OONOO Privacy Policy

Last updated 21 September 2026

This policy explains how Oonoo B.V. ("OONOO", "we", "us") collects and uses personal data when you use our file transfer, agreement, view-only and identity verification services. We are the data controller for the personal data described here.

Who we are

For any privacy question, please use our contact form.

What data do we collect?

The data we hold depends on how you use OONOO:

• Standard (no account): the sender's email address, the recipient's email address (when you send by email), the files you upload for delivery, and, for agreements, the contract details you enter and the electronic signatures of the parties.
• Pro (account): your account details and the metadata for the workflow features you choose, such as your transfer history, saved agreements, address book entries and billing information.
• Saved payment details (optional): if you use the invoice builder, you can save the bank details you want printed on your invoices, being the account holder name, bank name, IBAN, BIC, payment reference and bank address. These are your own details, saved only so we can fill them in for you. They are stored encrypted, we never use them to take payment from you, and we never share them.
• Identity verification (optional add-on): where a sender enables it, the recipient completes an identity check. The identity document and selfie are captured and processed by Stripe Identity (see "Identity verification" below). OONOO does not receive or store the document or selfie images.
• Technical data: limited technical data needed to run the service. We do not store your IP address. Analytics data about how you use the site is only collected if you accept analytics cookies.

How do we collect your data?

You provide most of this data directly, for example when you send a transfer or an agreement, create a Pro account, or complete an identity check. Analytics data is only collected if you accept analytics cookies.

Saved bank details for invoices

The Pro invoice builder lets you save your own bank details so they can be filled in automatically on the invoices you create. Saving them is entirely optional and the invoice builder works without it. We use these details for one purpose only, printing them on the invoices you generate, and we never use them to debit your account, never share them with anyone, and never use them for anything else. They are encrypted before they are written to our database, and they are shown back to you only on your own settings page and in the invoice builder. You can change or clear them at any time from your account settings, and they are deleted when you delete your account.

Why we use your data and our legal bases

We use your data to deliver your transfers and agreements, run identity verification when requested, provide the Pro workflow features, take payment, keep the service secure, and comply with our legal obligations. We do not sell or trade your personal data. Depending on the activity, our legal basis under Article 6 GDPR is:

• performance of a contract, for delivering the transfer, agreement or Pro service you request, including saving the bank details you choose to store for your invoices;
• your consent, for optional features such as the address book, saved transfer log and analytics cookies;
• our legitimate interests, for preventing abuse and keeping the service secure;
• compliance with a legal obligation, for example tax and accounting records.

Identity verification

The optional identity verification feature is powered by Stripe Identity, who acts as our processor for this feature. When a recipient completes a check, Stripe captures and analyses their identity document and a selfie to confirm the document is genuine and matches the person. OONOO does not receive or store the document or selfie images, and we do not retain the verification data. The verification receipt is made available to the sender and recipient at the time of the check, by email or download, and is not kept by us afterwards.

Who we share your data with

We use a small number of trusted providers (processors) to run the service, under data processing agreements:

• Amazon Web Services (AWS) for hosting and file storage in the EU, under their Data Processing Addendum;
• Stripe for payments and, where enabled, Stripe Identity for identity verification;
• Google Analytics for website analytics, only if you accept analytics cookies.

Beyond these providers, we do not share your personal data with third parties except where required by law.

International transfers

We host and store files in the EU. Some of our providers (for example Stripe and Google) may process limited data outside the European Economic Area. Where that happens, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long do we keep your data?

Files sent through the standard service are automatically deleted after the transfer window chosen by the sender (72 hours, 2 weeks or 1 month), enforced by lifecycle rules on our S3 storage. For Pro accounts, your account and workflow data is kept for as long as your account exists, and you can delete your data at any time from your account; when you delete your account it is removed, including any saved bank details. Identity verification data is not retained by us. Billing records are kept for as long as the law requires.

What are your data protection rights?

OONOO would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access. You have the right to request copies of your personal data, and we will email this information to you.
• The right to rectification. You have the right to ask us to correct any information you believe is inaccurate, and to complete information you believe is incomplete.
• The right to erasure. You have the right to ask us to erase your personal data, under certain conditions.
• The right to restrict processing. You have the right to ask us to restrict the processing of your personal data, under certain conditions.
• The right to object to processing. You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability. You have the right to ask us to transfer the data we have collected to another organisation, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us through the contact form.

Do we use cookies?

OONOO does not use any marketing, advertising or tracking cookies, and we never sell or share cookie data.

The cookies below are functional: they are needed to run the parts of the service you ask for, so they are set without asking for consent. None of them are used to profile you or follow you across other websites.

• oonoo_lang remembers the language you picked, so the next page opens in the same one. It stores a two-letter language code and nothing else. Kept for 3 months.
• analytics_consent remembers whether you accepted or declined analytics cookies, so we do not ask again on every page. Kept for 30 days.
• Session cookie keeps you signed in and keeps a transfer together while you are setting it up. Deleted when you close your browser.
• remember_token is only set if you have a Pro account and tick "Keep me signed in". It holds a random token, never your email or password, and we store only a hashed copy of it. Kept for 30 days from when you last used it, and deleted as soon as you sign out or change your password.

Analytics cookies are a separate matter. They are only ever set if you press Accept on the cookie banner, they help us see which pages people find useful, and you can change your mind at any time by clearing your cookies. If you decline, or simply ignore the banner, no analytics cookies are set and the site works exactly the same.

Privacy policies of other websites

The OONOO website contains links only to our own pages. Our privacy policy applies only to our website.

Changes to our privacy policy

OONOO keeps its privacy policy under regular review and places any updates on this web page. This privacy policy was last updated on 21 September 2026.

How to contact us

If you have any questions about OONOO's privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

How to contact the appropriate authority

Should you wish to report a complaint, or if you feel that OONOO has not addressed your concern in a satisfactory manner, you may contact the Dutch DPA (Autoriteit Persoonsgegevens).

• (+31)-(0)88-1805250 for privacy questions, Monday to Thursday, 10:00 to 12:00.
• (+31)-(0)70-8888500 for business related questions, Monday to Friday, 9:00 to 13:00.