Privacy Policy

4Viso BV is a private limited company incorporated under Belgian law, registered with the Crossroads Bank for Enterprises under number 1027.105.086, with its registered office at Science Park Antwerp, Galileilaan 15, 2845 Niel, Belgium. Email: info@4viso.com.

4Viso operates a business-to-business software-as-a-service platform for governance, risk, and compliance management, including shipping-lane risk intelligence, supply-chain audit management, compliance-scheme and guideline management, and certificate management.

4Viso acts in two roles, and which one applies decides which document governs.

If you use the platform under a contract between your employer and 4Viso, your employer's privacy notice also applies to what your employer does with your data.

3.1 Data you give us

3.2 Data we collect automatically

3.3 Data we receive from others

• Your organization or a 4Viso customer: your name and business contact details when an administrator adds you as a user or when a customer asks the platform to invite you or your organization (see Section 7).
• Stripe: tokenized payment confirmation and subscription status.
• Zoho CRM: sales and account-relationship data for customers and prospects.
• Single sign-on providers: identity claims (name, email) when your organization uses SSO.

The purposes below are those for which 4Viso is the controller. They correspond to Section 15.4 of the Software Subscription Agreement.

Where we rely on legitimate interests we have carried out a balancing test and concluded that our interests do not override your rights and freedoms. You can ask for a summary of a balancing test at info@4viso.com. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

4Viso generates anonymized, aggregated, and de-identified data from use of the platform and uses it for security, product improvement, research, and benchmarking. That data does not identify any customer, user, or other individual, and we do not disclose it in a form that identifies a customer (Section 7.4 of the Agreement). Once data is anonymized it is no longer personal data.

The platform is designed so that organizations can be discovered and audited. By default, part of an organization's profile is visible to other platform users, may appear in search results within the platform and on 4Viso's public pages, and may be indexed by external search engines. 4Viso cannot control reuse of that information once it has been indexed externally.

Visible by default

• Organization name, registered address, and primary contact information. Where the primary contact is a named person, their business name, role, business email address, and business phone number are part of the public profile.
• Organization type, industry sectors, and service locations.
• Certifications and compliance schemes held.
• Logistics service types.

Private by default

Everything else, including audit records, risk assessments, internal notes, and non-public documents, is private and governed by the customer's role-based access control settings. The platform's shareability settings let a customer decide which items of its private information are shared, and with which other users or organizations. 4Viso acts on that configuration and does not decide what a customer shares.

Your choices

The organization's administrator controls which optional profile information is published and can nominate a role-based mailbox rather than a named individual as the primary contact. If your personal details appear on a profile and you believe they should not, ask your administrator or contact info@4viso.com. You can object to this processing under Article 21 GDPR.

The platform sends invitations and notifications when a customer or one of its users asks it to, for example inviting you to join that customer's account, inviting your organization to become a subsidiary in the customer's group, or inviting your organization to join an ecosystem or compliance scheme that the customer operates, using a member or contact list the customer maintains.

• Who is responsible. The customer decided to contact you and is the controller of your contact details. 4Viso sends the message as the customer's processor under the Data Processing Agreement. The customer's privacy notice applies.
• What the message tells you. The message may say that it is sent on the customer's behalf, identify the customer, state where your contact details came from, and include 4Viso's company identification.
• Refusing further invitations. The message offers a way to refuse further invitations. If you use it, 4Viso records your email address and the date on a suppression list and will not send you further invitations. 4Viso keeps that suppression record as controller, because it is the only way to honor your choice across customers.

We do not sell or rent personal data. We share it only as described here.

8.1 Service providers (sub-processors)

The following providers process personal data for us. Customers can request the Data Processing Agreement, which lists them with entity details and transfer mechanisms, at info@4viso.com.

8.2 Other recipients

• Your organization: other authorized users in your account see your data according to your organization's RBAC settings, and your administrator can see account and audit information about you.
• Other platform users: the public profile fields described in Section 6, and any private information your organization chooses to share through its shareability settings.
• Legal disclosure: where required by applicable law, court order, or a regulatory authority, or to protect the rights, property, or safety of 4Viso, our customers, or the public.
• Business transfers: in a merger, acquisition, or sale of assets, personal data may be transferred to a successor subject to equivalent protections. We will tell you if that happens.

Data that is no longer required is deleted or irreversibly anonymized. On termination of a subscription, the customer may ask for earlier deletion of platform content, except where retention is required by law.

The platform is hosted on Amazon Web Services in a single region within the European Union. Where personal data is transferred outside the European Economic Area, for example when our development partner in India maintains and supports the platform, or to Stripe's US infrastructure or Zoho's India infrastructure, we rely on one or more of the following:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914);
• an adequacy decision of the European Commission; or
• approved Binding Corporate Rules.

A copy of the applicable safeguards is available on written request to info@4viso.com.

We apply technical and organizational measures proportionate to the risk, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access control, multi-factor authentication, security testing integrated into our development pipeline, logging of access to the platform, and an ISO 27001-aligned management system (certification in progress). Customers can request more detail on these measures at info@4viso.com.

Under the GDPR you have the following rights. To exercise them, email info@4viso.com with the subject "Privacy / DPO Request". We respond within one month, extendable by two further months for complex requests, in which case we will tell you.

If your request concerns data that a customer uploaded into the platform, we will pass it to that customer, who is the controller, and help them respond.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the right to know what personal information we collect, use, and disclose, to delete it, to correct it, and not to be discriminated against for exercising these rights. 4Viso does not sell personal information or share it for cross-context behavioral advertising, and we honor the Global Privacy Control signal. We do not collect sensitive personal information for purposes other than those the law permits.

In the preceding 12 months we collected these categories of personal information: identifiers, commercial information, internet or other electronic network activity, and professional or employment-related information. To submit a verifiable request, email info@4viso.com. We respond within 45 days, extendable by a further 45 days with notice.

We use essential cookies for sign-in, security, and session management, functional storage for your interface preferences, and, with your consent, analytics from Google Analytics 4 and Mixpanel. We do not use advertising or cross-site tracking cookies. You can change your choices at any time through the Cookie Settings link in the footer. The list below shows every cookie we use, with its purpose and lifetime.

The platform is a professional business service and is not directed at anyone under 18. We do not knowingly collect personal data from minors. If you believe we have done so, contact info@4viso.com and we will delete it.

We may update this policy to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top changes each time. For material changes we notify account administrators by email, or by a prominent notice in the platform, at least 14 days before the change takes effect. This policy is a notice about our own processing. It does not change the Software Subscription Agreement, which is amended only as that Agreement provides.

Data Protection Officer
4Viso BV, Science Park Antwerp, Galileilaan 15, 2845 Niel, Belgium
Email: info@4viso.com (subject: "Privacy / DPO Request")

Belgian Data Protection Authority
Gegevensbeschermingsautoriteit / Autorité de protection des données
Rue de la Presse 35, 1000 Brussels
www.dataprotectionauthority.be