Privacy Policy

Introduction

At Gantara, we believe technology should empower people and organisations without compromising privacy, security, or digital sovereignty.

Gantara is a brand operated by Dunetrails BV and provides digital collaboration, communication, storage, and productivity services, including but not limited to file storage, document sharing, email, collaboration, meetings, and online workspaces.

This Privacy Policy explains how we collect, use, process, store, and protect personal data when you use Gantara websites, services, applications, and platforms (collectively, the "Services").

By using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

Dunetrails BV
Schauwegemstraat 37
9090 Merelbeke-Melle
Belgium

VAT: BE1032145326

hello@dunetrails.com

Throughout this document, "Gantara", "we", "our", and "us" refer to Dunetrails BV and its Gantara services.

2. Scope of this Policy

This Privacy Policy applies to:

• Gantara websites
• Gantara Drive
• Gantara Calendar
• Gantara Meet
• Gantara Workspace
• The Gantara data migration feature (importing data from Google and Microsoft accounts)
• Customer support services
• Prospect and customer communications
• Events, webinars, and newsletters

Certain services may be subject to additional agreements, including Master Service Agreements, Subscription Agreements, and Data Processing Agreements.

If such agreements conflict with this Privacy Policy, those agreements will prevail.

3. Controller and Processor Roles

Depending on the service being provided, Dunetrails BV may act as either:

Data Controller

For:

• Website visitors
• Marketing communications
• Newsletter subscribers
• Event registrations
• Customer and supplier administration
• Account creation and billing

Data Processor

For customer content stored or processed through Gantara services. Examples include:

• Files stored in Gantara Drive
• Emails hosted through Gantara Mail
• Calendar data
• Collaboration data
• User-generated content
• Data you import from your Google or Microsoft account (see section 8)

When acting as a Data Processor, we process personal data solely on behalf of our customers and according to their documented instructions.

4. Our Privacy Principles

We built Gantara around the following principles:

• Privacy by Design
• Privacy by Default
• Data Minimisation
• Transparency
• Security by Design
• European Digital Sovereignty
• Customer Ownership of Data
• Respect for User Rights

We do not sell personal data. We do not monetise customer content. We do not use customer content for advertising purposes.

5. Information We Collect

Account Information

When you create an account, we may collect:

• Name
• Email address
• Telephone number
• Organisation name
• Billing information
• Authentication preferences

Technical Information

When accessing the Services, we may collect:

• IP address
• Device identifiers
• Browser information
• Operating system information
• Access timestamps
• Login events
• Audit trail information

Usage Information

To operate and improve our Services, we may collect:

• Service usage statistics
• Feature interactions
• Security events
• Service performance metrics
• Error logs

Communications

If you contact us, we may process:

• Email correspondence
• Support requests
• Contact form submissions
• Meeting requests
• Recorded support interactions where applicable

6. Your Content

Our services are designed to allow you to create, store, manage, share, and collaborate on information. We refer to this information collectively as "Your Content."

Your Content may include:

• Files
• Documents
• Images
• Videos
• Emails
• Calendars
• Contacts
• Notes
• Chat messages
• Shared workspace information
• Data you import from your Google or Microsoft account

Ownership

You retain ownership of Your Content. Nothing in this Privacy Policy transfers ownership rights to Gantara.

Access to Your Content

We only access Your Content when necessary to:

• Operate the service
• Provide technical support
• Resolve incidents
• Maintain security
• Comply with legal obligations
• Follow your instructions

We do not inspect customer content for advertising purposes. We do not sell customer content.

7. Metadata

To operate the Services, we may process information related to Your Content. Examples include:

• File names
• File sizes
• Upload timestamps
• Modification timestamps
• User permissions
• Sharing settings
• Collaboration activity
• Audit logs

This information is processed solely to provide, secure, and improve the Services.

8. Data Imported from Google and Microsoft Accounts

Gantara lets you import your own data from your Google account or your Microsoft account (OneDrive) into your Gantara account, using the "Data migration" page in your personal settings. This only happens when you connect your account and start an import yourself. You can disconnect at any time.

What Google user data we access

With your permission, Gantara accesses the following Google user data. All access is read-only.

What Microsoft user data we access

With your permission, Gantara accesses your OneDrive files, contacts, calendars, mailbox time zone setting (to import calendar events in the correct time zone) and basic profile. All access is read-only.

How we use this data

We use this data only to copy it into your own Gantara account at your request: files into your Gantara storage, contacts into Gantara Contacts, and calendars into Gantara Calendar. We do not use it for any other purpose. Gantara never modifies, deletes, or shares anything in your Google or Microsoft account.

Sharing, transfer, and disclosure

We do not sell, share, transfer, or disclose Google user data to third parties. Google user data is not used for advertising, including targeted, personalised, retargeted, or interest-based advertising, and is not provided to data brokers or information resellers or used for credit or lending purposes.

Humans do not read Google user data, except with your explicit consent, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the data has been aggregated and anonymised.

The imported copy is stored on Gantara's European infrastructure (OVHcloud) and is protected in the same way as the rest of Your Content.

Artificial intelligence

Google user data obtained through Google Workspace APIs is not used to develop, improve, or train generalised or non-personalised artificial intelligence and/or machine learning models.

How we protect this data

Data from Google and Microsoft is transferred over encrypted connections (TLS) and stored on Gantara's European infrastructure, with the security measures described in section 16 "Security", including access controls, encryption at rest where supported, and audit logging. The access tokens that allow Gantara to read your data are stored only in your Gantara account and are used only for imports you start.

Retention and deletion

• Access tokens are kept only while your Google or Microsoft account is connected. They are deleted when you click "Disconnect" on the Data migration page, or when your Gantara account is closed.
• You can also revoke Gantara's access at any time at https://myaccount.google.com/permissions (Google) or https://account.live.com/consent/Manage (Microsoft).

Imported copies become part of Your Content, which you control. You can delete them at any time, and they are deleted when your account is closed, as described in section 18 "Account Closure and Data Deletion".

Limited Use

Gantara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

9. Organisation Administrators

If your account is part of an organisation, designated administrators may have access to administrative controls and account information. These administrators may be able to:

• Manage user accounts
• Reset passwords
• Configure services
• View activity logs
• Manage sharing permissions

Administrator access is determined by your organisation's policies and not by Gantara. Questions regarding administrator access should be directed to your organisation.

10. Why We Process Personal Data

We process personal data for the following purposes:

To Provide Services

• Account management
• Authentication
• File storage
• Collaboration
• Email delivery
• Calendar services
• Importing your data from Google or Microsoft at your request
• Customer support

To Maintain Security

• Threat detection
• Fraud prevention
• Abuse prevention
• Incident response
• Access logging

To Meet Legal Obligations

• Tax obligations
• Accounting obligations
• Regulatory compliance
• Lawful government requests

To Improve Services

• Service performance analysis
• Platform enhancements
• Reliability improvements

Google user data is only used to provide the import you requested, as described in section 8. It is not used for the other purposes in this section.

11. Artificial Intelligence

Gantara does not use customer files, emails, messages, documents, meetings, or stored content to train public artificial intelligence models.

Google user data obtained through Google Workspace APIs is never used to develop, improve, or train generalised or non-personalised artificial intelligence and/or machine learning models (see section 8).

Should AI-powered functionality be offered within the Services, we will clearly communicate:

• What information is processed
• Why it is processed
• Which providers are involved
• What controls are available to customers

12. Digital Sovereignty

Digital sovereignty is a core principle of Gantara. Where commercially and technically feasible, we prioritise:

• European infrastructure
• European-operated providers
• European-owned technology vendors
• Data processing within the European Union

We continuously evaluate suppliers against privacy, security, and sovereignty criteria.

13. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• Adequacy Decisions
• Other GDPR-approved mechanisms

14. Sharing Information

We do not sell personal information. We may share information with carefully selected service providers that help us operate the Services, including:

• Hosting providers
• Infrastructure providers
• Security and monitoring providers
• Backup providers
• Payment providers
• Professional advisers

All relevant providers are contractually bound to appropriate confidentiality and data protection obligations.

Google user data is not shared with third parties, as described in section 8.

15. Government Requests

We will only disclose customer information when legally required to do so. Any request received from public authorities will be reviewed for:

• Legal validity
• Scope
• Necessity
• Proportionality

Where legally permitted, we will notify affected customers before disclosing information. We oppose requests that are unlawful, overly broad, or inconsistent with applicable European privacy legislation.

16. Security

We implement technical and organisational measures designed to protect personal data. These measures may include:

• Encryption in transit
• Encryption at rest where supported
• Multi-factor authentication
• Access controls
• Security monitoring
• Vulnerability management
• Backup procedures
• Audit logging

No security measure can guarantee absolute protection, but we continuously improve our security posture.

17. Data Retention

We retain personal data only for as long as necessary. Typical retention periods include:

Longer retention periods may apply where required by law.

18. Account Closure and Data Deletion

When an account or service is terminated:

• Customer data, including imported data and any stored Google or Microsoft access tokens, will be deleted or anonymised within a reasonable period;
• Data may remain in backup systems for a limited period;
• Certain records may be retained where required by law or legal obligations.

You can request deletion of your data at any time via hello@dunetrails.com. Customers may request information about data deletion timelines applicable to their service.

19. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Withdraw consent
• Request data portability
• Lodge a complaint with a supervisory authority

Requests can be submitted via: hello@dunetrails.com

20. Cookies

We use cookies and similar technologies to:

• Operate the website
• Protect security
• Remember preferences
• Improve user experience
• Analyse service performance

Non-essential cookies are only used where required consent has been obtained. Further information is available in our Cookie Policy.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in legislation
• Changes in technology
• Changes in our services
• Changes in how we access, use, or store Google or Microsoft user data

The latest version will always be published on this page, with the "Last Updated" date at the top. If changes materially affect your rights, or change how we use Google user data, we will provide reasonable notice before they take effect.

Contact

Gantara
A brand of Dunetrails BV

Schauwegemstraat 37
9090 Merelbeke-Melle
Belgium

VAT: BE1032145326

hello@dunetrails.com