E.U. Safe Harbor Privacy Policy

Oco, Inc. (Oco) recognizes that privacy is very important to our customers, and we pledge to protect the security and privacy of any personal information that customers provide to us. This includes customer's names, addresses, telephone numbers, email addresses and any information that can be linked to an individual. Not only does Oco strive to collect, use and disclose personal information in a manner consistent with the laws of the countries in which it does business, but it also has a tradition of upholding the highest ethical standards in its business practices. This Safe Harbor Privacy Policy (the "Policy") sets forth the privacy principles that Oco follows with respect to transfers of personal information from the European Union (EU) to the United States.

Safe Harbor

The United States Department of Commerce and the European Commission have agreed on a set of data protection principles and frequently asked questions (the "Safe Harbor Principles") to enable U.S. companies to satisfy the EU law requirement that personal information transferred from the EU to the United States be adequately protected. Consistent with its pledge to protect personal privacy, Oco adheres to the Safe Harbor Principles.

Scope

This Safe Harbor Privacy Policy (the "Policy") applies to all personal information received by Oco in the United States from the EU, in any format including electronic, paper or verbal.

Notice

When Oco directly collects personal information directly from individuals in the EU, it will inform them about the purposes for which it collects and uses their personal information, the types of non-agent third parties, if any, to which Oco discloses that information, and the choices and means, if any, that Oco offers individuals for limiting the use and disclosure of their personal information. Notice will be provided in clear and conspicuous language when individuals are first asked to provide personal information to Oco, or as soon as practicable thereafter, and in any event before Oco uses the information for a purpose other than that for which it was originally collected.

If Oco receives personal information from its customers or other entities in the EU, it will use such information in accordance with any applicable EU Data Transfer Agreement or other agreement provided by such entities and agreed to by Oco.

Choice

Oco will offer individuals the opportunity to choose (opt out) whether their personal information is (a) is to be disclosed to a third party or (b) to be used for purposes other than the purpose for which it was originally collected or subsequently authorized by the individual. Oco does not collect sensitive personal information.

Onward Transfer

Prior to disclosing personal information to a third party, Oco shall notify the individual of such disclosure and allow the individual the choice (opt out) of such disclosure. Oco shall ensure that any third party for which personal information must be disclosed subscribes to the principals or are subject to a law providing the same level of privacy protection as is required by the Safe Harbor principals and agree in writing to provide an adequate level of privacy protection.

Data Security

Oco shall take reasonable steps to protect the information from loss, misuse and unauthorized access, disclosure, alteration and destruction. Oco has put in place appropriate physical, electronic and managerial procedures to safeguard and secure the information from loss, misuse, unauthorized access or disclosure, alteration, or destruction. Oco cannot guarantee the security of information transferred via the internet and as a result will only accept customer data via a secure, encrypted transmission.

Data Integrity

Oco shall only process personal information in a way that is compatible with and relevant for the purpose for which it was originally collected or authorized by the individual. To the extent necessary for those purposes, Oco shall take reasonable steps to ensure that personal information is accurate, complete, current and reliable for its intended use.

Access

Oco shall allow individuals to access their personal information and allow the individual to correct, amend or delete inaccurate information, except where the burden or expense of providing access would be disproportionate to the risks to the privacy of the individual in the case in question where the rights of persons other than the individual would be violated.

Enforcement

Oco will conduct compliance audits to assure compliance with the privacy policy and periodically verifies that its policy is accurate, comprehensive for the information it is intended to be covered, prominently displayed, completely implemented and accessible, and in conformity with the Safe Harbor principals. We encourage interested persons to raise any concerns using the contact information provided and will investigate and attempt to resolve any complaints and disputes regarding use and disclosure of personal information.

Dispute Resolution

Any questions or concerns regarding the use or disclosure of personal information should be directed to Oco’s Privacy Officer at the address given below. Oco will investigate and attempt to resolve complaints and disputes regarding use and disclosure of personal information in accordance with the principles contained in this Policy. For complaints that cannot be resolved between Oco and the complainant, Oco has agreed to participate in the dispute resolution procedures of the panel established by the European data protection authorities to resolve disputes pursuant to the Safe Harbor Principles.

Contact Information

Questions, comments or complaints regarding this Policy or data collection should be submitted to Oco’s Privacy Office by mail or email as follows:
Oco, Inc.
Attn: Privacy Officer
100 Fifth Avenue, 4th Floor
Waltham, MA 02451
privacyofficer@oco-inc.com

Amendments

This Policy may be amended from time to time, consistent with the requirements of the Safe Harbor Principles. Oco will provide appropriate public notice of such amendments.