01Introduction
Open Vantage B.V. (Chamber of Commerce / KvK number 77774558), a private limited company (besloten vennootschap) incorporated under the laws of the Netherlands with its registered office at Koevelden 1, 5685 HE Best, trading under the name “Thentic Labs” (“Thentic Labs”, “we”, “us” or “our”), respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and protect personal data through our website at www.thenticlabs.com (the “Website”) and in the course of our business.
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, “UAVG”) and other applicable law. Terms such as “personal data”, “processing”, “controller” and “processor” carry the meanings given to them in the GDPR.
02Who is responsible for your personal data (controller)
For personal data where we determine the purposes and means of processing, Thentic Labs is the controller. You can contact us about this Policy or your personal data using the details below:
- Entity: Open Vantage B.V. (trading as Thentic Labs)
- KvK number: 77774558
- Registered office: Koevelden 1, 5685 HE Best, Noord-Brabant, the Netherlands
- Data protection contact: privacy@thenticlabs.com (general enquiries: info@thenticlabs.com)
We have not appointed a statutory Data Protection Officer, as we are not currently required to do so under Article 37 GDPR. Should this change, we will update this Policy with the relevant contact details.
03Personal data we collect
We collect only the personal data we reasonably need for the purposes set out in this Policy. Depending on how you interact with us, this may include:
- Identity and contact data, such as your first and last name, company name, job title, email address and telephone number;
- Account and authentication data, such as username, log-in credentials, authentication tokens and role and permission assignments;
- Marketing preferences and communication choices;
- Demographic data, such as country and preferred language;
- Technical and usage data collected automatically when you use the Website, including IP address, device and browser type, session metadata, audit-log activity, the pages you visit and the links you follow;
- Business data relating to representatives of our customers, suppliers and partners; and
- Recruitment and employment data, where you apply for a position or are engaged by us.
We do not ordinarily process special categories of personal data within the meaning of Article 9 GDPR (such as data about health, race or ethnic origin, religion, political opinions or sexual orientation), except with your explicit consent or where the law requires or permits it. Where we link other data to your personal data, we treat the combined data as personal data.
04How we collect personal data
We collect personal data directly from you when you engage us, contact us, subscribe to our communications, register for our events, apply for employment, or otherwise interact with us. We also collect certain data automatically through the Website using cookies and similar technologies (see clause 12 and our separate Cookie Statement), and we may receive data from third parties such as public sources and business partners, to the extent permitted by law.
05Purposes and legal bases for processing
We process personal data for the following purposes:
- To operate, maintain, develop and improve our business, our services and the Website;
- To research, develop, support and maintain the software platform whose intellectual property we hold (see clause 6);
- To establish and manage our relationships with customers, suppliers and partners;
- To respond to your enquiries, requests and complaints;
- To send you communications and, where permitted, marketing about our services;
- To recruit and administer staff and contractors;
- To maintain the security, integrity and availability of our systems; and
- To comply with our legal, regulatory and contractual obligations.
We rely on one or more of the legal bases set out in Article 6(1) GDPR, namely: your consent; that processing is necessary to enter into or perform a contract with you; that processing is necessary to comply with a legal obligation; or that processing is necessary for the legitimate interests pursued by us or a third party, balanced against your rights and freedoms. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
06When we act as a processor (platform development and support)
Thentic Labs holds the intellectual property in the Arcaidea software platform (the “Platform”) and licenses it to Arcaidea (Pty) Ltd. Where our personnel develop, support or maintain the Platform and, in doing so, process personal data contained within a customer’s tenant, we act as a processor (and, in relation to Arcaidea, as a sub-processor) on the documented instructions of Arcaidea and the relevant customer.
That processing is governed by the intra-group data processing agreement between Thentic Labs and Arcaidea, together with the subscription agreement and data processing agreement between Arcaidea and its customer. This Policy governs personal data for which Thentic Labs is itself the controller.
07Recipients and sharing of your personal data
We may share personal data, for the purposes described above, with:
- Processors and sub-processors that process personal data on our behalf under written agreements, including cloud hosting and infrastructure providers (Amazon Web Services, Microsoft Azure, Google Cloud Platform), source-code hosting (GitHub), observability and security tools (for example Sentry and Snyk), and accounting, payroll and collaboration service providers;
- Arcaidea (Pty) Ltd and other entities within our group, under binding intra-group arrangements;
- Professional advisors and auditors bound by a duty of confidentiality;
- Competent authorities where required by law, including the Netherlands Tax Administration (Belastingdienst), the Netherlands Chamber of Commerce (KvK) and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens);
- A third party in connection with a merger, sale, restructuring or financing of all or part of our business; and
- Any party to whom you consent that we disclose your personal data.
We do not sell, rent or trade your personal data.
08International transfers
Most personal data is processed within the European Economic Area (EEA). Where we transfer personal data to a country outside the EEA, including to Arcaidea (Pty) Ltd in South Africa and to certain cloud regions, we do so only where an adequate level of protection is ensured. This may be on the basis of a European Commission adequacy decision, the European Commission’s Standard Contractual Clauses together with any necessary supplementary measures, or another transfer mechanism permitted under Chapter V of the GDPR.
South Africa is not the subject of an EU adequacy decision, so transfers of personal data to Arcaidea (Pty) Ltd are made under Standard Contractual Clauses with appropriate supplementary measures. You can request a copy of the relevant safeguards using the contact details in clause 13.
09Security of your personal data
We maintain an Information Security Management System aligned to ISO/IEC 27001:2022 and apply a combination of organisational, technical and physical safeguards to protect personal data against loss, misuse and unauthorised access, alteration or disclosure. These include role-based access control on a least-privilege basis, multi-factor authentication on privileged accounts, encryption of data in transit and of sensitive data at rest, a secure software development lifecycle, logging and monitoring, and contractual security obligations on our processors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10Retention
We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, contractual or reporting obligations, to resolve disputes and to enforce our agreements. Personal data processed on behalf of Arcaidea or a customer is retained and deleted in accordance with the relevant intra-group, subscription and data processing agreements. When personal data is no longer required, we delete, destroy or anonymise it in a secure manner.
11Your rights
Subject to the GDPR, you have the right to:
- Request access to the personal data we hold about you;
- Request that we rectify personal data that is inaccurate or incomplete;
- Request erasure of your personal data (the right to be forgotten) in the circumstances set out in the GDPR;
- Request restriction of processing in the circumstances set out in the GDPR;
- Receive your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller (data portability);
- Object, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time to processing for direct marketing purposes;
- Not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you; and
- Withdraw your consent at any time where processing is based on consent.
Where Thentic Labs processes your personal data as a processor on behalf of Arcaidea or a customer, requests to exercise these rights should ordinarily be directed to that controller, and we will assist as required. Otherwise, please contact us using the details in clause 13. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at www.autoriteitpersoonsgegevens.nl.
12Direct marketing and cookies
Direct marketing
We will only send you electronic marketing communications where you have consented or where you are an existing customer and the law permits. You may opt out of marketing at any time by following the unsubscribe instructions in any message or by emailing info@thenticlabs.com.
Cookies and similar technologies
The Website uses cookies and similar technologies. Strictly necessary cookies are placed without consent. Non-essential cookies (such as analytics and marketing cookies) are placed only with your prior consent, in accordance with Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet) and the GDPR. For full details, and to manage or withdraw your consent, please see our separate Cookie Statement, available on the Website.
13How to contact us and complaints
If you have any questions about this Policy or how we handle your personal data, or wish to exercise your rights or lodge a complaint, please contact us at privacy@thenticlabs.com or info@thenticlabs.com. If you are not satisfied with our response, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at www.autoriteitpersoonsgegevens.nl, where details of the complaints process are available.
14Changes to this Policy
We may update this Policy from time to time. The current version will be posted on the Website with a revised effective date, and, where the changes are material, we will take reasonable steps to notify you. Unless stated otherwise, the updated Policy supersedes all previous versions.
15Validity and document management
Version 1. This Policy is effective from 5 June 2026.