Privacy Policy
Last Updated: October 20, 2026
1. Introduction
RiskRhino (“RiskRhino”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection laws.
This Privacy Notice explains how we collect, use, store, disclose and otherwise process personal data when you visit our website, communicate with us, request information about our services, participate in our events, or interact with us in a business or professional capacity.
RiskRhino is a Dutch provider of governance, risk and compliance (“GRC”) software as a service (“SaaS”). Our services enable organisations to manage and document governance, risk, compliance and related business processes.
This Notice distinguishes between two situations:
RiskRhino as a data controller: We determine the purposes and means of processing personal data for our own business activities, such as managing business relationships, operating our website, providing marketing communications and administering customer accounts or internal HR data.
RiskRhino as a data processor: When we process personal data on behalf of a customer through our GRC platform or related services, we generally act as a processor and process that data on the customer's documented instructions and in accordance with our contractual arrangements as described in the EULA or the applicable Data Processing Agreement (“DPA”).
Where RiskRhino acts as a processor, the relevant customer generally acts as the data controller with direct access to the RiskRhino application and data and is responsible for determining the purposes and legal basis for processing personal data within its use of the platform. The processing of such data is governed by the applicable customer agreement and DPA.
This Notice does not replace any DPA or other contractual terms governing our services.
Our website or communications may contain links to third-party websites or services. Those third parties operate under their own privacy notices, and RiskRhino is not responsible for their independent privacy practices.
2. Personal data we collect
The personal data we collect depends on your relationship with us and how you interact with our website and services.
2.1 Contact and business information
When you contact us, request a demonstration, subscribe to communications, enter into a business relationship or otherwise interact with us, we may collect:
Name and surname.
Business email address and telephone number.
Job title, department and employer.
Business address, country and other relevant business contact details.
Information about your organisation and its requirements.
The content of communications, enquiries and support requests.
2.2 Account and customer relationship information
When you or your organisation establishes a relationship with RiskRhino, we may process account and administrative information, including names and contact details of authorised users, account identifiers, roles and permissions, authentication-related information, subscription details, contract information, invoices and records of customer interactions.
2.3 Website and technical information
When you visit our website or use our online services, we may collect technical information such as:
IP address and general device or browser information.
Operating system and browser type.
Date and time of access.
Pages visited, referring URLs and interaction data.
Security logs, error reports and diagnostic information.
Cookie identifiers and similar online identifiers, where applicable.
We use this information to operate and secure our website and services, diagnose technical issues, understand website and application performance and improve functionality, subject to applicable law and your cookie preferences where required.
2.4 Communications, events and feedback
If you participate in a meeting, webinar, demonstration, training session or other event organised by RiskRhino, we may process registration details, attendance information, questions, feedback and related communications.
We will record or transcribe meetings only where appropriate, with any notice, consent or other legal basis required by applicable law.
2.5 Information obtained from third parties
We may obtain professional contact details or business information from your organisation, publicly available professional sources, business partners or other legitimate business information providers.
Where we obtain personal data indirectly, we will provide the information required by applicable data protection law, subject to any applicable legal exceptions.
2.6 Customer data processed through the GRC platform
Our customers may upload, enter, generate or otherwise make available personal data through the RiskRhino platform. Depending on how a customer uses our services, this data may include information relating to employees, contractors, suppliers, business contacts, auditors or other individuals.
The nature and extent of this data are determined by the customer.
RiskRhino processes such personal data on behalf of the relevant customer and in accordance with the applicable customer agreement and DPA. The customer is responsible for ensuring that it has an appropriate legal basis for processing and sharing the data with RiskRhino.
RiskRhino does not use customer content for its own independent purposes except where permitted by the applicable agreement, requested by the client or required or permitted by law.
3. Purposes and legal bases for processing
RiskRhino processes personal data only where an applicable legal basis under Article 6 GDPR exists.
Depending on the circumstances, our legal bases include the performance of a contract, compliance with a legal obligation, our legitimate interests or your consent.
The purposes and legal bases are set out below.
3.1 Responding to enquiries and managing business relationships
We process contact and business information to respond to enquiries, arrange demonstrations, provide requested information, communicate with prospective and existing customers, negotiate agreements and manage our commercial relationships.
Legal basis: Taking steps at your request before entering into a contract, performance of a contract, or our legitimate interests in managing and developing business relationships.
3.2 Providing and administering our services
We process relevant account and contact information to establish and administer customer accounts, provide access to our services, manage subscriptions, communicate service updates, deliver customer support, process payments and fulfil our contractual obligations.
Legal basis: Performance of a contract and, where applicable, our legitimate interests in administering our business and services.
3.3 Operating, maintaining and securing our services
We process technical information, logs and relevant account information to maintain service availability, monitor performance, investigate errors, detect and prevent fraud, investigate security incidents, protect our systems and prevent unauthorised access.
Legal basis: Our legitimate interests in ensuring the availability, integrity, confidentiality and security of our systems and services, and compliance with legal obligations where applicable.
3.4 Marketing and business development
We may use business contact information to communicate with you about RiskRhino, our GRC services, product developments, events and other relevant business information.
We will send direct marketing communications only where permitted by applicable law. Where consent is required, we will obtain it before sending the relevant communications.
You may object to direct marketing at any time or withdraw your consent where processing is based on consent. Following an objection to direct marketing, we will stop processing your personal data for that purpose.
Legal basis: Our legitimate interests in developing business relationships and promoting our services, or your consent where required by applicable law.
3.5 Website analytics and cookies
We may use analytics technologies to understand how visitors interact with our website and to improve its usability and performance.
Where cookies or similar technologies are not strictly necessary, we will seek consent before placing or using them where required by applicable law. You may change your preferences through our cookie settings, where available.
Legal basis: Consent where required for the relevant technology, or our legitimate interests for strictly necessary operations and other processing that does not require consent.
3.6 Legal, financial and regulatory obligations
We may process personal data to comply with applicable laws and regulations, maintain accounting and tax records, respond to lawful requests from competent authorities, establish or defend legal claims, and protect our rights and interests.
Legal basis: Compliance with a legal obligation or our legitimate interests, as applicable.
3.7 Business operations and service improvement
We may use relevant information to troubleshoot technical problems, assess service performance, plan product improvements, conduct internal reporting and improve our operational processes.
Where possible, we will use aggregated or anonymised information for statistical analysis and service improvement.
We will not use identifiable customer content for unrelated product development or other independent purposes unless we have an appropriate legal basis and such use is permitted by the applicable customer agreement and DPA.
Legal basis: Our legitimate interests in maintaining and improving our business and services, subject to applicable law and the rights of individuals.
4. Cookies and similar technologies
Our website may use cookies and similar technologies.
Strictly necessary cookies may be used to enable essential website functions, maintain security and provide services you request. Other cookies, including analytics or marketing cookies, will be used only in accordance with applicable law and any consent requirements.
You can manage your cookie preferences through our cookie settings, where available, and through your browser settings. Disabling certain cookies may affect website functionality.
Where required, we will provide additional information about the cookies used, their purposes, their providers and their retention periods in a separate Cookie Notice or cookie preference interface.
5. Disclosure of personal data
RiskRhino may disclose personal data to the following categories of recipients where necessary and lawful.
5.1 Service providers and subprocessors
We use third-party service providers to support our operations and services. These may include providers of:
Cloud hosting and infrastructure.
IT security, monitoring and technical support.
Business communications and email.
Customer relationship management and support tools.
Website hosting, analytics and cookie management.
Accounting, invoicing and payment services.
Legal, audit and other professional services.
Where a service provider processes personal data on our behalf, we will put appropriate contractual safeguards in place as required by applicable law.
Where RiskRhino acts as a processor for a customer, our use of subprocessors is governed by the applicable DPA or the EULA and the requirements of Article 28 GDPR.
5.2 Microsoft Azure hosting
The RiskRhino platform is hosted using Microsoft Azure infrastructure, with managed hosting located in Ireland.
Personal data processed through the platform may be stored and processed within the configured Azure environment. Processing is confined to Ireland or the European Union (EU).
RiskRhino will take appropriate steps to ensure that any processing and possible transfers comply with applicable data protection law.
Further information about our hosting arrangements and relevant subprocessors may be provided through our contractual documentation or upon request, subject to appropriate confidentiality and security requirements.
5.3 Professional advisers and business partners
We may disclose personal data to professional advisers, auditors, insurers, accountants and other business partners where necessary for legitimate business purposes or to comply with legal obligations.
5.4 Corporate transactions
If RiskRhino is involved in a merger, acquisition, restructuring, financing or sale of assets, personal data may be disclosed to relevant parties where necessary for the transaction, subject to appropriate confidentiality and data protection safeguards.
5.5 Legal requirements and protection of rights
We may disclose personal data where required by law, pursuant to a valid and applicable request from a competent authority, or where necessary to establish, exercise or defend legal claims or protect the rights, security and property of RiskRhino or others.
We will assess such requests in accordance with applicable law.
5.6 No sale of personal data
RiskRhino does not sell personal data as a business activity.
6. International data transfers
RiskRhino is established in the Netherlands, and the RiskRhino platform is hosted on Microsoft Azure infrastructure located in Ireland.
Where personal data are transferred outside the EEA, RiskRhino will ensure that the transfer complies with Chapter V GDPR.
Depending on the circumstances, this may involve:
A European Commission adequacy decision under Article 45 GDPR.
Appropriate safeguards under Article 46 GDPR, such as the European Commission's Standard Contractual Clauses.
Supplementary technical, organisational or contractual measures where necessary.
A specific derogation under Article 49 GDPR, where its conditions are satisfied.
Where required, RiskRhino will assess the circumstances of the transfer and the effectiveness of the safeguards in place.
You may request further information about relevant international transfers and the safeguards used by contacting us using the details in Section 14.
7. Data retention
RiskRhino retains personal data only for as long as necessary for the purposes for which the data were collected, including satisfying legal, accounting, contractual and reporting requirements.
Retention periods depend on the type of data, the nature of our relationship with you, the applicable contract and any relevant legal obligations.
In general:
Business enquiries: Retained for the period necessary to respond to and manage the enquiry and any resulting business relationship.
Customer and account information: Retained for the duration of the relevant contractual relationship and for an appropriate period afterwards where required for legal, accounting, dispute resolution or other legitimate purposes.
Marketing information: Retained until you unsubscribe or object, or until the information is no longer required for the relevant purpose, subject to any necessary suppression records.
Website and security logs: Retained for the period reasonably necessary for security, troubleshooting and operational purposes.
Customer content processed on behalf of customers: Retained and deleted in accordance with the applicable customer agreement and DPA, including applicable deletion and return procedures.
When personal data is no longer required, we will delete or anonymise it, unless retention is required or permitted by law. Where immediate deletion from backups is not technically feasible, the data will be protected and deleted in accordance with the applicable backup lifecycle and retention procedures.
8. Security of personal data
RiskRhino implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.
Depending on the nature of the processing and associated risks, these measures may include access controls, authentication mechanisms, encryption, logging, monitoring, backup procedures, vulnerability management and incident response processes.
We review our security measures periodically and seek to ensure that access to personal data is limited to authorised persons who require access for legitimate business or service delivery purposes.
No system or method of data transmission can be guaranteed to be completely secure. However, RiskRhino works to maintain a level of security appropriate to the risks associated with its processing activities.
9. Your rights under the GDPR
Where RiskRhino acts as a data controller, you may have the following rights under the GDPR, subject to the applicable conditions and exceptions:
Right of access: To obtain confirmation as to whether we process your personal data and, where applicable, access to that data and relevant information about the processing.
Right to rectification: To request correction of inaccurate personal data or completion of incomplete personal data.
Right to erasure: To request deletion of your personal data where the legal conditions are met.
Right to restriction: To request restriction of processing in certain circumstances.
Right to data portability: To receive certain personal data in a structured, commonly used and machine-readable format and, where technically feasible and legally applicable, have it transmitted to another controller.
Right to object: To object to processing based on our legitimate interests. We will assess the objection in accordance with the GDPR. You have an unconditional right to object to processing for direct marketing.
Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Rights relating to automated decision-making: To the extent applicable, you have rights in relation to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
To exercise your rights, please contact us using the details in Section 14.
We may request information reasonably necessary to verify your identity and protect your personal data against unauthorised disclosure. We will respond to requests within the time limits prescribed by the GDPR, generally within one month of receipt. Where permitted, this period may be extended by up to two further months for complex or numerous requests, in which case we will inform you of the extension and its reasons.
We do not normally charge a fee for handling requests. A reasonable fee or refusal may be permitted where a request is manifestly unfounded or excessive, in accordance with the GDPR.
Where RiskRhino acts as a processor and your request concerns personal data processed on behalf of a customer, please contact the relevant customer or organisation in the first instance. We will assist that customer as required by the applicable DPA and law.
10. Right to lodge a complaint
If you believe that our processing of your personal data infringes applicable data protection law, you may contact RiskRhino so that we can investigate your concern.
You also have the right to lodge a complaint with a competent supervisory authority.
As RiskRhino is established in the Netherlands, you may contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), without prejudice to your right to complain to another competent supervisory authority where permitted by the GDPR.
Website: https://autoriteitpersoonsgegevens.nl/
11. Automated decision-making and artificial intelligence
RiskRhino may use software tools and automation to support its business operations and the delivery, security and improvement of its services.
RiskRhino will not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you unless the requirements of Article 22 GDPR are satisfied and the necessary safeguards are in place.
Where AI-enabled functionality is introduced into the RiskRhino platform, the applicable documentation and customer agreements will govern its use and any related processing of customer data. AI tools are hosted on the RiskRhino Azure platform and data is not provided to the AI suppliers for training purposes.
Personal data will not be submitted to third-party AI services for purposes incompatible with the original purpose of collection or the applicable customer agreement.
12. Children's personal data
RiskRhino's website and services are intended primarily for business and professional users and are not directed at children.
We do not knowingly collect personal data directly from children through our website for purposes unrelated to our business services. If we become aware that personal data have been collected unlawfully, we will take appropriate steps to address the situation in accordance with applicable law.
Where customer data processed through our platform relate to children, the relevant customer remains responsible for determining the lawful basis for processing and ensuring compliance with applicable data protection requirements. RiskRhino will process such data in accordance with its contractual obligations and applicable law.
13. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, processing activities, legal obligations or business practices.
The latest version will be published on our website together with its effective or last-updated date. Where required by applicable law, we will provide additional notice of material changes.
14. Contact RiskRhino
If you have questions about this Privacy Notice, wish to exercise your rights or would like further information about our processing of personal data, please contact us using the details below.
Data controller:
Ba-Professional b.v. (dba RiskRhino)
Registered address:
Oetelaarsestraat 49
5481XH Schijndel
The Netherlands
Chamber of Commerce (KVK) number:
17176159
Privacy contact:
Roxana@RiskRhino.com