Privacy Policy

Effective date: January 8th, 2019

GENERAL INFORMATION

The company icCUBE SOFTWARE SARL, with registered office at Route de la Pierre 22, 1024 Ecublens, Switzerland, Business Registration no. CHE-456.560.508 (hereinafter referred to as “we”, “us” or “our”), in its capacity of data controller regarding the processing of Personal Data, is committed to protecting and respecting the privacy of its users and customers, even prospective (hereinafter singularly and collectively referred to as the “you” or “your”), pursuant to the Swiss Federal Data Protection Act (hereinafter referred to as the “National Law”) and, if you are citizen of a Country in the European Economic Area, also pursuant to the European Regulation no. 2016/679 (hereinafter referred to as the “GDPR”) (hereinafter the National Law and the GDPR will be referred to as the “Applicable Law”).

This policy (hereinafter referred to as the “Privacy Policy”) is aimed to inform you about our practices related to our collection and use of your Personal Data with reference to the performance of any of our service (hereinafter collectively referred to as the “Services”), either prior to entering into a contract having as its subject any of our Services or during the performance thereof.

“Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

We invite you to read this Privacy Policy carefully to understand our considerations and practices regarding the processing of your Personal Data.

SECT. 1 – PERSONAL DATA WE PROCESS

When we provide you with our Services, we may collect the following Personal Data:

1.1. Information you give us. You may, through our Services or other contact channel (e.g., email, website contact form, etc.), voluntarily provide us Personal Data and/or information and documents containing your common Personal Data. In particular, such Personal Data may include your name, email, address, country, phone number, your company name, your interest in icCube, as well as any information required for invoicing (such as, business registration data, tax data, order number, content and type, etc.). We will process these data in accordance with the Applicable Law and on the assumption that they refer to you or to third parties who have authorized you to provide them pursuant to an appropriate legal basis which legitimize the processing at stake. In this case, you act as independent data controller, assuming all relevant obligations and responsibilities according to the Applicable Law. In this regard, you shall indemnify and hold us harmless from and against all damages, losses, and expenses of any kind (including reasonable legal fees and costs) arose by any claim made by any third party whose Personal Data have been processed in breach of the Applicable Law as regards to your obligations as independent data controller.

1.2. Information processed by us. Computer systems and software procedures which are used either to operate the Services or to improve the performance thereof, process your Personal Data and/or associate other data to your Personal Data. Such data include: (i) your IP address; (ii) our Services’ license number associated with you; (iii) your machine configuration; (iv) the type of requests being used.

SECT. 2 – PURPOSES AND LEGAL BASIS OF THE PROCESSING

2.1. Purposes. Personal Data above will be processed by us for the purposes and legal basis specified below:

Purposes	Legal Basis
To carry out our obligations arising from any contract entered into between you and us and to provide you with Services that you requested from us (e.g., create and manage your account, provide our Services, process the subscription to our newsletter, etc.).	This processing is necessary for the performance of our mutual contractual obligations and/or carried out with your consent.
To communicate with you to verify your account and for informational and operational purposes (e.g., account management, customer service, system maintenance), including by periodically emailing you Services-related announcements.	This processing is necessary for the performance of our mutual contractual obligations and/or based on a legitimate interests pursued by us.
To give you access to our support and customer care Services and to enable you to communicate with our team.	This processing is necessary for the performance of our mutual contractual obligations, carried out with your consent and/or necessary for the establishment, exercise or defense of legal claims.
To ensure compliance with any applicable laws, our Services’ terms and conditions, and our Privacy Policy.	This processing is necessary for the performance of our mutual contractual obligations and/or for the establishment, exercise or defense of legal claims.
To send information to authorized third-parties (e.g., clients, processors, etc.).	This processing is necessary for the performance of our mutual contractual obligations and/or carried out with your consent
To send marketing materials, as well as suggestions and recommendations on our services that may be of interest to you.	This processing is based on your consent.
To carry on statistical research / analysis, as well as to report, measure and evaluate the Services’ operation, features and performance, as well as our website, its traffic and usability.	This processing is based on a legitimate interests pursued by us and/or does not involve Personal Data (as data processed are anonymized).
To the fulfill a legal obligation to which we are subject or to ascertain, exercise or defend a right in Court or whenever an authority exercises its jurisdiction.	This processing is necessary for the establishment, exercise or defense of legal claims.

2.2. Voluntary nature of the processing. Providing your Personal Data for the above-mentioned purposes is voluntary and not mandatory. However, any refusal to provide any of such data may not allow us to establish and/or continue a contractual relationship with you, or to fulfill your requests, or to comply with legal obligations to which we are subject.

SECT. 3 – WHAT IS DATA RETENTION PERIOD AND WHAT SECURITY MEASURES HAVE BEEN TAKEN FOR YOUR PERSONAL DATA SAFEGUARD

3.1. Data retention. Personal Data collected by us will be processed for the time strictly necessary to achieve the purposes referred to in above. In particular:

3.1.a.Personal Data needed for the provision of our newsletter service will be processed until you decide to unsubscribe.

3.1.b.Personal Data whose retention is mandatory under the applicable laws (e.g., tax laws, bookkeeping, etc.) will be retained for a period of time necessary or permitted to comply with such laws.

3.2. Security measures. We warrant to maintain (and continue to maintain) appropriate and sufficient technical and organisational security measures to protect your Personal Data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access, as well as against all other unlawful forms of processing. Please be aware that no security measures are perfect or impenetrable, so we cannot guarantee that unauthorised access, hacking, data loss or a data breach will never occur. Notwithstanding the preceding, we operate with the aim of mitigating the risks associated with processing your Personal Data through several measures, including without limitation: (i) process only Personal Data that is essential to carry out our services and legal obligations (data minimisation); (ii) use encryption for securing the Personal Data that we process (e.g., SSH – Secure SHell protocol); (iii) use company-wide restriction methods for restricting access into the foundation of our processes, systems and structure, in order to ensure that only those with authorisation and/or a relevant purpose have access to Personal Data and always with their private keys.

SECT. 4 – WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA

4.1. Third-party service providers or consultants. We engage certain trusted third parties to perform functions and provide services to us, including hosting and maintenance, error monitoring, debugging, performance monitoring, billing, customer relationship, database storage and management, and direct marketing campaigns. Therefore, we may share your Personal Data with these third parties, but only to the extent necessary to perform these functions and provide such services. We also require these third parties to maintain the confidentiality and security of your Personal Data they process on our behalf. In particular, without limiting the foregoing, our main third-party service providers are: (i) our cloud storage and hosting service providers (i.e., Google Inc., see https://cloud.google.com/security/gdpr and Linode LLC., see https://www.linode.com/compliance); (ii) our customer relationship management (CRM) service provider (i.e., Base – FutureSimple Inc., see https://blog.getbase.com/gdpr-update-base-ready); (iii) our mail marketing service provider (i.e., Mailchimp – The Rocket Science Group LLC., see https://mailchimp.com/legal/privacy/).

4.2. Other Third Parties. We may share Personal Data with our headquarters and affiliates, employees and business partners to whom it is reasonably necessary or desirable for us to process your Personal Data for the purposes described in this Privacy Policy. In particular, your Personal Data will be processed by our parent company Misc AG (with offices at Baarerstrasse 75, 6300 Zug, Switzerland) for bookkeeping and invoicing purposes.

4.3. Third parties required by laws or authorities. We may disclose your Personal Data to a third party if: (i) we believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process or governmental request (including to meet national security or law enforcement requirements), (ii) to protect ourselves, our customers, or the public from harm or illegal activities, or (iii) to respond to an emergency which we believe in good faith requires us to disclose data to assist in preventing a death or serious bodily injury. If we are required by law to disclose any of your Personal Data, then we will use reasonable efforts to provide you with notice of that disclosure requirement, unless we are prohibited from doing so by statute, subpoena or court or administrative order. Further, we object to requests that we do not believe were issued properly.

4.4. Third Parties recipients of anonymised, de-identified and aggregated data. In addition to the processing activities we may carry on according to this Privacy Policy, we may transform your Personal Data in such a manner (i.e., through anonymisation, de-identification and aggregation) that these data can no longer be attributed to you. Such anonymised, de-identified or aggregated data will be shared to third parties for various purposes, including for business or marketing purposes or to assist third parties in understanding our users’ interest, habits and usage patterns for certain programs, content, services and functionalities of our Services.

SECT. 5 – WHERE YOUR PERSONAL DATA MAY BE TRANSFERRED

We are based in Switzerland and your Personal Data may be further transferred to, and stored at, any of our affiliates, partners or service providers mentioned in previous Sect. 4, which may be either inside or outside the European Economic Area. In any case, when we transfer or disclose your Personal Data to such other countries, we will ensure that such Personal Data will be protected as described in this Privacy Policy. By submitting your Personal Data, you agree to such transfers.

SECT. 6 – YOUR RIGHTS

6.1. Right of access. You are always entitled to receive confirmation as to whether or not your Personal Data are being processed and, where that is the case, access and receive copy of such Personal Data in an intelligible form. Furthermore, you are also entitled to receive information concerning: the purposes of the processing; the categories of Personal Data concerned; the recipients (or categories thereof) to whom the Personal Data have been or will be disclosed; where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right to request from us rectification or erasure of personal data or restriction of processing of your Personal Data or to object to such processing; the right to lodge a complaint with a supervisory authority; the source of the Personal Data; the existence of automated decision-making; where Personal Data are transferred to a third country or to an international organization, the appropriate safeguards relating to the transfer.

6.2. Right to withdraw consent. You are always entitled to withdraw, at any time, your consent to the processing of your Personal Data, both on legitimate grounds (even though they are relevant to the purpose of the collection) and if the processing is carried out for direct marketing purpose. The preceding will not affect the lawfulness of your Personal Data processing based on consent before the withdrawal.

6.3. Right to rectification, erasure and restriction. You are always entitled to obtain from us, without undue delay: the rectification or integration of your Personal Data that are inaccurate or incomplete; the erasure of your Personal Data that have been processed unlawfully or whose retention is unnecessary for the Purposes; the restriction of processing, in case you challenge either the accuracy of your Personal data or the lawfulness of the processing, or in case we no longer need the Personal Data for the Purposes, but they are required by you for the establishment, exercise or defense of a legal claim.

6.4. Right to data portability. You have the right to receive your Personal Data in a structured, commonly used and machine-readable format, as well as the right to transmit those data to another controller without hindrance from us, where technically feasible.

6.5. Right to lodge a complaint before an European supervisory authority. If you are citizen of a Country in the European Economic Area, you have the right to lodge a complaint with the Supervisory Authority located in your place of residence.

6.6. Contacts. Requests to exercise the rights above must be sent to _icCube Software, Route de la Pierre 22, 1024 Ecublens, Switzerland , or by e-mail to contact@icCube.com. Any access request is always completed within one month; however, where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two further months. If this is the case, we will write to the individual within one month and keep him/her informed of the delay and the reasons thereof.

SECT. 7 – AMENDMENTS TO THIS POLICY

This Privacy Policy came into force on the “Effective Date” specified above. We reserve the right to amend or to update its content, whether in whole or in part, also following changes in the legal and regulatory obligations regarding data protection. We will inform you on such amendments and updates through their publication on our website (at https://www.iccube.com/gdpr) as soon as they are adopted, and they will be binding from the moment of their publication. Therefore, we invite you to visit this page of our website regularly, in order to be aware of the most recent and updated version thereof, so that you are always updated on the processing activities that we carry out.