Last updated: December 2025
Disso cares about your privacy and treats your personal data as confidentially as possible.
The protection of your privacy and your personal data is an extremely serious matter for us. We collect, store and use your personal data only in accordance with the contents of this privacy statement ("Privacy Statement") and the applicable regulations on data protection, in particular the provisions of the General Data Protection Regulation ("GDPR") and the national data protection provisions.
This Privacy Statement explains what personal data is collected and processed, for what purposes, how long we keep personal data, what your rights are in this regard and how you can contact us.
This Privacy Statement applies, inter alia, to (i) our website disso.ai (hereinafter our "Website") and Disso platform (hereinafter our "Platform"), and the services and activities associated with it and (ii) all relationships through any other means of communication between you and us in which Disso acts as data controller.
For clarity: Disso acts as a data controller only for the limited personal data described above (such as website interactions, contact details, account information, and demo access). Any personal data processed through a client’s use of the Disso platform—whether hosted by Disso or deployed inside the client’s own cloud environment—is processed by Disso solely as a data processor under the relevant DPA and contractual terms.
Disso Security, a private limited company, with registered office at Juliaan Dillensstraat 10, 2018 Antwerpen, Belgium and registered in the Belgian Crossroads Bank for Enterprises under the number 1016.749.842 (hereinafter "Disso", "we" or "us"), is responsible for processing your data as described in this Privacy Statement.
Please note that Disso is a data controller, which means that we have a direct responsibility to you in relation to the processing of your personal data in the situations covered by this Privacy Statement. This Privacy Statement relates solely to our relationship with you as a data controller (for example, when you visit our Website, communicate with us, or when we manage contract and billing information).
It is important to clarify that Disso is not the data controller of the personal data processed through the Disso services (such as employee communications or other personal data handled by our Gen-AI communication security functionality). For all use of the Disso platform—whether delivered as a hosted SaaS service, a private deployment inside a client’s cloud environment, or any other implementation—the client determines the purposes and means of the processing and therefore acts as the data controller. Disso acts as the data processor solely in accordance with the applicable contractual documentation, including the Subscription Agreement, Data Processing Agreement, and, where relevant, the Architecture Documentation for private deployments. These documents govern how personal data is processed within the service.
Personal data is data that can be used to directly or indirectly identify natural person. We may collect and process personal data in various ways, e.g. when:
Usually, you give us your personal data yourself. Sometimes we receive your contact details through third parties, e.g:
We may also find, update, supplement and improve your data through public sources (e.g. Crossroads Bank for Enterprises, etc.) and social networks (e.g. LinkedIn, etc.).
The above relates only to personal data that Disso processes as a data controller (e.g., website interactions, contact details, demo access, etc.). Any personal data processed through a client’s use of the Disso platform is handled by Disso solely as a data processor under the applicable DPA and contractual terms. Disso does not extract or copy employee communication data from a client’s environment unless expressly instructed and contractually agreed.
You have several rights:
If you wish to exercise any of the rights listed above, please contact us by e-mail or post using the details below (under title 2.5).
When you make a request to exercise your rights, we will first verify your identity through the appropriate and least privacy-intrusive means. We do this to prevent your data from falling into the wrong hands.
The exercise of your rights is in principle free of charge. If your request is manifestly unfounded or excessive, we may charge you a reasonable fee in light of the administrative costs incurred by us. In such cases, however, we may also choose not to comply with your request. You will be notified of the reasons for this, if applicable.
In any case, we will always inform you of the outcome of your request no later than within one month. For complex or multiple requests, this period may be extended by two months, but we will also inform you of this necessary extension within the initial month.
Please note that the above relates only to personal data for which Disso acts as a data controller (such as website, account, and contact information). Personal data processed through the Disso platform—whether hosted by Disso or deployed privately inside a customer’s cloud environment—is controlled by the customer. In those cases, your rights should be exercised with your employer or the relevant enterprise customer, who is the data controller for that processing.
For the exercise of your rights, for any questions or complaints related to the processing of personal data, you can always contact us:
You can also file a complaint with the supervisory authority in the location where you reside. For Belgium, this is the Data Protection Authority:
For more information regarding complaints and remedies, we invite you to consult the Data Protection Authority's website: gegevensbeschermingsautoriteit.be/burger/acties/klacht-indienen.
Under what circumstances Disso collects, uses or otherwise processes different categories of personal data from you, for what purpose, on what legal basis, for what period and with whom it is shared, is described below.
Disso provides Gen-AI driven email and communication security, giving your business more control over its communication safety and protecting it against modern cyber threats.
As controller, Disso may collect and process one or more of the following personal data about your representatives and contacts:
However, we will never collect more personal data from you than is strictly necessary to achieve the purposes for which we have collected your personal data.
Disso processes the above personal data for the following purposes:
Disso processes the personal data listed above on the following legal grounds:
Disso will retain your personal data for a period of 6 months after the completion of the service or termination of the agreement. This retention period allows us to handle any post-service inquiries, complaints, or administrative follow-ups.
In certain cases, we may retain your personal data for a longer period, including but not limited to the following situations:
In pursuit of these purposes, we may disclose your personal data to:
This section covers only the personal data for which Disso acts as a data controller. Any personal data processed through the Disso platform, whether in our SaaS cloud or in your private deployment, is processed under your control as the data controller, with Disso acting as your data processor as defined in the DPA.
Disso may collect and process one or more of the following personal data:
However, we will never collect more personal data from you than is strictly necessary to achieve the purposes for which we have collected your personal data.
Disso processes the above personal data for the following purpose:
Disso processes the personal data listed above on the following legal basis:
We keep your personal data for 3 years after completion of the service, unless Disso is required by law to keep the data longer.
In pursuit of this purpose, we may disclose your personal data to:
Disso may collect and process one or more of the following personal data:
However, we will never collect more personal data from you than is strictly necessary to achieve the purposes for which we have collected your personal data.
Disso processes the above personal data for the following purposes:
Disso processes the personal data listed above on the following legal grounds:
Disso will not retain your personal data for longer than necessary for the purposes for which they were collected. The following retention periods apply:
In pursuit of these purposes, we may disclose your personal data to:
Disso may collect and process one or more of the following personal data:
However, we will never collect more personal data from you than is strictly necessary to achieve the purposes for which we have collected your personal data.
Disso processes the above personal data for the following purposes:
Disso processes the personal data listed above on the following legal grounds:
Disso will delete applicants' personal data no later than 4 weeks after the end of the application process unless the applicant has given his/her express consent to keep his/her data for a longer period. In that case, Disso will keep the personal data for a period of 1 year, after which the applicant will be asked whether he/she wishes to renew his/her consent.
In pursuit of these purposes, we may disclose your personal data to:
Disso may collect and process one or more of the following personal data:
However, we will never collect more personal data from you than is strictly necessary to achieve the purposes for which we have collected your personal data.
Disso processes the above personal data for the following purposes:
Disso processes the personal data listed above on the following legal grounds:
Disso will delete participants' personal data no later than 5 years after the activity unless the participant has given his/her express consent to keep his/her data for a longer period.
In pursuit of these purposes, we may disclose your personal data to:
We may update this Privacy Statement from time to time. Therefore, we encourage you to consult it regularly so that you are aware of any changes.
Last updated: December 2025