Onde Website Privacy Policy

Last Updated: September 28, 2026

1. Who we are and what this Policy covers

Ondemand Apps OÜ, registration number 14521027, an Estonian company (“Onde”, “we”, “us”), is the controller of the personal data described in this Policy. You can contact us at hi@onde.app or at our postal address.
This Policy covers our websites onde.app and onde.com (“Website”) and the enquiries, demo and trial requests, subscriptions and business correspondence that start there. It applies to visitors, prospective and existing customers and the people who represent them. Our processing is subject to Regulation (EU) 2016/679 (the “GDPR”).
This Policy does not cover:
- personal data we process on behalf of our Clients in the Onde platform and apps, such as My Hub, Operator App, Driver App and Customer App. Our agreement with each Client governs that processing.
- job and contractor applications, which are covered by our Recruitment and Contracting Privacy Policy.
- Onde's own ride-hailing service for passengers and drivers if any, which is covered by its own privacy notice.
This Policy replaces all earlier privacy policies for the Website.

2. What we collect and why

We collect the data you give us through forms, chat, calls and emails, and technical data from your device when you use the Website. We may also receive your business contact details (name, business email and phone, company and role) from colleagues who contact us on your behalf, from clients who introduce you to us and from public professional sources such as company websites and business registers.
Table 1 sets out what we process, why and on which legal basis.

Table 1. Purposes, data and legal bases

Purposes	Data	Legal basis (GDPR)
Answering enquiries, arranging demos and trials, managing business relationships and passing your enquiry to a company related to Onde that serves your market	Name, business email and phone, company, role, business type and stage, goals, fleet size, monthly order volume, correspondence, how you reached the Website (referring page, campaign)	Our legitimate interest in answering business enquiries and developing relationships with the organisations you represent (Art. 6(1)(f)). Where you act as a sole proprietor: steps you request before entering into a contract (Art. 6(1)(b))
Operating and securing the Website	IP address, device and browser data, timestamps, error reports, the anti-bot check on forms	Our legitimate interest in a secure and working Website (Art. 6(1)(f))
Analytics and testing	Pages viewed, clicks, referring pages, online identifiers, the test version you see, session recordings of how you scroll, move and click	Consent (Art. 6(1)(a))
Marketing emails	Email address, name, company, subscription choices. With your consent, which emails you open and which Website pages you visit	Consent (Art. 6(1)(a)), or the existing-customer exception in clause 3.1
Advertising	Online identifiers and Website activity. Your email address and phone number in hashed form, only if you tick “personalized ads”	Consent (Art. 6(1)(a))
Privacy requests and legal matters	Consent records, requests, objections, correspondence	Legal obligation (Art. 6(1)(c)). Our legitimate interest in respecting objections and in establishing, exercising or defending legal claims (Art. 6(1)(f))

3. Fields marked as required are needed to handle your request. Without them, we cannot answer it. Submitting a form is not consent to marketing, analytics or advertising.

3. Marketing, advertising and cookies

We send marketing emails only with your consent. One exception applies: if you or your company bought our services and gave us your email address in that context, we may email you about our own similar services unless you objected when we collected it. We use this exception only where the e-marketing rules of your country allow it. You can unsubscribe or object free of charge at any time through the unsubscribe link in every email or at hi@onde.app .
Where our marketing emails or our email tool measure opens, clicks or Website visits, we do so only with your consent.
With your consent to advertising cookies, advertising tools on the Website use your activity and online identifiers to measure our campaigns and show you our ads. If you also tick “personalized ads” in a form, we send your email address and phone number in hashed form to the advertising platforms listed in the Recipient Register, so that they can match you with their users. You can withdraw this consent at any time by switching off advertising cookies in Cookie settings or by writing to us.
Our forms use Google reCAPTCHA to check that a submission comes from a person. It reads information about your browser and device when you use a form. Google processes this data only on our behalf. We treat this check as strictly necessary for the form you chose to use.
Optional analytics, testing and advertising tools run only after you consent to the relevant purpose. Strictly necessary technologies run without consent where the law allows it. Our banner lets you accept, reject or customize optional technologies. You can open Cookie settings at any time from the bottom of every page to see their purposes, providers and lifetimes and to change your choice. You do not need to accept optional cookies to send an inquiry or request a demo or trial.

4. Recipients and international transfers

We share personal data with the recipients listed in the Recipient Register, which forms part of this Policy. Service providers process data only on our instructions under data processing agreements. Advertising platforms act as independent or joint controllers for the activities stated in the Register. We also pass enquiries to companies related to Onde when your enquiry concerns a market they serve, including outside the EEA. From that point each of them acts as a separate controller for its own dealings with you.
We may also disclose personal data to courts, competent authorities and our legal advisers where the law requires it or where it is necessary to establish, exercise or defend legal claims.
Some recipients are located outside the European Economic Area (“EEA”), in particular in the United States and the United Kingdom, or can access data from there. For the United Kingdom we rely on the Commission adequacy decision (Implementing Decision (EU) 2021/1772, as amended by Implementing Decision (EU) 2025/2574). For recipients in the United States certified under the EU-U.S. Data Privacy Framework we rely on Implementing Decision (EU) 2023/1795. For other transfers we use the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, with supplementary measures where required.

5. Retention

We keep personal data only for the periods in Table 2. After that, we delete it or irreversibly anonymize it.

Table 2. Retention periods

Data	Retention period
Enquiries and CRM records	24 months after our last contact with you. If you become a customer: for the duration of the business relationship and 3 years after it ends
Marketing subscriptions	Until you unsubscribe or withdraw consent. After that we keep only your email address and the date on a suppression list, so that we do not contact you again
Technical logs and error reports	90 days. Records of a specific security incident are kept until it is closed
Analytics and testing data	14 months
Advertising audiences	180 days after your last visit, or until you withdraw consent, whichever is earlier
Consent records and privacy requests	5 years after the consent ends or after our reply
Records needed for a legal claim	Until the claim is finally resolved

6. Your rights

Right to object. You may object at any time, without giving reasons, to the use of your data for direct marketing, including related profiling. We will then stop. You may also object, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.
Subject to the conditions of the GDPR, you may also request access to your data and a copy of it, rectification, erasure, restriction of processing and, where processing is based on consent or contract and carried out by automated means, data portability. You may withdraw consent at any time, in Cookie settings, through the unsubscribe link or at hi@onde.app , without affecting the lawfulness of earlier processing.
To exercise your rights, write to hi@onde.app . This address also handles requests about data we have passed to companies related to Onde. If we have reasonable doubts about your identity, we may ask for the information necessary to confirm it.
You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, or with the supervisory authority of the EEA country where you habitually reside or work or where the alleged infringement took place. Where processing is joint, you may exercise your rights against either controller.

7. Changes to this Policy

We may update this Policy. The current version and its date are published on the Website. We will inform you of material changes in an appropriate way, for example by email or by a notice on the Website.