identiqaCyberattacks end here.
24/7 Incident Response

This privacy policy explains which personal data we process when you visit the website www.identiqa.com, for which purposes and on which legal basis we do so, and which rights you have. It is provided in accordance with Article 13 of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), each as amended, including by the Data (Use and Access) Act 2025.

1. Who is responsible

The following companies are joint controllers within the meaning of Article 26 UK GDPR for the processing described in this policy:

  • Identiqa Inc., 1440 Broadway, Oakland, CA 94612, United States
  • Identiqa Europe Operations Ltd., 1 Ballycoolin Rd, Ballycoolen, Dublin, D15 AKK1, Ireland

The two companies have entered into an arrangement that sets out which of them meets which data protection obligations, in particular informing data subjects and responding to their requests. We will make the essence of this arrangement available to you on request. The arrangement also governs the processing of data between the two companies and their respective rights and obligations. Access to personal data is logged and reported between the companies. Identiqa Inc. complies with requests from individuals who are protected by the UK GDPR and handles them in accordance with it.

You may exercise your rights against either company. The central point of contact for all privacy requests is:

  • Email: privacy.uk@identiqa.com
  • Postal address: Identiqa Europe Operations Ltd., 1 Ballycoolin Rd, Ballycoolen, Dublin, D15 AKK1, Ireland

2. Principles of processing

2.1 Scope

We process personal data only to the extent necessary to operate a functioning and secure website and to handle your requests. We use services that set cookies or record your behaviour (Google Analytics, Matomo and Microsoft Clarity) only with your consent. In addition, we evaluate server log data and the information from your requests in aggregated form; see the sections “Server log files” and “Contacting us” for details.

2.2 Legal bases

We rely on the following legal bases:

  • Article 6(1)(a) UK GDPR, where you have given consent. Regulation 6 of PECR additionally applies to storing information on your device and accessing it.
  • Article 6(1)(b) UK GDPR, where processing is necessary to perform a contract or to take steps prior to entering into a contract.
  • Article 6(1)(c) UK GDPR, where we are subject to a legal obligation.
  • Article 6(1)(f) UK GDPR, where processing is necessary for our legitimate interests and these are not overridden by your interests or fundamental rights and freedoms.

2.3 Retention

We delete personal data as soon as the purpose of the processing no longer applies. We retain data for longer only where statutory retention obligations apply, for example under company and tax law, or where the data is needed to establish, exercise or defend legal claims. Where fixed periods apply, they are stated for each processing activity below.

3. Providing the website

3.1 Server log files

Each time the website is accessed, our systems automatically record the following data from the requesting device:

  • IP address (shortened where technically possible)
  • date and time of access
  • the address requested and the referring address (referrer)
  • browser and operating system used
  • internet service provider

This processing is necessary to deliver the website, to keep it stable, and to detect and defend against misuse and attacks.

In addition, we transfer the log data to central systems of Identiqa Inc. in the United States. There it is aggregated and processed by downstream systems for evaluation purposes, in particular for statistics on the operation and use of the website. No cookies are set and no information is read from your device for this purpose.

Legal basis: Article 6(1)(f) UK GDPR. Our legitimate interest lies in the secure and stable operation of the website and its evaluation and improvement on the basis of aggregated data. You may object to this processing; see the section “Your rights” for details.

Retention: log files on the delivering servers are generally deleted after seven days, unless a security incident requires longer retention for investigation. We keep the log data transferred to the central systems, and the evaluations derived from it, for as long as they are needed for the purposes stated, and delete them afterwards.

3.2 Hosting and delivery

The website is operated on infrastructure owned by the Identiqa group. Our central servers are located in the United States (State of New Jersey). The website for visitors in Europe is delivered from servers in the Netherlands, which are operated by Identiqa Europe Operations Ltd. The cooperation between the two companies is governed by the arrangement described in the section “Who is responsible”. Data from the operation of the website, from audience measurement and from your requests is transferred to the central systems of Identiqa Inc. in the United States, aggregated there and processed by downstream systems for evaluation purposes. What this means for each kind of data is described in the respective sections; see the section “International transfers” for details. Images, fonts and scripts are delivered from our own servers. Content from third-party servers is not loaded without your consent, with one exception: the DNS query in the instant domain check, which you trigger yourself (see the section “Instant domain check”).

Legal basis: Article 6(1)(f) UK GDPR. Our legitimate interest lies in the secure and fast delivery of the website.

4. Storage in your browser and consent management

This website does not set any cookies without your consent. In your browser's local storage (local storage and session storage) we store only settings that are technically necessary to operate the website as you have requested:

  • idqa-consent: your decision on consent for each purpose, with the time it was made and your Privacy Consent ID; valid for 180 days
  • idqa-theme: the display mode you selected (light, dark or automatic)
  • idqa-region: the country edition you selected
  • idqa-region-auto: a note that you were automatically redirected to your country edition; deleted when you close the browser tab

This information stays in your browser. Only your decision on consent is transmitted to us, as described in the section “Record of your decision”.

Legal basis: no consent is required under regulation 6 of, and Schedule A1 to, PECR, because this storage is strictly necessary to provide the service you have requested or serves only to apply the display and country settings you have chosen; in addition, Article 6(1)(f) UK GDPR.

On your first visit we ask for your consent to the services described in the sections “Audience measurement” and “Session analysis”. You may give or refuse consent for each purpose separately. Until you have consented, none of these services are loaded. Refusing consent has no disadvantage for your use of the website.

You can change your choice or withdraw your consent with effect for the future at any time using the “Privacy settings” link at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before it. When you withdraw consent, we delete the cookies set by the services to the extent this is technically possible from our website. After 180 days, and whenever the services we use change, we ask for your consent again. If your browser sends the Global Privacy Control signal, we treat it as a refusal.

4.1 Record of your decision

We are required to be able to demonstrate your consent. We therefore also store on our server every decision you make in the consent dialog, whether you consent or refuse. We store a randomly generated identifier (Privacy Consent ID), the time, your choice for each purpose, the version of the information shown in the dialog and the country edition of the website. We do not store your IP address together with this information; to protect against misuse, we merely keep a hash value of the IP address separately for no more than ten minutes.

We show you the Privacy Consent ID each time a decision is stored; you can also find it in the consent dialog at any time. If you contact us about your consent, we can locate your decision using this identifier. Without the identifier we cannot attribute the stored information to any person.

Legal basis: Article 6(1)(c) UK GDPR in conjunction with Articles 5(2) and 7(1) UK GDPR (duty to demonstrate consent).

Retention: we keep the record for as long as it is needed to demonstrate consent and its withdrawal, and delete it afterwards.

5. Audience measurement

We use the following services only if you have consented to the purpose “Audience measurement”.

5.1 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service shows us how the website is used so that we can improve its content and structure. The data processed includes in particular:

  • the IP address (Google shortens it before storage)
  • pages viewed, time spent and click paths
  • the referring address and the source of the visit
  • device and browser information
  • approximate location at city or region level
  • pseudonymous user and session identifiers

Google Analytics sets the cookies “_ga” and “_ga_” followed by an identifier, each with a lifetime of up to two years. We use Google Analytics exclusively for statistical evaluation. Through Google Consent Mode we signal to Google that no consent has been given for storing or using data for advertising purposes.

Legal basis: your consent under Article 6(1)(a) UK GDPR; for storing information on, and accessing information from, your device, regulation 6 of PECR.

Data processing agreement: we have a data processing agreement in place with Google.

International transfers: Google Ireland Limited engages Google LLC, Mountain View, United States, as a sub-processor; the data is therefore also processed in the United States. See the section “International transfers” for details.

Retention: user-level and event-level data is deleted by Google after no more than 14 months.

Further information: https://policies.google.com/privacy

5.2 Matomo

We also use the web analytics software Matomo. We operate Matomo on servers owned by Identiqa Inc. in the United States (analytics.identiqa.com); we do not disclose this data outside the Identiqa group, unless we are required to do so by law. The measurement data is aggregated there and processed for evaluation purposes by downstream systems of Identiqa Inc. The data processed includes in particular the IP address, pages viewed, clicks on links, the referring address, and device and browser information. Matomo sets the cookies “_pk_id” (lifetime 13 months) and “_pk_ses” (lifetime 30 minutes).

Legal basis: your consent under Article 6(1)(a) UK GDPR; for storing information on, and accessing information from, your device, regulation 6 of PECR.

International transfers: the data is processed in the United States. See the section “International transfers” for details.

Retention: the measurement data is deleted as soon as it is no longer needed for statistical evaluation.

6. Session analysis

We use the following service only if you have consented to the purpose “Session analysis”.

6.1 Microsoft Clarity

We use Microsoft Clarity, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, United States. Clarity records your interactions with the website, in particular mouse movements, clicks, scrolling and the pages you view; Microsoft receives this information directly from your browser while you use the website. It is used to create session recordings and heatmaps. Entries in form fields are masked; their content is not recorded. Clarity is not loaded, and nothing is recorded, before you give your consent. The IP address, device and browser information, and pseudonymous identifiers are also processed. Clarity sets the cookies “_clck” (lifetime one year) and “_clsk” (lifetime one day).

We use the results to identify usability problems and to improve the website. According to Microsoft, it also processes the data for its own purposes, including improving its own services and advertising. We are responsible together with Microsoft for collecting the data on this website and transmitting it to Microsoft; for its further processing, including for its own purposes, Microsoft acts as an independent controller. Your consent to the purpose “Session analysis” covers the transmission to Microsoft.

Legal basis: your consent under Article 6(1)(a) UK GDPR; for storing information on, and accessing information from, your device, regulation 6 of PECR.

International transfers: the data is processed in the United States. See the section “International transfers” for details.

Retention: according to Microsoft, session recordings are stored for 30 days, and tagged recordings and heatmaps for up to 13 months.

Further information: https://privacy.microsoft.com/privacystatement

7. Instant domain check

The website offers an instant check for domains. The check starts only when you enter a domain and trigger it.

  • DNS queries: your browser queries public DNS records of the domain you entered directly from the service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States (cloudflare-dns.com). Cloudflare receives the domain you entered and technical connection data, in particular your IP address, and processes them on its own responsibility under its privacy policy: https://www.cloudflare.com/privacypolicy/
  • Checks by our server: our own server checks the mail servers and security headers of the domain you entered. For this purpose we process the domain you entered; it appears in the server log files as part of the address requested.
  • Protection against misuse: to limit the number of requests, we store a hash value of your IP address together with the times of your requests. We evaluate only the requests of the last ten minutes; older entries are deleted with your next request.

Legal basis: Article 6(1)(f) UK GDPR. Our legitimate interest lies in providing the function you requested and protecting it against misuse.

8. Contacting us

If you contact us by telephone, by email or through a form, we process the information you provide, in particular your name, contact details, company and the content of your request, in order to handle your request. If you call us, we also process the telephone number transmitted.

Legal basis: Article 6(1)(b) UK GDPR where your request is aimed at entering into or performing a contract, otherwise Article 6(1)(f) UK GDPR. Our legitimate interest lies in answering your request.

Retention: we delete the data as soon as it is no longer needed to handle your request. We retain business correspondence for the periods required by the tax and record keeping laws that apply to us.

We use a customer relationship management system to manage communication with customers and prospective customers. This system and our other central systems are operated in the United States, so your information is stored there. It is also aggregated there and processed by downstream systems for evaluation purposes, in particular for internal statistics on requests and business relationships. The legal basis for this is Article 6(1)(f) UK GDPR; our legitimate interest lies in managing and improving our services. We operate these systems ourselves and do not use external service providers for them.

9. Links to other websites

The website contains links to third-party services, such as LinkedIn and GitHub. These are simple links. Data is transmitted to the respective provider only when you click the link; that provider alone is responsible for any subsequent processing.

10. Recipients

Within the Identiqa group, access to your data is given to those units that need it to perform their tasks. Outside the group, the following categories of recipients receive data:

  • Google and Microsoft, to the extent you have consented to the respective services
  • Cloudflare, to the extent you use the instant domain check
  • tax advisers, auditors and lawyers, where this is necessary to protect our rights
  • public authorities and courts, where we are legally obliged to disclose data

We do not sell your data.

11. International transfers

Personal data is transferred outside the United Kingdom to the extent described in this policy. This concerns Ireland, where Identiqa Europe Operations Ltd. is established, the Netherlands, where the servers for visitors in Europe are located, and the United States: the central systems of Identiqa Inc. are located there (State of New Jersey), including the systems used for audience measurement with Matomo, for evaluating operational data and for managing customer relationships. Data is also processed in the United States where you use, or have consented to, the services of Google, Microsoft and Cloudflare.

The following safeguards apply to these transfers:

  • Transfers to Ireland and the Netherlands are covered by the United Kingdom's adequacy regulations for the member states of the European Economic Area.
  • Where a recipient in the United States is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the United Kingdom's adequacy regulations for that framework. You can check whether a company is certified at https://www.dataprivacyframework.gov
  • Identiqa Inc. is not certified under the Data Privacy Framework. For transfers to it, and to other recipients that are not certified, we rely on the International Data Transfer Agreement or the International Data Transfer Addendum to the standard contractual clauses of the European Commission, each as issued by the Information Commissioner.
  • In addition, we take technical and organisational measures to maintain the level of protection of the data transferred.

We will provide you with a copy of the safeguards on request.

12. Your rights

Where we process your personal data, you have the following rights:

  • access to the data we process about you (Article 15 UK GDPR)
  • rectification of inaccurate data and completion of incomplete data (Article 16 UK GDPR)
  • erasure of your data, subject to the exceptions provided by law, in particular statutory retention obligations (Article 17 UK GDPR)
  • restriction of processing (Article 18 UK GDPR)
  • data portability, meaning receiving your data in a structured, commonly used and machine-readable format (Article 20 UK GDPR)
  • withdrawal of consent you have given, with effect for the future (Article 7(3) UK GDPR)

Right to object under Article 21 UK GDPR: you may object at any time, on grounds relating to your particular situation, to processing that we base on Article 6(1)(f) UK GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, you may contact us in any form, for example by email to privacy.uk@identiqa.com. Exercising your rights is free of charge, except where the law allows us to charge a reasonable fee or to refuse a request.

13. Complaints

You may complain to us first using the contact details above; we will acknowledge your complaint and respond without undue delay.

You also have the right to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, https://ico.org.uk/make-a-complaint

14. No obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. Without the technically necessary connection data, however, we cannot deliver the website to your device.

15. No automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

16. Data security

We take technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction and unauthorised access. These include in particular encryption in transit (TLS), access controls, regular security reviews and the use of our own security platform. We review these measures regularly and develop them further. No method of transmitting data over the internet is completely secure, and we cannot guarantee absolute security.

17. Changes to this privacy policy

We update this privacy policy when the law, our website or the services we use change. The version published on this page applies. If we make material changes, we will publish the updated policy on this page with a new date. This version was last updated in November 2026.