Global Privacy Policy

Overview of Incorta Services

Incorta Cloud is our cloud-based unified data analytics platform that enables customers to connect and analyze complex data in real time. It includes features for data ingestion, enrichment, visualization, and sharing—eliminating the need for traditional data modeling or transformation.

We also offer a range of related services that support our platform and customers’ data strategies, including:

• Platform implementation and onboarding
• Technical support and customer success services
• Training programs, webinars, and documentation
• Solution consulting and custom configuration
• Access to updates, new features, and release notes

These services may involve the processing of personal data when users interact with our platform, contact our support teams, register for events, or access resources. When we process personal information for these purposes, we do so in accordance with applicable data protection/ privacy laws and the principles outlined in this Privacy Notice.

Customer Data

When customers use Incorta’s Services, they may upload or store data within our platform. This Customer Data is owned and controlled by the customer. Incorta only processes this data on behalf of and under the instruction of our customers.

What is Customer Data?

• Data uploaded, stored, or processed through the Incorta Cloud platform
• Controlled by the customer (the data controller)
• May include personal information of individuals known to the customer (e.g., employees, clients)
• Incorta does not use this data for its own purposes

Our Role as Data Processor

In these circumstances, Incorta acts as a data processor, and our responsibilities are governed by:

• The contractual terms agreed upon with each customer
• The customer’s own Privacy Notice
• Applicable data protection laws, including Article 28 of the GDPR

We follow these core principles when handling Customer Data:

• We process data only on documented instructions from the customer
• We implement appropriate technical and organizational safeguards
• We assist customers in meeting their compliance obligations where applicable
• We do not access or use Customer Data for marketing or analytics unrelated to the Services

Details of our processing obligations are set out in our Data Processing Agreement, which is available upon request at privacy@incorta.com.

Fair and Lawful Processing

Incorta processes personal data on one or more of the following legal bases, as defined under the GDPR and equivalent privacy laws:

• Consent (Art. 6(1)(a)): Where you have given clear affirmative consent — for example, to receive marketing communications, to allow non-essential cookies, or to process special category data.
• Contract (Art. 6(1)(b)): Where processing is necessary to enter into or perform a contract with you or your organization, including delivery of the Incorta Services, account administration, and support.
• Legal obligation (Art. 6(1)(c)): Where processing is required to comply with applicable laws and regulations, such as tax, accounting, employment, anti-fraud, or law-enforcement obligations.
• Legitimate interests (Art. 6(1)(f)): Where processing is necessary for our or a third party's legitimate interests, provided those interests are not overridden by your rights and freedoms. We rely on legitimate interests for activities such as: improving and securing our Services, conducting product analytics on aggregated or pseudonymized data, managing direct B2B communications with prospective customers, detecting and preventing fraud or abuse, and exercising or defending legal claims. We conduct a Legitimate Interests Assessment (LIA) before relying on this basis.
• Vital interests or public interest (Art. 6(1)(d)–(e)): Only in narrow circumstances, such as responding to a security incident affecting the safety of individuals.

Processing of special category data (Art. 9) is carried out only where an additional condition applies, such as your explicit consent, compliance with employment or social-security obligations, or the establishment, exercise, or defense of legal claims.

Transparency and Purpose Limitations

We are committed to transparency about the Personal Information we collect and how we use it. Where required, we provide individuals with a clear notice at the point of collection and obtain consent for data uses when necessary. We collect data only:

• For specified, explicit, and legitimate purposes
• In a way that is relevant and proportionate to the purpose
• With the intent to minimize the amount of Personal Information we collect and retain.

We do not use Personal Information in ways that are incompatible with the original purposes disclosed, unless we notify you and, where necessary, obtain your consent.

Consent

In certain situations, we rely on your consent to collect and process your personal information. For example, we request your consent when:

• You sign up for our marketing Communications (e.g., newsletters, product updates)
• You provide sensitive information/special category data (e.g., health info for event accommodations)
• You interact with our Services where optional data collection is involved (e.g., webinars, optional profile fields). Note that the use of cookies and similar tracking technologies on our websites is separately governed by the ePrivacy Directive (and equivalent national implementations) and is addressed in detail in our Cookies Notice.

Where we rely on your consent, you can withdraw it at any time by using the opt-out mechanisms provided in our communications, cookie settings, or by contacting us directly, via this form on our website https://www.incorta.com/contact.

The following table outlines the categories of personal data Incorta may collect, along with examples and typical sources of collection:

Incorta collects personal information in several ways depending on how you interact with our websites, mobile apps, communications, and services. We gather this information to deliver services, support business operations, fulfill legal obligations, and improve user experience. This section outlines the primary sources and types of information we collect.

We may collect personal data from the following sources:

Webforms and Requests

When you submit information to us through webforms, such as “Contact Us,” demo requests, support inquiries, newsletter signups, or resource downloads—we collect the information you provide, including your name, email, company name, phone number, and any message or additional details you choose to include.

You may also submit requests to exercise your data rights (such as access or deletion), in which case we will process the information needed to verify and fulfill your request.

Website Browsing Activity

When you visit our websites (such as www.incorta.com), we automatically collect certain information about your device and usage through cookies and other tracking technologies. This includes:

• IP address
• Browser type and version
• Operating system
• Referring/exit pages
• Date and time of access
• Clickstream data
• Pages viewed and actions taken
• Session duration and interactions

This information is used to optimize our site performance, security, and marketing effectiveness. For more details, see: Cookies and Tracking Technologies.

Device Information and Log Data

We may collect technical information from the devices you use to access our services. This includes:

• Device type and model
• Operating system version
• Unique device identifiers (e.g., MAC address, advertising ID)
• Network and connection information
• Log files and error reports

Where technically feasible, unique device identifiers are hashed or otherwise pseudonymized before being stored in our systems. If you use multiple devices to access your Incorta account, we may associate sessions across those devices solely to support secure authentication, session continuity, and fraud detection. We do not use cross-device linking to build behavioral profiles or to make automated decisions that produce legal or similarly significant effects on you.

Mobile Applications and Social Media

Some of our services are accessible via mobile apps or mobile-optimized sites. When you use these channels, we may collect:

• Mobile device ID
• Device location (based on GPS or IP)
• App interaction data
• Mobile OS version and platform

In addition, we maintain company pages on platforms such as LinkedIn, Facebook, Twitter, Instagram, YouTube, Vimeo, and others. If you interact with our content or submit information through those platforms (e.g., likes, comments, messages), that data may be collected by both us and the platform provider, subject to their privacy policies.

Location Data

Depending on your device settings and the features you use, we may collect location data to tailor content or comply with local laws. This may include:

• General location inferred from your IP address
• Precise GPS-based location (if enabled on mobile)
• Location preferences you select on our Services

You can manage or disable location collection through your browser, device settings, or app permissions.

Business Interactions and Transactions

We may collect information about you and your company through direct business interactions, such as:

• Meetings or phone calls
• Tradeshow or event attendance
• Partner referrals
• Contract discussions or negotiations

This may include your name, title, company name, business email and phone number, job role, and other information relevant to the business relationship.

Financial Information

If you purchase services or software from us, we may collect payment-related information such as:

• Name on card
• Billing address
• Card type and expiration
• Transaction date and amount

This data is securely processed through trusted third-party payment providers and is not stored by Incorta directly unless necessary for legal or contractual compliance.

Events and Webinars

If you register for one of our in-person events or online webinars, we may collect:

• Your name, title, and contact details
• Company name and role
• Session attendance data
• Feedback or survey responses

This information may be used to follow up on your interest, respond to your inquiries, and improve future event offerings.

Communications and Subscriptions

If you sign up to receive marketing communications, newsletters, product updates, or other promotional content, we collect your name and email address, as well as preferences or interaction data related to those communications (e.g., email open/click rates).

From time to time, we may provide electronic or printed communications to our customers and prospective customers. These communications may include updates about our products, services, company news, offers, and events. If you subscribe, you will be added to our mailing list and receive communications at the contact information you provide.

In some cases, our Services may allow us or other users to contact you via text message (SMS). These messages may include service notifications, system alerts, or other service-related communications. You can manage your notification preferences, including opting out of text messages, through your account settings or by contacting us.

We request your consent before using your personal information for marketing purposes, including email and SMS. You may withdraw your consent at any time using the opt-out instructions in the message or by contacting us directly.

Your name and email address may be stored in a third-party mailing system based in the United States or Europe. These providers are contractually obligated to follow appropriate data protection standards. We do not use your information for automated decision-making. We retain your communication preferences and contact data for as long as we continue sending communications.

If you unsubscribe, we promptly suppress your contact details from active marketing lists. We retain a minimum set of suppression data (typically your email address in hashed form, the date you unsubscribed, and the source of the original opt-in) for up to three years solely to honor your opt-out choice, prevent re-contact, and demonstrate compliance with applicable anti-spam and data protection laws (including CAN-SPAM, the GDPR, and the ePrivacy Directive). Suppression data is not used for any marketing or analytics purpose. After three years, we securely delete the suppression record unless a longer period is required by law.

You may withdraw consent or opt out of further processing at any time by:

• Clicking the "Unsubscribe" link in any marketing email
• Replying "STOP" to SMS communications
• Adjusting your preferences in the cookie consent manager on our website
• Emailing privacy@incorta.com
• Submitting a request through our Data Subject Request Form.

We will action verified opt-out requests without undue delay and within the timeframes required by applicable law.

Personal Data Obtained from Third-Party Sources

In addition to information you provide directly, we may receive personal data about you from the following third-party sources:

• Your employer or organization: Where your employer is an Incorta customer, your employer may provide your contact details, role, and access credentials so we can provision the Services to you.
• Your authorized representatives: Where you have authorized an agent, advisor, or representative to act on your behalf, we may receive your information from them.
• Business partners and resellers: Channel partners, integrators, and resellers may share your business contact details where they have a lawful basis to do so.
• Event and webinar co-sponsors: Where Incorta co-hosts an event, we may receive registration details from the co-sponsor, subject to the disclosures made at registration.
• Publicly available sources: Such as professional networking platforms (e.g., LinkedIn), corporate websites, and public registries, where consistent with the source platform's terms.
• Analytics, advertising, and marketing technology providers: Who may share aggregated or pseudonymized data relating to your interactions with our digital properties.
• Service providers and subprocessors: Acting on Incorta's behalf in support of our operations.

We require third parties who provide personal data to us to have a lawful basis for doing so and to have provided any required notices to the individuals concerned.

How We Share Personal Information

In accordance with applicable data protection laws and industry standards, Incorta does not share personal information with third parties unless they provide at least the same level of protection as this Privacy Notice requires.

We may share Personal Information with:

• Vetted service providers and subprocessors that support our operations (e.g., hosting, CRM, analytics, marketing tools)
• Affiliated Incorta entities under a common data protection framework
• Regulatory or legal authorities, when required by law
• Partners and resellers, if necessary to support customer relationships or services

In addition, we may share your personal information:

• With your consent, where required by law or when appropriate for specific purposes
• To prevent or respond to fraud, security threats, or potential harm
• In connection with a merger, acquisition, reorganization, or sale of assets, where your data may be transferred as part of the transaction
• In de-identified or aggregated form that cannot reasonably be used to identify you, for statistical analysis or business intelligence
• With third-party messaging or communication service providers, such as SMS carriers or email platforms, where necessary to deliver communications

All third parties who process data on our behalf are required to sign Data Processing Agreements (DPAs) that include obligations under Article 28 of the GDPR and CCPA’s service provider rules.

We do not sell personal information for monetary or other valuable consideration.

Sharing of De-Identified or Aggregated Data

We may use and share aggregated or de-identified information that cannot reasonably be used to identify you. This type of data is used for purposes such as:

• Statistical reporting and analytics
• Product development and optimization
• Industry trend analysis
• Internal business insights

This data is no longer considered personal information under applicable privacy laws and is not subject to the same restrictions.

International Transfers of Personal Data

We may transfer personal information to countries outside of your home country, including the United States and Egypt, where data protection laws may differ from those in your jurisdiction.

To ensure that international transfers comply with applicable laws, we implement one or more of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfer Impact Assessments (TIAs) in line with EDPB guidance (post-Schrems II)
• Where applicable, certified participation in approved cross-border transfer frameworks

We take appropriate steps to ensure that personal data transferred internationally is protected with adequate and consistent safeguards.

If you would like more information about our international transfer mechanisms, please contact us at privacy@incorta.com

Automated Decision-Making and Profiling

Incorta does not currently use personal information to make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 of the GDPR. All decisions that may materially affect individuals involve meaningful human review.

If this position changes, for example, as a result of new product features or AI capabilities, Incorta will update this Privacy Notice, and where required by law, will provide individuals with appropriate notice, the safeguards required under Article 22, and the right to obtain human intervention, express their point of view, and contest the decision.

How We Keep Your Data Accurate

Incorta makes a good faith effort to ensure that all personal information we process is accurate, complete, and up to date. We collect only the personal data necessary for specified purposes and take reasonable steps to keep it current.

Individuals may access or update their information through their user profile or by contacting us at privacy@incorta.com.

Our Approach to Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws, regulations, and internal business needs.

Our retention periods are guided by our formal Records Retention Policy, which groups record types into categories with defined durations based on legal, regulatory, and operational requirements (e.g., financial records, audit logs, customer data, etc.).

Once data is no longer required for legal or business purposes, we securely delete, anonymize, or archive it, in accordance with applicable laws and industry standards.

You may request deletion of your personal information at any time, subject to our legal and contractual obligations.

Retention Period Examples

The table below provides examples of common data types and general retention periods. Specific durations may vary based on the nature of the data, user agreements, or applicable regulations.

Data Retention Summary Table

Note: These are general guidelines. In specific cases, data may be retained longer or shorter based on business, legal, or regulatory requirements.

Our Commitment to Data Security

Incorta is committed to protecting personal information from unauthorized access, disclosure, alteration, and destruction. We implement and maintain appropriate administrative, technical, and physical security measures aligned with industry standards and legal requirements, including those set out under GDPR and CCPA.

Our security approach is regularly reviewed and enhanced as part of our compliance, risk management, and internal audit processes.

For data classified as sensitive personal information, we apply additional safeguards in accordance with applicable data protection laws.

Technical and Organizational Safeguards

We apply a multi-layered security model that includes:

• Encryption: All data is encrypted at rest and in transit (AES-256 at rest; TLS 1.2 or higher in transit)
• Access Controls: Role-based access permissions and least privilege enforcement
• Authentication: Multi-Factor Authentication (MFA) for admin-level accounts
• Risk Management: Periodic risk assessments and incident response planning
• Monitoring: Logging, anomaly detection, and activity monitoring
• Infrastructure Hardening: Built on hardened cloud infrastructure (GCP)
• Key Management: Enforced policies for key rotation and secure storage
• Vendor Security Reviews: Assessments of all processors and sub-processors

This is not a comprehensive list of our security controls. For a more detailed overview, you may contact us at infosec@incorta.com.

Security and Our Service Providers

Incorta ensures that any third-party service providers who process personal information on our behalf adhere to equivalent or stronger data protection and security measures. We include contractual safeguards such as data processing agreements and regular compliance checks.

Third-party subprocessors are assessed for:

• Data access controls
• Encryption protocols
• Certifications (e.g., ISO 27001, SOC 2)
• Breach response procedures

We maintain a list of authorized subprocessors, which can be made available upon request. We provide reasonable advance notice of new subprocessors and allow customers to object to changes as set out in our Data Processing Agreement.

Oversight and Complaint Management

If you have concerns or complaints about how your personal information is handled, we encourage you to contact us directly so that we can resolve the issue promptly.

• You can reach us at: privacy@incorta.com
• Or by submitting a request via our online privacy form

Incorta has appointed Privaon Oy as our external Data Protection Officer (DPO) under the GDPR.

Privaon Oy represents Incorta in matters relating to data protection compliance, complaint resolution, and risk mitigation. If your concern is unresolved or relates specifically to GDPR compliance, you may contact our DPO using the same contact methods above. Please include “DPO Inquiry” in the subject line if applicable.

You also have the right to contact your local data protection authority at any time regarding your privacy rights or concerns.

The Finnish Office of the Data Protection Ombudsman serves as Incorta’s lead supervisory authority under the GDPR. To find the contact details for your national supervisory authority, visit: https://edpb.europa.eu/about-edpb/board/members_en

How We Use Cookies and Similar Technologies

When you visit our websites or use our online services, Incorta and third parties may use cookies and other tracking technologies such as web beacons, pixels, tags, and analytics tools to collect and store information about your usage.

We use these tools to:

• Ensure our websites function properly (strictly necessary cookies)
• Measure and improve performance
• Personalize content and ads based on your interests
• Understand how users interact with our content (e.g., video heatmaps)

Some cookies are essential for website operation. Others, such as marketing or analytics cookies, require your explicit consent if you're located in the EU or EEA.

Types of Cookies We Use

We categorize cookies as follows:

• Strictly Necessary Cookies – Essential for basic site functionality
• Performance Cookies – Measure website usage and performance
• Functional Cookies – Remember choices like language or preferences
• Analytics Cookies – Help us understand how users interact with our site
• Targeting & Advertising Cookies – Deliver ads more relevant to you

We may also use:

• Wistia tracking for video engagement analytics
• Web beacons in emails to measure open and click rates
• Conversion pixels to understand marketing effectiveness

Managing Your Cookie Preferences

You have control over how cookies are used:

• EU users are presented with a cookie banner to provide or deny consent
• You can change your preferences at any time using the “Cookie Settings” link at the bottom of our website
• You may also manage or delete cookies through your browser settings
• Some browsers allow you to browse in incognito/private mode or use extensions to block trackers

View instructions for managing cookies in your browser

Legal Basis for Cookies

• In the EU, we rely on explicit consent under the ePrivacy Directive and GDPR for non-essential cookies.
• In California, under the CCPA/CPRA, users can opt out of certain cookie uses that may qualify as “selling” or “sharing” personal data. Because we do not currently sell or share personal information as defined under the CPRA, we are not required to provide a “Do Not Sell or Share” link; if our practices change, we will add one and honor opt-out requests as required.

We maintain a cookie consent log for five years, consistent with supervisory-authority guidance and applicable limitation periods.

Third-Party Tools and Embedded Content

Incorta websites and services may include buttons, tools, or content that link to other companies’ services (for example, a Facebook "Like" button). We may collect information about your use of these features. In addition, when you see or interact with these buttons, tools, or content or view an Incorta web page containing them, some information from your browser may automatically be sent to the other company.

Please read the company's Global Privacy Notice for more information regarding its use of that information.

Please note that if you click on a link to a third-party website or service, any data you provide will be subject to that third party’s Privacy Notice, and not this one.

Do Not Track (DNT) Signals

Some web browsers and mobile operating systems offer a "Do Not Track" (DNT) feature to signal your preference regarding tracking activities. At this time, there is no industry standard for how to respond to these signals, and Incorta does not currently respond to DNT browser signals. We continue to monitor developments and will update this policy if a standard is established.

Children’s Privacy

Incorta's Services are B2B (business-to-business) software products designed for use by enterprise customers and their authorized personnel. Our Services and websites are not directed to, marketed to, or intended for use by children under the age of 16 (or the equivalent minimum age in the relevant jurisdiction).

Incorta does not knowingly collect, solicit, or process personal information from children under 16. We do not maintain content of a kind likely to attract a child audience, and our registration processes are designed for business users.

If we become aware that we have inadvertently collected personal information from a child under the age of 16 without verified parental or guardian consent, we will take reasonable steps to delete that information immediately.

Because our Services are not directed to children, we have not produced a child-friendly version of this Notice. If a parent, guardian, or child believes that a child under 16 has provided personal information to Incorta, please contact us at privacy@incorta.com and we will respond promptly.

If you have any questions about how we process your personal data, or if you wish to exercise your data protection rights, you can contact our Data Protection Officer directly at privacy@incorta.com. If you believe that your personal data has not been processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or applicable national data protection law, you also have the right to lodge a complaint with a Supervisory Authority.

In particular, you may contact the Supervisory Authority in the country where:

• You normally live,
• You work, or
• The alleged infringement of data protection law has taken place.

For individuals located in Finland, the competent supervisory authority is:

• Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
• P.O. Box 800
• 00531 Helsinki
• Finland
• Email: tietosuoja@om.fi
• Telephone: +358 29 566 6700
• Website: www.tietosuoja.fi

Please note that contacting our DPO does not limit your right to lodge a complaint with a supervisory authority.