identiqaCyberattacks end here.
24/7 Incident Response

This privacy policy describes the personal information we collect when you visit www.identiqa.com, how we use and disclose it, and the choices and rights you have. It applies to visitors in the United States and includes the disclosures required by US state privacy laws, to the extent those laws apply to us.

1. Who is responsible

The following companies (together “Identiqa”, “we” or “us”) are responsible for the processing described in this policy:

  • Identiqa Inc., 1440 Broadway, Oakland, CA 94612, United States
  • Identiqa Europe Operations Ltd., 1 Ballycoolin Rd, Ballycoolen, Dublin, D15 AKK1, Ireland

The two companies have agreed between them which of them handles privacy notices and requests. You may address your requests to either company. The arrangement also governs the processing of data between the two companies and their respective rights and obligations. Access to personal data is logged and reported between the companies. Identiqa Inc. complies with requests from individuals who are protected by the GDPR and handles them in accordance with it.

You may exercise your rights against either company. The central point of contact for all privacy requests is:

  • Email: privacy.us@identiqa.com
  • Postal address: Identiqa Europe Operations Ltd., 1 Ballycoolin Rd, Ballycoolen, Dublin, D15 AKK1, Ireland

2. Principles of processing

2.1 Scope

We process personal data only to the extent necessary to operate a functioning and secure website and to handle your requests. We use services that set cookies or record your behavior (Google Analytics, Matomo and Microsoft Clarity) only with your consent. In addition, we evaluate server log data and the information from your requests in aggregated form; see the sections “Server log files” and “Contacting us” for details.

2.2 Legal bases

US privacy laws do not require a separate legal basis for each processing activity in the way European law does. We nevertheless load the services that set cookies or record your behavior only after you have opted in, and we process personal information only for the purposes described in this policy. Server log data and the information from your requests are also aggregated in our central systems and processed by downstream systems for evaluation purposes, in particular for statistics on the operation and use of the website and on requests and business relationships.

2.3 Retention

We delete personal data as soon as the purpose of the processing no longer applies. We retain data for longer only where statutory retention obligations apply, for example under company and tax law, or where the data is needed to establish, exercise or defend legal claims. Where fixed periods apply, they are stated for each processing activity below.

3. Providing the website

3.1 Server log files

Each time the website is accessed, our systems automatically record the following data from the requesting device:

  • IP address (shortened where technically possible)
  • date and time of access
  • the address requested and the referring address (referrer)
  • browser and operating system used
  • internet service provider

This processing is necessary to deliver the website, to keep it stable, and to detect and defend against misuse and attacks.

In addition, we transfer the log data to central systems of Identiqa Inc. in the United States. There it is aggregated and processed by downstream systems for evaluation purposes, in particular for statistics on the operation and use of the website. No cookies are set and no information is read from your device for this purpose.

Retention: log files on the delivering servers are generally deleted after seven days, unless a security incident requires longer retention for investigation. We keep the log data transferred to the central systems, and the evaluations derived from it, for as long as they are needed for the purposes stated, and delete them afterwards.

3.2 Hosting and delivery

The website is operated on infrastructure owned by the Identiqa group. Our central servers are located in the United States (State of New Jersey). The website for visitors in Europe is delivered from servers in the Netherlands, which are operated by Identiqa Europe Operations Ltd. The cooperation between the two companies is governed by the arrangement described in the section “Who is responsible”. Data from the operation of the website, from audience measurement and from your requests is transferred to the central systems of Identiqa Inc. in the United States, aggregated there and processed by downstream systems for evaluation purposes. What this means for each kind of data is described in the respective sections; see the section “International transfers” for details. Images, fonts and scripts are delivered from our own servers. Content from third-party servers is not loaded without your consent, with one exception: the DNS query in the instant domain check, which you trigger yourself (see the section “Instant domain check”).

4. Storage in your browser and consent management

This website does not set any cookies without your consent. In your browser's local storage (local storage and session storage) we store only settings that are technically necessary to operate the website as you have requested:

  • idqa-consent: your decision on consent for each purpose, with the time it was made and your Privacy Consent ID; valid for 180 days
  • idqa-theme: the display mode you selected (light, dark or automatic)
  • idqa-region: the country edition you selected
  • idqa-region-auto: a note that you were automatically redirected to your country edition; deleted when you close the browser tab

This information stays in your browser. Only your decision on consent is transmitted to us, as described in the section “Record of your decision”.

On your first visit we ask for your consent to the services described in the sections “Audience measurement” and “Session analysis”. You may give or refuse consent for each purpose separately. Until you have consented, none of these services are loaded. Refusing consent has no disadvantage for your use of the website.

You can change your choice or withdraw your consent with effect for the future at any time using the “Your Privacy Choices” link at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before it. When you withdraw consent, we delete the cookies set by the services to the extent this is technically possible from our website. After 180 days, and whenever the services we use change, we ask for your consent again. If your browser sends the Global Privacy Control signal, we treat it as a refusal.

4.1 Record of your decision

We want to be able to demonstrate what you chose. We therefore also store on our server every decision you make in the consent dialog, whether you consent or refuse. We store a randomly generated identifier (Privacy Consent ID), the time, your choice for each purpose, the version of the information shown in the dialog and the country edition of the website. We do not store your IP address together with this information; to protect against misuse, we merely keep a hash value of the IP address separately for no more than ten minutes.

We show you the Privacy Consent ID each time a decision is stored; you can also find it in the consent dialog at any time. If you contact us about your consent, we can locate your decision using this identifier. Without the identifier we cannot attribute the stored information to any person.

Retention: we keep the record for as long as it is needed to demonstrate consent and its withdrawal, and delete it afterwards.

5. Audience measurement

We use the following services only if you have consented to the purpose “Audience measurement”.

5.1 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service shows us how the website is used so that we can improve its content and structure. The data processed includes in particular:

  • the IP address (Google shortens it before storage)
  • pages viewed, time spent and click paths
  • the referring address and the source of the visit
  • device and browser information
  • approximate location at city or region level
  • pseudonymous user and session identifiers

Google Analytics sets the cookies “_ga” and “_ga_” followed by an identifier, each with a lifetime of up to two years. We use Google Analytics exclusively for statistical evaluation. Through Google Consent Mode we signal to Google that no consent has been given for storing or using data for advertising purposes.

Data processing agreement: we have a data processing agreement in place with Google.

International transfers: Google Ireland Limited engages Google LLC, Mountain View, United States, as a sub-processor; the data is therefore also processed in the United States. See the section “International transfers” for details.

Retention: user-level and event-level data is deleted by Google after no more than 14 months.

Further information: https://policies.google.com/privacy

5.2 Matomo

We also use the web analytics software Matomo. We operate Matomo on servers owned by Identiqa Inc. in the United States (analytics.identiqa.com); we do not disclose this data outside the Identiqa group, unless we are required to do so by law. The measurement data is aggregated there and processed for evaluation purposes by downstream systems of Identiqa Inc. The data processed includes in particular the IP address, pages viewed, clicks on links, the referring address, and device and browser information. Matomo sets the cookies “_pk_id” (lifetime 13 months) and “_pk_ses” (lifetime 30 minutes).

International transfers: the data is processed in the United States. See the section “International transfers” for details.

Retention: the measurement data is deleted as soon as it is no longer needed for statistical evaluation.

6. Session analysis

We use the following service only if you have consented to the purpose “Session analysis”.

6.1 Microsoft Clarity

We use Microsoft Clarity, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, United States. Clarity records your interactions with the website, in particular mouse movements, clicks, scrolling and the pages you view; Microsoft receives this information directly from your browser while you use the website. It is used to create session recordings and heatmaps. Entries in form fields are masked; their content is not recorded. Clarity is not loaded, and nothing is recorded, before you give your consent. The IP address, device and browser information, and pseudonymous identifiers are also processed. Clarity sets the cookies “_clck” (lifetime one year) and “_clsk” (lifetime one day).

We use the results to identify usability problems and to improve the website. By giving your consent, you agree that Microsoft may receive and record your interactions with the website as described in this section. According to Microsoft, it also uses the data for its own purposes, including improving its services and advertising. For that use, Microsoft acts as an independent third party and not as our service provider.

International transfers: the data is processed in the United States. See the section “International transfers” for details.

Retention: according to Microsoft, session recordings are stored for 30 days, and tagged recordings and heatmaps for up to 13 months.

Further information: https://privacy.microsoft.com/privacystatement

7. Instant domain check

The website offers an instant check for domains. The check starts only when you enter a domain and trigger it.

  • DNS queries: your browser queries public DNS records of the domain you entered directly from the service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States (cloudflare-dns.com). Cloudflare receives the domain you entered and technical connection data, in particular your IP address, and processes them on its own responsibility under its privacy policy: https://www.cloudflare.com/privacypolicy/
  • Checks by our server: our own server checks the mail servers and security headers of the domain you entered. For this purpose we process the domain you entered; it appears in the server log files as part of the address requested.
  • Protection against misuse: to limit the number of requests, we store a hash value of your IP address together with the times of your requests. We evaluate only the requests of the last ten minutes; older entries are deleted with your next request.

8. Contacting us

If you contact us by telephone, by email or through a form, we process the information you provide, in particular your name, contact details, company and the content of your request, in order to handle your request. If you call us, we also process the telephone number transmitted.

Retention: we delete the data as soon as it is no longer needed to handle your request. We retain business correspondence for the periods required by the tax and record keeping laws that apply to us.

We use a customer relationship management system to manage communication with customers and prospective customers. This system and our other central systems are operated in the United States, so your information is stored there. It is also aggregated there and processed by downstream systems for evaluation purposes, in particular for internal statistics on requests and business relationships. We do this to manage and improve our services. We operate these systems ourselves and do not use external service providers for them.

9. Links to other websites

The website contains links to third-party services, such as LinkedIn and GitHub. These are simple links. Data is transmitted to the respective provider only when you click the link; that provider alone is responsible for any subsequent processing.

10. Recipients

Within the Identiqa group, access to your data is given to those units that need it to perform their tasks. Outside the group, the following categories of recipients receive data:

  • Google and Microsoft, to the extent you have consented to the respective services
  • Cloudflare, to the extent you use the instant domain check
  • tax advisers, auditors and lawyers, where this is necessary to protect our rights
  • public authorities and courts, where we are legally obliged to disclose data

We do not sell personal information for money. The section “Additional information for US residents” explains when the use of analytics and session analysis services may qualify as a sale, sharing or targeted advertising under US state privacy laws and how you can opt out.

11. International transfers

We are based in the United States, and our central systems are located there (State of New Jersey). If you visit the website from outside the United States, your personal information is transferred to and processed in the United States. The website for visitors in Europe is delivered from servers in the Netherlands.

12. Your rights

Depending on the US state in which you live, you may have the following rights regarding your personal information:

  • to know whether we process your personal information and to access it
  • to correct inaccurate personal information
  • to delete personal information
  • to obtain a copy of your personal information in a portable and readily usable format
  • to opt out of the sale of personal information, of the sharing of personal information for cross-context behavioral advertising, and of targeted advertising
  • not to be discriminated or retaliated against for exercising your rights

To exercise your rights, email us at privacy.us@identiqa.com and tell us which right you wish to exercise. To opt out of the sale or sharing of personal information or of targeted advertising, use the “Your Privacy Choices” link at the bottom of every page or enable Global Privacy Control in your browser; we do not require you to verify your identity for an opt-out, and we act on it as soon as feasibly possible and no later than 15 business days after receipt.

For requests to know, delete or correct, we confirm receipt within 10 business days and respond within 45 calendar days of receipt. Where reasonably necessary, we may extend this period once by up to 45 additional days; we will inform you of the extension and the reason within the first 45 days. We verify your identity by matching information you provide with information we hold. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to confirm your identity directly with us.

If we decline to act on your request, you may appeal by replying to our decision with the subject line “Privacy appeal”. We will respond to your appeal in writing within 45 days of receipt, explain the reasons for our decision and, if we deny the appeal, tell you how to contact the attorney general of your state.

13. Complaints

If you believe that we have not handled your personal information in accordance with the law, please contact us first using the contact details above. You may also contact the attorney general of the state in which you live. California residents may also submit a complaint to the California Privacy Protection Agency at https://cppa.ca.gov

14. Additional information for US residents

14.1 Categories of personal information

In the preceding twelve months we have collected the following categories of personal information:

  • identifiers, such as IP address, a hashed IP address, cookie identifiers and other pseudonymous online identifiers, and, if you contact us, your name, email address and telephone number
  • internet or other electronic network activity information, such as pages viewed, clicks, mouse movements, scrolling, session recordings, the referring address, and device and browser information
  • approximate geolocation derived from the IP address
  • professional information, such as your company, if you provide it
  • the content of your communications with us

We collect this information directly from you and automatically from your browser or device. We use identifiers, internet activity and approximate geolocation to deliver and secure the website and, with your consent, to measure and improve it. We use identifiers, professional information and communications to respond to your requests and to manage our business relationship with you. We also aggregate the information described in this policy in our central systems and evaluate it for statistics on the operation and use of the website and on requests and business relationships.

For a business purpose, we disclosed identifiers, internet activity and approximate geolocation to IT service providers and, with your consent, to Google and Microsoft, and identifiers, professional information and communications to IT service providers, professional advisers and, where legally required, public authorities.

We retain server log files for seven days, Google Analytics data for up to 14 months, Clarity recordings for 30 days and heatmaps for up to 13 months, Matomo data for as long as it is needed for statistical evaluation, and correspondence for as long as needed to handle your request and thereafter for the period required by the tax and record keeping laws that apply to us.

Our consent dialog links to this policy as our notice at collection.

14.2 Disclosure, sale and sharing

We disclose personal information to service providers and contractors that process it on our behalf under written contracts, as described in the section “Recipients”. We do not sell personal information for money.

If you opt in to session analysis, Microsoft receives identifiers and internet or other electronic network activity information through Clarity and, according to Microsoft, may use this information for its own purposes, including advertising. Under the California Consumer Privacy Act and other US state privacy laws, this may constitute a “sale” of personal information, “sharing” for cross-context behavioral advertising, or processing for targeted advertising. In the preceding twelve months, we have made such disclosures of identifiers and internet or other electronic network activity information to the following category of third parties: providers of session analysis services.

You may opt out of the sale and sharing of your personal information and of targeted advertising at any time by using the “Your Privacy Choices” link at the bottom of every page or by enabling Global Privacy Control in your browser. We process a Global Privacy Control signal as a valid request to opt out for the browser that sends it. In that case the services are not loaded.

14.3 Sensitive personal information

We do not ask for or intentionally collect sensitive personal information through the website, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use under California law.

14.4 Children

The website is directed at businesses and is not intended for children. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share personal information of, or process it for targeted advertising concerning, consumers under 18. If you believe that a child has provided personal information to us, please contact us and we will delete it.

14.5 California

California residents may request information about the disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information for that purpose.

Do Not Track and third-party tracking: if you consent to audience measurement or session analysis, Google and Microsoft may collect information about your online activities over time and across different websites through the cookies described in this policy. Our website does not respond to browser “Do Not Track” signals. We honor the Global Privacy Control signal as described in this policy.

15. No obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. Without the technically necessary connection data, however, we cannot deliver the website to your device.

16. No automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

17. Data security

We take technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction and unauthorized access. These include in particular encryption in transit (TLS), access controls, regular security reviews and the use of our own security platform. We review these measures regularly and develop them further. No method of transmitting data over the internet is completely secure, and we cannot guarantee absolute security.

18. Changes to this privacy policy

We update this privacy policy when the law, our website or the services we use change. The version published on this page applies. If we make material changes, we will publish the updated policy on this page with a new date. This version was last updated in November 2026.