was added. That no longer contains your address or your license code, and we use it only to count how many purchases reach an app account. If you get a refund, we delete the hash, the order reference and the license code in the same way. If the purchase is never added to an account, we delete the whole record 24 months after a lifetime purchase, or 3 months after a subscription ends.
Whenever a lifetime license code is added to an app account, the service that activates license codes stores a keyed hash of that account's internal number next to the code. It does not store your email address, your username or the internal number itself with the code, and the hash cannot be turned back into the number without our secret key. If the same account sends the code again, for example after a dropped connection, the hash lets the service recognise that account and confirm the code instead of refusing it. Any other account is still refused. The service also records when the code was redeemed and keeps that date with the code for 5 years, the same period our webshop keeps the personal details of an order. We delete the hash 25 months after the code was redeemed.
We do this to deliver what you paid for, as part of our agreement with you.
Records of payments and subscriptions
When a subscription starts, renews, changes, is cancelled or ends, whether you took it out on our website or in an app store, the service that manages our subscriptions (RevenueCat) notifies our servers. We also note when a purchase is added to your account. For each of these events we keep what happened, the product, the billing period, the date, the reason given for a cancellation, and a keyed hash of your account's internal number instead of your name or email address.
We need these records to keep your access correct, and we have a legitimate interest in using them to understand how our sales and subscriptions develop. We keep them for 13 months. After that we keep only monthly totals, which contain nothing about you.
Managing your subscription
When you take out a subscription on our website, we email you a link where you can change your payment method or plan, or cancel. The link works for 30 days.
If the link has expired or you cannot find it, you can ask for a new one on our website by entering your email address. If that address has a subscription with us, we send a new link to it. The page shows the same message either way, so it does not reveal whether an address has a subscription. We use the address you enter only for this check and do not store it. To prevent misuse, we count requests per connection using a hashed IP address, which we delete within one hour.
Contact form
You can use our contact form to ask questions or make any request.
For this purpose, we use your name and address details, phone number, email address and IP address. We do this because we have a legitimate interest in answering the questions people send us. We store this information until we are sure that you are satisfied with our response and 24 months thereafter. This way we can easily access the information in case you have any following questions and train our customer service to improve even more.
Chat with Lumi
You can ask us a question with the Lumi chat button on our website. Until you click it, our website does not load anything from Zendesk or send anything to it. When you click it, your browser loads the chat from Zendesk, Inc., the company that runs our support system. From then on, Zendesk receives your IP address, details about your browser and the address of the page you are viewing. Zendesk may pass some of this to companies it uses for the chat, for example a service that reports technical errors. The chat also stores a few items in your browser that it needs to work, such as a code that tells it which conversation is yours. These items are deleted when you close the browser tab. We have turned off Zendesk's own visitor statistics in the chat.
People from our support team read and answer your messages. We use your messages, and the name and email address you give us, to answer your question and any follow-up questions. We also keep track of the kinds of questions we get, so we can improve our product and our support. Zendesk processes this data for us. We have a data processing agreement with Zendesk for this. Zendesk may also handle the data outside the European Union, for example in the United States. Zendesk protects those transfers with safeguards that the GDPR accepts: the EU-U.S. Data Privacy Framework, its binding corporate rules and standard contractual clauses. Our basis for all of this is our legitimate interest in answering the questions people send us. You can object at any time by writing to [email protected]. We keep the conversation for 24 months after we have finished helping you. Then we delete it.
Statistics and personalization
We keep statistics on the use of our website. These statistics help us to, for example, only show you information that is relevant to you. We will of course respect your privacy at all times. If you do not want us to do these statistics, please let us know.
For this purpose, we use your email address and IP address. We have a legitimate interest in doing this. We store this information for six months.
Promotion
Other than the advertisements on the website, we can inform you about new products or services:
- by e-mail
- via social media
You can object at all times against this promotional communication. Every e-mail contains a cancellation link. On social media, you can block us or use the cancellation option. You can also inform us through your account. Further, you can inform us through the portal.
Location data
If necessary, we may collect your location data (GPS). If that is the case, you will be asked to grant consent beforehand.
This location data and other data can also be stored and processed by the provider of the navigation/mapping software, such as Google Maps, but the data could also be used by, for example, Google or Apple itself. We have no control over their actions. We recommend that you read the applicable privacy statement of the provider in question.
Providing data to third parties
Except for the parties necessary to deliver the above-mentioned services, we do not under any circumstance provide your personal data to other companies or organisations, unless we are required to do so by law (for example, when the police demands access to personal data in case of a suspected crime).
Statistics
We keep statistics on the use of our website.
Cookies
Our website makes use of cookies. Cookies are small files in which we can store information, so that you do not have to fill in that information again. We can also use them to see whether you are visiting us again.
The first time you visit our website, we will show you a notification explaining our cookies and ask for your permission for the use of these cookies.
You can disable the use of cookies through your browser setting, but some parts of our website may not work properly as a result of that.
We made arrangements with other parties who place cookies through our website. Nevertheless, we cannot fully control what they are doing with their cookies, so please read their privacy statements as well.
Google Analytics
We use Google Analytics to understand how visitors use our website. It only loads if you accept statistics cookies in our cookie notice. If you decline, or have not yet answered the notice, it does not load and sends nothing. We have a data processing agreement with Google, and we do not permit Google to use what it collects here for its other services.
Measuring our own website
We measure how our pages load and how they are used, using software we run on our own servers. This runs for every visitor, including before you answer the cookie notice, because it does not place or read anything on your device.
For each page view we record the page address, the page or website you arrived from, the width of your browser window, a rough device type, which browser engine you use, the country your connection comes from, loading-speed measurements, and a randomly generated number that exists only for that single page view.
We do not store your IP address, your name or email address, anything you type, or any identifier that would let us recognise you on a later visit. We use your IP address briefly, in hashed form, to limit how often one visitor can send us these measurements, and we delete that within ten minutes. Without a lasting identifier these records can show us that a page was viewed and how quickly it loaded, but not who viewed it, and they cannot follow you from one visit to the next. If you arrived from another website, we shorten that address to its domain name before storing it and discard the rest.
We keep these records for 180 days and then delete them. We do not share them with anyone.
Security
We take security measures to reduce misuse of and unauthorized access to personal data. We take responsibility in the security of your personal data. We renew our security measures to ensure safe storage of personal data and keep track what might go wrong.
Changes to this privacy statement
We reserve the right to modify this statement. We recommend that you consult this statement on a regular basis, so that you remain informed of any changes.
Inspection and modification of your data
You can always contact us if you have any questions regarding our privacy policy or wish to review, modify or delete your personal data.
You have the following rights:
- Right of access: you have the right to see what kind of personal data we processed about you;
- Right of rectification: you have the right to rectify any personal data we have processed about you, if this information is (partially) wrong;
- Right to complain: you have the right to file a complaint against the processing of your personal data by us, or against direct marketing;
- Right to be forgotten: you can file a request with us to remove any personal data we have processed of you;
- Right to data portability: if technically possible, you have the right to ask us to transfer your processed personal data to a third party;
- Right to restriction of processing: you can file a request with us to (temporarily) restrict the processing of your personal data.
If you exercise any of the rights mentioned above, we might ask to identify yourself with a valid ID, to confirm it is your personal data. If so, it is important that you hide your social security number and photo.
We will usually respond to your request within one month. This term can be extended if the request is proven to be complex or tied to a specific right. You will be notified about a possible extension of this term.
Complaints
If you want to file a complaint about our use of personal data, please send an e-mail with the details of your complaint to [email protected]. We will look into and respond to any complaint we receive.
If you think that we are not helping you in the right way, you have the right to file a complaint at the authority. For The Netherlands, this is the Autoriteit Persoonsgegevens.
Contact details
OneSpace Security B.V.
Torenlaan 19A
1251HE Laren
[email protected]
Share your files with who you want, where you want. Always encrypted.