Privacy policy
This information describes data processing related to the public website and business use of MANDO OS, a solution developed by S2Risk.
Last updated: 16/09/2026
1. Responsibility and scope
S2Risk is responsible for the data it collects to manage the website, respond to inquiries and administer relationships with users and companies.
Customer companies determine the purposes of the employment and operational information they enter into MANDO OS. S2Risk provides the technology service within the agreed scope and instructions. The allocation of responsibilities must be documented in the service conditions.
2. Contact and registration data
We may process the information you provide when contacting S2Risk, registering a company or requesting help: name, company, email, job title, phone number and request content.
Requesting a quote by email opens your email application. The website does not need employment documents or sensitive information to prepare a commercial inquiry.
3. Business and employment data
Depending on enabled modules, a company may enter worker identities, employment relationships, contracts, attendance, assignments, training, payroll and onboarding information.
The company must inform its workers, limit information to what is necessary and have the appropriate authorization or other basis. The presence of a field does not mean it should be completed with data that is not applicable.
4. Documents, location and information requiring special care
Files may contain identity documents, employment records or other confidential information. Operational functions may record location or evidence where the workflow, configuration and device permissions allow it.
Health, biometric and other sensitive information requires a specific assessment of necessity, permissions and legal basis before use. It must not be submitted through the public website or included in a quotation request.
5. Purposes
Information is used to provide and administer the service, manage access, connect business records, process requests, retain evidence of relevant actions and communicate necessary notices.
Contact information is used to respond to inquiries and coordinate the requested relationship. Any additional use must be explained and supported by an appropriate basis.
6. Basis and authorization
Processing must rely on valid authorization from the individual or another basis permitted under applicable law. Using the website does not by itself authorize unrestricted processing of any data.
When a company enters third-party information, it is responsible for checking the basis, explaining the purposes and keeping the information under its control current.
7. Security and technical records
Session, abuse-prevention and audit functions may process IP addresses, browser information, dates, times, account or session identifiers and actions performed. Such records are not described as anonymous where they can link activity to a person.
MANDO OS includes company- and role-based access controls, download restrictions, versioning and auditing. No measure completely eliminates the risk of an incident.
8. Cookies and analytics
The site uses necessary session and security mechanisms and retains cookie choices. Your selected language is retained in the session to serve the experience you requested, without a separate cookie.
This version does not include visitor analytics tools or advertising trackers. Internal operational indicators are generated from business records and are only available to authorized users. Consult the Cookie policy for available controls.
9. Access, providers and disclosures
Information is intended for authorized users and personnel who need to intervene to provide the service. Visibility depends on role, company and access purpose.
Operations may require hosting, email and support services. Their scope, location and conditions must be disclosed in the relevant service relationship; this page does not claim that all information stays within a particular country. Disclosures required by an authority must be assessed under applicable law.
10. Retention
Retention periods depend on purpose, applicable obligations and service conditions. Records should not be kept indefinitely simply because storage is available.
Deletion or anonymization must consider applicable employment, contractual, security and evidence-retention obligations. Document histories are not automatically deleted when a version is replaced.
11. Requests about your data
You may request information about your data, correction, and deletion or restriction where legally applicable. Write to the S2Risk contacts listed on this page, explaining your request without sending unnecessary sensitive documents.
If your employer or another customer company entered the information, a response may need to be coordinated with that company and your identity or authority verified. A deletion request does not permit removal of information that must legitimately be retained.
12. Account security
Use personal credentials, protect the associated email account and do not share verification codes. Report suspected unauthorized access through the available channels.
Business recovery requires verification and is not granted solely on an informal request.
13. Updates and contact
This information will be updated when processing or relevant conditions change. Check the date and version shown on the page.
The published S2Risk contacts receive inquiries and help route privacy requests; no unconfirmed individual function is assigned to any address.