Privacy statement for the AnnTac apps

This statement applies to AnnTac Dock for Outlook, the My AnnTac mobile app and the Orbit app. It supplements AnnTac's general privacy statement and is the shared privacy URL for Microsoft AppSource, Apple App Store and Google Play.

1. Who is responsible

AnnTac B.V., Eemnesserweg 1/24, 1221 CS Hilversum, the Netherlands, is responsible for account, contact, security and service data. If you use an app through an organisation, that organisation will generally be the controller for archive, case-file and conversation content. AnnTac processes that content on the organisation's behalf under a data processing agreement.

2. Data processed by the apps

Depending on the app and the features you use, we process:

• your name, business email address, organisation, account and access details;
• device, operating system, app version, IP address and technical logs for security and troubleshooting;
• a sign-in token, language and functional preferences on your device;
• documents, images, emails, attachments and case-file metadata that you select, capture or upload;
• in Orbit: messages, participants, attachments, tasks and technical delivery or read states needed for secure communication.

3. AnnTac Dock for Outlook

Dock only archives the email or selection that you activate. Sender, recipients, subject, date, headers, message body, attachments, selected status and note may be sent to the AnnTac archive. Dock does not read your mailbox in the background or scan unselected messages. “Save to this computer” creates the file locally and does not send it to AnnTac. Dock does not use Microsoft Graph and does not store your Outlook password.

4. My AnnTac

My AnnTac provides access to your organisation's archive. It processes the documents and case-file details that you view, search, scan, photograph or upload. The camera or photo library is accessed only when you choose that feature and after the operating system has requested permission. A local sign-in token keeps you signed in until you sign out or access is withdrawn.

5. Orbit

Orbit brings messages, documents and tasks together around a customer or client case file. It processes participant identity, the relationship with the organisation or case file, messages, files, scans, tasks and required status data. Camera, photo library and notifications are used only for the selected feature and with device permission. If you enable notifications, Apple or Google may process a technical device token to deliver them; notification content is limited to what delivery requires.

6. Purposes and legal bases

We process data to perform the agreement, manage accounts and access, securely deliver and archive documents and communication, provide support, prevent abuse and comply with legal obligations. The apps request permission where optional device features require it. AnnTac does not sell personal data or use client content for advertising, data brokerage or training public AI models.

7. Hosting, recipients and transfers

Core data and client content are stored on AnnTac infrastructure in Dutch data centres and transmitted over encrypted connections. Only staff and service providers who need access for management, security or support receive it under appropriate agreements. Technical delivery data handled by app stores and push services is also subject to Apple, Google or Microsoft terms. We limit it to what is technically necessary.

8. Retention and deletion

The GDPR does not prescribe one general fixed retention period. Data is kept for as long as necessary for its purpose and applicable legal obligations. AnnTac applies the following principles:

• case-file content is retained under the documented retention policy and legal duties of the client organisation;
• a My AnnTac or Orbit account remains linked to the client case file while the guardian or other responsible organisation needs that access. After a verified instruction, access is withdrawn immediately and the separate service profile is deleted or anonymised within 30 days where possible;
• regular technical and security logs are kept for no more than 90 days by default. Relevant logs may be retained for up to 12 months, or for the duration of the case, where needed for a security incident, fraud investigation or legal obligation;
• an Orbit pilot application is deleted after withdrawal or no later than 24 months after the last meaningful contact;
• deleted data may remain temporarily in secured backups until the normal backup cycle expires.

A client account forms part of a case file managed by the guardian or other responsible organisation. The client cannot independently erase the underlying case-file data. A closure or deletion request can be initiated on the account and access deletion page. The responsible organisation decides which case-file data it must legally retain; AnnTac carries out its instructions.

9. Security

AnnTac uses encrypted connections, access controls, logging, monitoring, backups and separated privileges. Client content is limited to authorised users. No security measure removes every risk; report suspected misuse immediately to info@anntac.eu.

10. Tracking, advertising and children

The apps contain no advertising networks and do not track you across apps or websites for marketing. They may process crash and performance diagnostics supplied by the operating system, app store or an enabled technical diagnostics service. These data are used only for operation, security and troubleshooting, not advertising. The apps are business services and are not intended for children to create accounts independently.

11. Your rights

You may request access, correction, deletion, restriction, portability or object to processing. For data managed in AnnTac by your employer or service provider, first submit the request to that organisation. You may also contact AnnTac. You have the right to lodge a complaint with the Dutch Data Protection Authority.

12. Contact and changes

AnnTac B.V.
Eemnesserweg 1/24, 1221 CS Hilversum, the Netherlands
info@anntac.eu · +31 (0)35 2400 210

We update this statement when an app, permission or processing activity changes. The date above shows the latest revision.