Privacy Policy

1Controller

If you have concluded a contract with Indicium Technologies GmbH or have given your consent to that company, the controller within the meaning of data protection law is

Indicium Technologies GmbH
Große Johannisstraße 7
D-20457 Hamburg

Contact: 040 / 5936173019

In all other cases in which you use services of the Indicium group directly and not via your employer or principal, in particular when generally using the website www.indicium.ag, the controller within the meaning of data protection law is

Indicium Technologies AG
Rothusstraße 21
CH-6331 Hünenberg

(hereinafter both "Indicium").

We also operate the software Indicium Digital Analyst (IDA) ("Software") on behalf of companies that use the Software's functionalities to carry out background checks. If you use the Software as an employee or contractor of such a company, your employer or principal is the controller within the meaning of data protection law. In that case, please inform yourself about the processing of your personal data by your employer or principal.

2Data protection contact

For questions regarding data protection and the exercise of your data subject rights, you can reach us at: datenschutz@indicium.ag.

3Data subject rights

As a person affected by data processing carried out by Indicium, you are entitled to the following rights, subject to the respective statutory requirements:

• the right to confirmation as to whether we process your personal data (Art. 15 GDPR),
• the right to information about the personal data we process and to a copy of that data (Art. 15 GDPR),
• the right to rectification if your personal data is inaccurate (Art. 16 GDPR),
• the right to erasure of your personal data (Art. 17 GDPR),
• the right to restriction of processing (blocking) of your personal data (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR).

If your personal data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you may also object to the processing concerned under the conditions of Art. 21(1) GDPR. You may object to the processing of your personal data for direct marketing purposes at any time, without stating reasons and with effect for the future (Art. 21(2) GDPR). If the processing is based on your consent (Art. 6(1)(a) GDPR, Art. 9(2)(a) GDPR), you may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR). For questions or complaints about data protection at Indicium and to exercise your data subject rights, you can contact our data protection contact at any time (datenschutz@indicium.ag).

4Storage period and erasure of your personal data

We erase your personal data as soon as its processing is no longer necessary for the purposes explained in this privacy policy; unless, in the event of your objection, there are overriding legitimate grounds on Indicium's side for continued processing (Art. 21(1) GDPR), or, in the event of a withdrawal of your consent, another legal basis for the processing exists.

If and as long as statutory retention obligations prevent erasure, we restrict the processing of your data to this archiving purpose (so-called blocking) and erase your data after the retention period expires. Typical retention periods under German commercial and tax law are six years from the end of the year for business letters (including e-mails) and ten years from the end of the year for accounting-relevant data.

5Recipients of personal data

We may transfer your personal data for the purposes described in this privacy policy to service providers whom we commission with specific, purpose-bound data processing operations on the basis of data processing agreements (Art. 28 GDPR) (e.g. hosting, IT support).

6Data transfers to third countries

We may transfer your personal data to recipients in countries outside the European Union and the European Economic Area, in particular to Switzerland and the USA. Adequacy decisions exist for Switzerland and the USA (EU-US Data Privacy Framework (DPF)) (Art. 45 GDPR). Where no adequacy decision exists or where it does not apply (for the USA, for example, where the data importer is not certified), we agree the EU Standard Contractual Clauses (SCC) with the recipient in the third country and, where necessary, additional measures to ensure an adequate level of data protection.

7Data processing when generally using our website

When you visit the Indicium website, we collect and process internet connection data (see a.) as well as certain telemedia and usage data stored in the browser of your device (see b.).

a. Internet connection data

When you visit the Indicium websites, we process the internet connection data automatically transmitted to our server by your browser. This includes your IP address and further usage data (e.g. date and time of access, name of the page accessed, volume of data transferred, and the requesting provider). We need this information to enable you to use our website, for example by adapting the website to the technical requirements of your device.

This internet connection data may also constitute personal data. The legal basis for this data processing is our legitimate interest in the security and usability of our website (Art. 6(1)(f) GDPR).

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes the aforementioned internet connection data on our behalf on the basis of a data processing agreement (Art. 28 GDPR); processing in the USA is safeguarded in accordance with section 6.

b. Cookies

We use cookies on the Indicium website. Cookies are text files that the browser stores on your device. Pseudonymous user-related data can be stored in these files. This data can subsequently be read out again. In certain cases, information is stored on your device or information already stored there is accessed. This is strictly necessary for us to be able to provide the software on our website for your use ("necessary cookies").

In these cases, within the scope of application of the German TDDDG (Telecommunications Digital Services Data Protection Act), access to your device takes place on the basis of § 25(2) no. 2 TDDDG. Insofar as this information relates to an identified or identifiable person and is further processed by us in our IT systems, the legal basis for this data processing is our legitimate interest in providing our website and ensuring data security (Art. 6(1)(f) GDPR). If you are already registered on one of our websites and the data processing serves the performance of the contract, the legal basis is Art. 6(1)(b) GDPR.

In addition — provided you have given your express consent — we use cookies and tracking technologies for analytics and marketing purposes (e.g. to measure the performance of advertisements or for technical integration via Google Tag Manager). In these cases, your data is processed on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future in the cookie settings.

Use of the Meta Pixel

Provided you have given your express consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta") on our website. The Meta Pixel enables us to measure the effectiveness of our advertisements and to show visitors to our website interest-based advertising on Meta platforms (Facebook, Instagram). In this context, data (including IP address, device and browser information, event data) may be transmitted to Meta and may also be passed on to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (see section 6).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time with effect for the future in the cookie settings.

Use of HubSpot

We use HubSpot, a service of HubSpot Ireland Ltd., 1 Sir John Rogerson's Quay, Dublin 2, Ireland, for our customer relationship management (CRM), online meeting booking and — provided you have given your consent — for analysing website usage. Processing takes place in HubSpot's EU data centre; a transfer to HubSpot, Inc. in the USA cannot be excluded (safeguarded in accordance with section 6).

The legal basis for website tracking is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); for meeting booking, the implementation of pre-contractual measures (Art. 6(1)(b) GDPR) or our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR).

You can view the purpose and storage duration of the cookies used at any time in the cookie settings, where you can also withdraw any consent given.

8"Self-check" of the Indicium Digital Analyst (IDA) software

As a user, you can test the software Indicium Digital Analyst (IDA) ("Software") with your own data as part of a "self-check" for commercial purposes. The Software is an open-source intelligence (OSINT) tool. It serves to carry out background checks on the user. For this purpose, you enter your name, your date of birth and, where applicable, further data from your CV into the Software. On the basis of the user data entered, the Software searches sources on the internet worldwide and provides you with the findings in a consolidated report. The sources searched may include in particular:

• results of a general internet search (e.g. via Google or Bing),
• press publications,
• credit and information agencies (e.g. LexisNexis),
• public registers (e.g. commercial and insolvency registers),
• official sanctions lists of the EU, the EU member states and third countries (e.g. the USA),
• professional social platforms (e.g. LinkedIn, Xing),
• private social platforms (e.g. Facebook, Instagram).

In principle, any personal data of the user may be the subject of data processing in the "self-check". In particular, it cannot be ruled out that special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. concerning political opinions, religious or philosophical beliefs, or trade union membership) are collected and made available to you via the report, insofar as you have published this information on the internet.

If you wish to carry out the self-check, you must register. We first collect your e-mail address and send you a confirmation e-mail with a confirmation link, which you must click to complete the registration; in addition, two-factor authentication must be set up.

The legal basis for the "self-check" is your consent as a user (Art. 6(1)(a) GDPR, Art. 9(2)(a) GDPR). You may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

9Registration of a user account

As part of your registration for a user account, we collect and process, to the extent necessary, your name, your company details and e-mail address, and the password you have chosen. If a contract exists with the user, the legal basis for this data processing is the initiation and performance of the usage contract concluded with the user (Art. 6(1)(b) GDPR). If you register as a representative, contact person or employee of a company that is our customer or other business partner, the legal basis for the processing is our legitimate interest in the initiation and performance of the respective contractual relationship (Art. 6(1)(f) GDPR).

10Newsletter and e-mail marketing

If you wish to receive our newsletter and sign up for it, we collect your e-mail address via the sign-up form. In the newsletter, we inform you about products and services of the Indicium group, in particular about the software Indicium Digital Analyst (IDA).

We process your data for this purpose exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You may withdraw your consent to the newsletter at any time with effect for the future. A link for declaring your withdrawal can be found in every e-mail. The contact details for declaring your withdrawal can also be found in section 1.

11Contacting us / contact form

When you contact us (e.g. via the contact form on the website or by e-mail), personal data is processed exclusively for the purpose of handling and responding to your enquiry and only to the extent necessary for this, in particular surname, first name, e-mail, telephone number, company and position. The legal basis for the processing of this data is our legitimate interest in responding to your enquiry and in assessing whether it is a business enquiry (Art. 6(1)(f) GDPR).

For the technical transmission of the forms embedded on the website, we use the service FormSubmit (formsubmit.co). The data you enter is transmitted to our e-mail inbox via this service; processing in the USA cannot be excluded (safeguarded in accordance with section 6).

12No automated individual decision-making

We do not make any decisions based solely on automated processing of your data that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

13Changes to this privacy policy

New legal requirements, business decisions or technical developments may make changes to this privacy policy necessary. The privacy policy will then be amended accordingly. You will always find the current version on our website.