Privacy Policy

1. General

We, Indoqa Software Design und Beratung GmbH (Opernring 1/E/639, +43 1 236 2828, info@indoqa.com, company registration number: 278314k, commercial court: Commercial Court Vienna, business license: Services in automatic data processing and information technology, GLN of the public administration: 9110016956312, VAT identification number: ATU6268833, authority according to ECG: Magistratic District Office of the I. District), briefly "INDOQA", take the protection of your personal data very seriously and inform you about our processing activities.

With this privacy information, we inform you for what purposes, on what legal basis, for how long, and by involving which service providers ("recipients") we process your (personal) data, and which rights you may have concerning your data when you

i. visit our website (see section 2.),

ii. subscribe to our email newsletter (see section 3.),

iii. are interested in our services (referred to as "prospect", see section 4.),

iv. belong to our clients (see section 5.),

v. use the Indoqa Search Intelligence Platform (see section 6.),

vi. are one of our suppliers or other business partners (see section 7.), or

vii. apply for a job with us (see SECTION 8.),

How we process your personal data depends on which of the above categories you belong to. You can find the respective details in the relevant sections of this privacy information.

2. Data Processing for Our Website

Visitors

When you visit our website and give your consent, we analyze the usage and performance of our internet presence and integrated search applications using Indoqa Search Analytics from the Indoqa Search Intelligence Platform. We collect the following data for this purpose:

Search queries
Selection of search results
Visited subpages
Duration of stay on the respective pages
IP address anonymized
Number of visits
Referrer URL
Device operating system
Device type
Screen resolution
Browser language
Geographic location
Browser type
Cookie ID

You can revoke your consent at any time under "Cookie Settings". The lawfulness of the processing carried out until the revocation is not affected.

We process your data in a personally identifiable manner for up to three years following your visit.

To be able to fulfill the above purposes, we work with service providers (so-called "processors" or "AV"), who process your personal data on our behalf for us and our purposes – but not for their own purposes. These processors include:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen Germany

SCALEWAY S.A.S.
8 rue de la Ville l’Evêque
75008 Paris France

Contact and Registration forms

When you contact us by a contact or registration form, we process the contact details you provide, such as your name, email address, your organisation, the message, as well as the response data we generate, in order to answer your inquiry, and thus for the performance of pre-contractual actions that follow upon your inquiry (Article 6(1)(b) GDPR).

If you do not provide us with the relevant personal data, we are unfortunately unable to process your inquiry.

We process your personal data until three years after the response (legitimate interests due to possible claims for damages).

To fulfill the purposes mentioned above, we work with service providers (so-called "processors" or "AV"), who process your personal data on our behalf for us and our purposes – but not for their own purposes. These processors include:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen Germany

QualityHosting AG
Uferweg 40-42
D-63571 Gelnhausen, Germany

3. Data Processing for Our Email Newsletter Subscribers

If you have given us your consent to receive our email newsletter, we process the personal contact details you have provided, such as your first and last name, your email address, and your newsletter language preference, to send you our email newsletter with a personal salutation. In specific instances, we also process additional information, namely which newsletters have been sent to you and which ones you have clicked on, or whether the email newsletter could not be delivered to you (e.g., because your email address no longer exists).

If you do not provide us with the relevant personal data, we are unfortunately unable to send you our newsletter.

In this case, we rely on your consent to receive the email newsletter (Article 6(1)(a) GDPR in conjunction with § 174(3) of the Austrian Telecommunications Act, "TKG"), which you can revoke at any time by either clicking on the unsubscribe link included in every email newsletter or by sending a corresponding email to info@indoqa.com. Your revocation does not affect the legality of our data processing activities until we receive your revocation (Article 7(3) GDPR).

We process your personal data until the consent is revoked.

If you are among our consulting or cloud service customers and have not opted out of receiving our email newsletter, we also process your first and last name, your email address, and your newsletter language to send you our email newsletter with a personal salutation. In specific instances, we also process additional information, namely which newsletters have been sent to you and which ones you have clicked on or whether the email newsletter could not be delivered to you (e.g., because your email address no longer exists or your email address is listed on the "RTR-Robinson list").

In this case, we rely on our legitimate interests (Article 6(1)(f) GDPR in conjunction with Recital 47 GDPR and § 174(4) TKG). In this case, too, you can cancel our email newsletter at any time by either clicking on the unsubscribe link included in every email newsletter or by sending a corresponding email to info@indoqa.com, from which your request is evident. To simplify administration, we ask you to use the subject "INDOQA-Newsletter-Unsubscribe" for such an email. Your cancellation does not affect the contractual relationship between you and INDOQA, nor the legality of our related data processing activities until we receive your objection (Article 21 GDPR).

We process your data personally until three years after the end of the contractual relationship (legitimate interests) or until objection.

CleverReach GmbH & Co. KG
Schafjückenweg 2
26180 Rastede Germany

4. Data Processing for Our Prospects

When you contact us by phone, post, or email with an inquiry, we process the contact details you provide, such as your academic title, first and last name, email address, your position at the inquiring company, your address or the address of the inquiring company, as well as the response data we generate, in order to answer your inquiry, and thus for the performance of pre-contractual actions that follow upon your inquiry (Article 6(1)(b) GDPR).

If you do not provide us with the relevant personal data, we are unfortunately unable to process your inquiry.

We process your personal data up until three years after the response (legitimate interests due to possible claims for damages).

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen Germany

QualityHosting AG
Uferweg 40-42
D-63571 Gelnhausen, Germany

5. Data Processing for Our Customers

When you place an order with us, we process your personal data, such as your academic title, first and last name, email address, your position at the contracting company, your address or the address of the company that is our customer, as well as your or the company’s billing and payment information (such as the name and BIC/SWIFT of the paying bank, the IBAN of the account from which our invoices are settled) and the data we generate to fulfill the contract (we do not – at least not systematically – process data that were not collected from the data subject or generated by us (see Article 14 GDPR and/or Article 22 GDPR)), to carry out pre-contractual actions (e.g., provision of an honorarium or advance payment) or to fulfill our contractual obligations from the commissioning relationship (Article 6(1)(b) GDPR).

If you do not provide us with the relevant personal data, we are unfortunately unable to enter into a contractual relationship with you.

We process your personal data up until seven years after the end of the contract (corporate, professional, or tax law retention obligations).

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen Germany

QualityHosting AG
Uferweg 40-42
D-63571 Gelnhausen, Germany

6. Data Processing for the Indoqa Search Intelligence Platform

To use the Indoqa Search Intelligence Platform, it is necessary to register with INDOQA and create accounts for all users. To ensure login, the following personal data are stored:

First name, last name, and, if applicable, company name
Address
Payment details
Tax numbers
Username
Email address
Password

We process this data based on Art. 6(1) sentence 1 lit. b GDPR to fulfill our contractual obligations.

If you do not provide us with the relevant personal data, we are unfortunately unable to enter into a contractual relationship with you.

We process your personal data up until seven years after the end of the contract (corporate or tax law retention obligations).

In addition to the mentioned data, we process further data relevant for the provision and billing of our service, such as log-ins, change logs of usage data. The processing and storage of the mentioned data are necessary for the conclusion of the contract and its fulfillment and are therefore legitimized under Art. 6(1) sentence 1 lit. b) GDPR. We store the data for the duration of the contract term and subsequently for another 14 days. After that, the data are irretrievably deleted.

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen Germany

SCALEWAY S.A.S.
8 rue de la Ville l’Evêque
75008 Paris France

7. Data Processing for Our Suppliers and Other Business Partners

If you supply us with goods and/or services, or are otherwise our business partner (but not one of our consulting clients or cloud service customers), we process your personal data, such as your academic title, first and last name, email address, your position at the respective company, your address or the address of the company that is our supplier/business partner, as well as your or the company’s billing and payment information (such as the name and BIC/SWIFT of the bank and the IBAN of the account to which we settle your invoices) and the data we generate for contract fulfillment (we do not – at least not systematically – process data that were not collected from the data subject or generated by us (see Article 14 GDPR and/or Article 22 GDPR)), to carry out pre-contractual actions (e.g., making an advance payment on our part) or to fulfill our contractual obligations from the contract relationship (Article 6(1)(b) GDPR) as well as to comply with our legal obligations (Article 6(1)(c) GDPR).

If you do not provide us with the relevant personal data, we are unfortunately unable to enter into a contractual relationship with you.

We process your pesonal data up until seven years after the end of the contract (corporate or tax law retention obligations).

Hetzner Online GmbH
Industriestr. 25 91710
Gunzenhausen Germany

QualityHosting AG
Uferweg 40-42
63571 Gelnhausen, Germany

8. Data Processing for Our Applicants

When you apply for a position at Indoqa, we process the personal data you provide in your application letter and resume, such as your academic title, first and last name, email address, address, and career history, to carry out pre-contractual measures, such as initiating an employment or substitution contract (Article 6(1)(b) GDPR).

If you do not provide us with the relevant personal data, we are unable to consider your application.

We process your personal data up until seven months after the conclusion of the application process or rejection (legitimate interest due to possible claims for damages under equality law).

If you give us your consent to keep you on file, we process your mentioned personal data for the purpose of keeping records. In this case, we rely on your consent to keep records (Article 6(1)(a) GDPR), which you can revoke at any time by sending us an email to info@indoqa.com, where your revocation does not affect the legality of our data processing until we receive your revocation (Article 7(3) GDPR).

Hetzner Online GmbH
Industriestr. 25 91710
Gunzenhausen Germany

QualityHosting AG
Uferweg 40-42
63571 Gelnhausen, Germany

9. Regarding the Storage Duration

See the storage duration mentioned above for each processing activity.

We generally store your personal data only as long as it is necessary for the fulfillment of the respective purpose for which your personal data were collected.

For tax reasons, we store contract documents as well as the associated documents and communications that concern our contractual relationships with suppliers/business partners (but not customers) for a period of seven years (§ 132 of the Austrian Federal Tax Code, "BAO").

If you have subscribed to our email newsletter, we store your relevant personal data until we receive your revocation of this consent (see section 3.1, above) or your unsubscription from the email newsletter (see above, section 3.2).

If you have applied for a job with us and we have not entered into a contractual relationship, we delete your personal data seven months after receiving your application unless you have agreed to be kept on file. If we have entered into an employment or substitution contract with you, our employee data protection information applies, which we will gladly communicate to you upon your hiring and which you can also request during the application process.

10. Your Rights as a Data Subject Under Data Protection Law

As a data subject under data protection law, we would like to inform you of your following rights:

Right of Access, detailed in Article 15 GDPR: Every data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed; if that is the case, access to the personal data (a copy of the personal data undergoing processing) and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence or not of automated decision-making, including profiling. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

Right to Rectification and Erasure, detailed in Article 16 GDPR: The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. Furthermore, the data subject has the right to have personal data concerning them erased without undue delay, and the controller is obliged to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based, and where there is no other legal ground for the processing; (c) the data subject objects to the processing; (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services (consent of a child). The right to erasure does not apply where processing is necessary for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, and/or for the establishment, exercise or defence of legal claims.

Right to Restriction of Processing, detailed in Article 18 GDPR: The data subject has the right to obtain from the controller restriction of processing where one of the following applies: (a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use; (c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or (d) the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject. Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. A data subject who has obtained restriction of processing shall be informed by the controller before the restriction of processing is lifted.

Right to Data Portability, detailed in Article 20 GDPR: Where the processing is based on consent or on a contract and the processing is carried out by automated means, the data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format. They also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where technically feasible.

Right to Object, detailed in Article 21 GDPR: The data subject has the right to object, on grounds relating to their particular situation,