Aikido
Start for Free
No CC required

Aikido Privacy Policy

Last updated

October 2026

Table of Contents

1. Introduction

This Privacy Policy explains how Aikido Security BV (Keizer Karelstraat 15, 9000 Ghent, Belgium) ("Aikido", "we" or "us") processes personal data of anyone engaging with us, including visitors and users of our websites, whether accessed via aikido.dev or noon.security (together, the "Website"), and our platform (the "Platform"), and our (prospective) customers. It sets out how we collect, use, share and otherwise process your Personal Data (as defined below), and your rights and choices in that regard. As an EU-based company that treats privacy as a core principle, Aikido uses the EU General Data Protection Regulation (GDPR) as the benchmark for its company-wide privacy program. Given our global activities, this Privacy Policy also reflects the principles of other applicable data protection laws (such as the California Consumer Privacy Act of 2018 and the UK Data Protection Act 2018), either through GDPR alignment or through provisions specifically added below.

2. Processing activities

We collect and process Personal Data such as name, job title, employer and business contact details, in the context of the activities described below. For each activity we set out what we process, why, and on which legal basis.

‍

2.1 When you visit our website

‍

When you visit our Website, we process Personal Data by automated means (cookies, web server logs, web beacons and similar technologies) to administer and secure the Website, diagnose server issues, analyze visitor trends, and improve our services.

We may in particular collect:

  • IP addresses;
  • the region or general location from which your device accesses the internet;
  • browser type and operating system;
  • the date, time and duration of your visit and the pages you view;
  • other usage information about your use of the Website.

Processing through analytical cookies is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via our cookie banner. Processing through strictly necessary cookies and log data is based on our legitimate interest in a secure, well-functioning Website (Art. 6(1)(f) GDPR). See our Cookie Policy for more details.

‍

2.2 When you contact us or send us a request

‍

To enable us to communicate with you when we receive a question, complaint or other request, we process the following categories of Personal Data:

  • your identity data (such as name, function/title, employer, postal address, telephone or mobile number and e- mail address);
  • identity and message data submitted through any contact form on our Website (such as your name, e-mail address and the content of your message);
  • complaints, enquiries and any related correspondence.

The processing of your Personal Data for this purpose is based on our legitimate interest in being able to provide you with a good service and to answer your request (Art. 6(1)(f) GDPR). When you contact us with a request, it is also in your interest that we process your Personal Data in order to provide you with the information or service you have requested, and the Personal Data is necessary for us to be able to handle and answer your request.

‍

2.3 When you become an Aikido prospect

‍

When you engage with us as a prospective customer, for example by requesting a demo, trial or quote, we process Personal Data to qualify you as a prospect, manage our sales pipeline, and take the steps necessary to enter into an agreement with you.

We may in particular process:

  • details of contact persons at your organization (such as name, function/title, telephone number and e-mail address) involved in the evaluation or procurement process;
  • correspondence and notes exchanged with our sales, pre-sales and onboarding teams in the context of demos, proof-of-concepts, trials, quotes and contract negotiations;
  • where applicable, information necessary to perform know-your-customer, anti-money-laundering, sanctions screening or credit checks prior to entering into a contract.

The processing of your Personal Data for the purposes of taking steps at your request prior to entering into a contract is necessary for the pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

The processing of Personal Data of contact persons at your organization, and the processing of Personal Data for the purposes of qualifying prospective customers, managing our sales pipeline and following up on demos, trials and quotes, is based on our legitimate interest in developing our business and entering into customer relationships (Art. 6(1)(f) GDPR).

Where we carry out know-your-customer, anti-money-laundering, sanctions screening or similar checks, and where we process Personal Data for accounting, tax and other regulatory record-keeping purposes, the processing is based on compliance with our legal obligations (Art. 6(1)(c) GDPR) and/or our legitimate interest in preventing fraud and ensuring the integrity of our customer base (Art. 6(1)(f) GDPR).

‍

2.4 When you use the Aikido Services

‍

When you or your organisation's authorised users access or use the Platform and Services as a customer or trial user, we process Personal Data of the individual users of the Services to operate the Services and to provide customer support. We may in particular process:

  • name and business e-mail address;
  • user and workspace identifiers;
  • support conversations and attachments, and telephone support recordings, where you contact our support team;
  • IP address, device and browser data generated automatically through your use of the Services;
  • service e-mail delivery and engagement data (such as whether a service or availability notification was delivered or opened).

This Personal Data is processed to receive, triage and resolve support requests, and to send service and availability notifications relating to the Services. This processing is necessary for the performance of our contract with your organisation, or, for trial users, for the pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In addition, to set up and administer your account and provide our Services, and to handle billing, accounting and tax obligations, we process:

  • account registration data (such as username, login credentials and authentication data) created when you sign up for a trial or a customer account on the Platform;
  • financial and payment data such as banking details, invoices and payment terms, as well as any Personal Data necessary to process billing information;
  • VAT or tax identification numbers, where the Services require such information.

This processing, and the processing of Personal Data for the purposes of following up on your order, managing the customer relationship and handling issues and requests, is necessary for the performance of our agreement with you (Art. 6(1)(b) GDPR), or, depending on the type of request, based on our legitimate interest in providing good customer service (Art. 6(1)(f) GDPR).

Where we carry out know-your-customer, anti-money-laundering, sanctions screening or similar checks, and where we process Personal Data for accounting, tax and other regulatory record-keeping purposes, the processing is based on compliance with our legal obligations (Art. 6(1)(c) GDPR) and/or our legitimate interest in preventing fraud and ensuring the integrity of our customer base (Art. 6(1)(f) GDPR).

Using the Aikido Services may also mean that Aikido is granted access to Personal Data in its capacity as a data processor, acting on the documented instructions of the customer as data controller (including, where applicable, e-mail communication, employee data and other Personal Data made available to Aikido in connection with your use of the Platform). Such processing is governed by the data processing agreement entered into between Aikido and the customer.

We retain this Personal Data for as long as your account remains active, and for 200 days after deactivation of your account, after which it will be deleted or anonymised, unless a longer retention period is required by applicable law.

‍

2.5 When you sign up for newsletters or participate in a promotion, event, survey or marketing campaign

‍

To enable us to contact you for the purpose of newsletters, promotions, events, surveys or marketing campaigns we organize, we process the following categories of Personal Data:

  • your identity data (such as name, function/title, employer, telephone or mobile number and e-mail address);
  • survey responses you provide;
  • data relating to your preferences for receiving newsletters or information about events and promotions.

The processing of Personal Data for newsletters, promotions, events, surveys or marketing campaigns is based on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by contacting us at privacy@aikido.dev or by using the unsubscribe link included in each marketing e-mail we send you. Where we send marketing communications, including product updates, about our own similar products and services to existing customers, we may rely on our legitimate interest in promoting our business (Art. 6(1)(f) GDPR), subject to your right to object at any time; where you are a prospect or are not an existing customer, we will only send you such communications based on your consent (Art. 6(1)(a) GDPR). We retain this Personal Data until you withdraw your consent or unsubscribe, after which we will delete or anonymise it, save to the extent we are required to retain a record of your withdrawal.

‍

2.6 When you buy merch

‍

When you request Aikido-branded merchandise through our merch request form, we process the following categories of Personal Data:

  • your name;
  • your business e-mail address;
  • your employer/company name;
  • any additional information you choose to provide in your request.

The processing of your Personal Data for this purpose is necessary for the performance of our agreement to provide you with the merchandise you requested (Art. 6(1)(b) GDPR), or, where no such agreement is concluded, based on our legitimate interest in being able to follow up on your request (Art. 6(1)(f) GDPR).

‍

2.7 When you apply for a position at Aikido

‍

For the purpose of candidate selection, placement and employment, we process the following Personal Data:

  • your identity data (such as name, postal address, telephone or mobile number and e-mail address);
  • other information you provide to us when you apply for a position with Aikido, such as cover letters, CV, references and information about your education and professional experience;
  • notes taken during interviews, as well as, as the case may be, results of any performed cases or tests as part of the recruitment process;
  • other relevant publicly available information such as information shared on your Linkedin profile.

The processing of your Personal Data is necessary for taking steps at your request prior to entering into a contract with you and, where applicable, for the performance of an employment contract (Art. 6(1)(b) GDPR). The processing of Personal Data that is not strictly necessary to take such steps, including the retention of your application file in our recruitment reserve, is based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

Where you are not selected, we retain your application file for nine months after our decision not to proceed, as part of our recruitment reserve, unless you withdraw your consent to such retention earlier.

3. Do we share your personal data?

It is our policy not to give, sell or otherwise distribute Personal Data we collect to third parties outside of Aikido, except where required with your consent or where this is necessary and in accordance with applicable law.

  • Aikido group entities. We may share your Personal Data with affiliated entities of Aikido for the purposes specified in the "Processing activities" section above and as described under the "International data transfers" section below.
  • Third party service providers (processors). Your Personal Data may be disclosed to third party service providers acting on our behalf, in connection with hosting and cloud storage, the operation of the Platform, data analytics, customer support, finance, accounting and other administrative services, marketing services, and information technology support. These service providers have access to and process Personal Data only on our behalf, on documented instructions and subject to appropriate confidentiality and security obligations.
  • Other data recipients. For the purposes set out above or where otherwise required by law, we may also need to make Personal Data available to third parties such as professional advisers, banks and financial institutions, auditors, independent consultants, potential or actual investors, acquirers or joint-venture partners (in connection with a merger, acquisition, sale, joint venture, corporate reorganisation, stock or asset sale, or other change in corporate control involving all or any part of Aikido), and to regulatory, administrative or judicial authorities, courts and police authorities. The sharing of such information shall be on an as-needed basis and, where possible, pseudonymized. You should also be aware that we may disclose specific information about you where necessary to comply with the law, to enforce an agreement we have with you, or where we believe in good faith that it is necessary to protect our rights, property or safety, or the rights, property or safety of our employees, customers or the public, including in response to properly made requests for the prevention or detection of crime, the apprehension or prosecution of offenders, or the safeguarding of national security. In each such case, we will act in accordance with applicable data protection law.

We may share with third parties certain pieces of aggregated, anonymised data, such as how our customers use the services, Platform or Website. Such information does not identify you individually.

4. International data transfers

In the performance of our contract with you or in providing our services, Platform or Website to you, we may need to transfer your Personal Data to recipients located outside the European Economic Area ("EEA") where different privacy rules may apply. In any such case, in accordance with Articles 45 and 46 GDPR, we will only transfer Personal Data to recipients that provide an adequate level of data protection (for example, in jurisdictions covered by a European Commission adequacy decision) or, in the absence of an adequacy decision, by implementing appropriate safeguards as permitted by applicable data protection laws, including by entering into the European Commission-approved Standard Contractual Clauses. These clauses are contractual commitments between the parties transferring Personal Data, binding them to protect the privacy and security of the data and to ensure that the Personal Data is processed with a level of protection essentially equivalent to that guaranteed within the European Union.

Where necessary, we will implement supplementary technical and organisational measures to ensure an adequate level of protection. For more information, or to request a copy of the safeguards we have put in place, please contact us at the contact details below.

For more information or if you have any questions, please contact us at privacy@aikido.dev

5. Your rights

The European Union’s General Data Protection Regulation (GDPR) and other countries’ privacy laws (such as the California Consumer Privacy act of 2018, or the UK Data Protection act 2018) provide certain rights for data subjects, including the following:

  • Right to be informed.
  • Right of access.
  • Right to rectification.
  • Right to erasure.
  • Right to restrict processing.
  • Right to data portability.
  • Right to object.
  • Rights related to automated decision-making, including profiling.
  • Right to withdraw consent.
  • Right to lodge a complaint.

You can exercise your rights at any time, free of charge, by sending a written and signed request, accompanied by proof of identity, to privacy@aikido.dev or to the postal address set out in the "Contact" section below. We will respond to your request without undue delay and in any event within one (1) month of receipt of the request. That period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests; we will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay. If we are unable to respond to a request, we will inform you of the reasons for not taking action.

Without prejudice to your right to seek any other administrative or judicial remedy, you also have the right to lodge a complaint with a competent supervisory authority if you consider that the processing of your Personal Data infringes applicable data protection laws. In Belgium, you may contact the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.

For questions or complaints concerning the processing of your personal data, you can email us at privacy@aikido.dev

6. How do we secure your personal data?

We take the security of your Personal Data seriously. We have implemented appropriate technical and organisational measures designed to protect the Personal Data we process against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for your rights and freedoms. These measures include, where appropriate, encryption of Personal Data in transit and at rest, strict access controls, segregation of environments, logging and monitoring, ongoing security testing of the Platform, and incident response procedures. We also impose contractual confidentiality and security obligations on our staff and on our service providers.

7. Children’s data

Our Website, Platform and services are not directed at children under the age of 16, and we do not knowingly collect Personal Data from children under that age. If you believe that we may have collected Personal Data from a child under 16, please contact us so that we can take appropriate steps to delete that information.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the services we offer, or in applicable law. The version date is indicated at the top (or bottom) of this Privacy Policy. We will take reasonable steps to inform you of any material changes via the Website or by other appropriate means. Where a change requires it under applicable law (for example, where we change the lawful basis for a processing activity that relies on your consent), we will ask you to re-consent to the amended Privacy Policy before continuing the relevant processing.

9. Contact

If you have any questions, comments or complaints about this Privacy Policy or about how we process your Personal Data, or if you wish to exercise any of your rights, you can contact Aikido’s privacy officer as follows:

  • Via email: privacy@aikido.dev
  • Via regular mail: Keizer Karelstraat 15, 9000 Gent (Belgium)