Privacy Policy

The controller responsible for data processing on this Site within the meaning of the GDPR is:

3.1 Legal bases

Where we process personal data, we rely on one of the following legal bases: your consent (Art. 6(1)(a) GDPR), performance of a contract or pre-contractual steps you requested, such as a job application or contact enquiry (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c) GDPR), or our legitimate interest in operating a secure, functioning website and responding to enquiries (Art. 6(1)(f) GDPR).

3.2 Retention

We retain personal data only for as long as necessary for the purpose it was collected for, or as required by statutory retention obligations. Contact and job application submissions are deleted once the enquiry or hiring process is concluded, unless you ask us to delete them sooner or a legal retention duty applies.

This Site is hosted on Firebase Hosting, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). DNS resolution and network-level routing are additionally provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"), which sits in front of the Site as a reverse proxy/CDN. Every time you access the Site, Google and/or Cloudflare automatically record technical access data in server log files, typically: IP address, date and time of the request, the page requested, HTTP status code, browser type and version, operating system, and the referring URL. This data is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the stable, secure operation of the Site. Data may be processed on servers outside the EU/EEA (e.g. in the US), safeguarded by the EU Standard Contractual Clauses.

Across this Site, we use Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland ("Microsoft"), to understand how visitors interact with our pages, for example through anonymised heatmaps and session insights. Clarity is only activated if you accept it via the cookie banner shown on the Site, and it uses cookies and similar technologies to recognise your browser during a session for this purpose. This processing is based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time by clearing your cookies and declining again, or by contacting us using the details in Section 2. See Microsoft's privacy statement for details.

When you use the contact form, we collect the data you enter: first name, last name, email address, company, country, phone number, subject and your message. To prefill the country field, we query a third-party IP geolocation service (geojs.io) with your IP address; we do not store the IP address ourselves. This data is processed to answer your enquiry (Art. 6(1)(b)/(f) GDPR).

When you apply for a position via our career/apply form, we collect: first name, last name, email address, phone number, the position you are applying for, your LinkedIn profile (if provided), your message, and any documents you upload (e.g. CV, cover letter — up to 3 PDF files, 5 MB each). This data is processed to evaluate your application (Art. 6(1)(b) GDPR — pre-contractual steps taken at your request).

Submissions from these forms, including uploaded application documents, are transmitted through a purpose-built, server-side integration and securely stored within our internal Google Workspace environment, to which only authorised Ibency staff have access. Google Workspace processing is governed by Google's data processing terms; data may be processed on servers in the US, safeguarded by the EU Standard Contractual Clauses. We do not use this data for advertising and do not sell it to third parties.

To protect our contact and application forms from automated abuse, we use Cloudflare Turnstile, a CAPTCHA alternative provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile analyses signals such as your browser environment and interaction behaviour to distinguish humans from bots, and may set a cookie or use local storage for this purpose. This processing is based on our legitimate interest in preventing spam and automated abuse of our forms (Art. 6(1)(f) GDPR). Data may be transferred to the US; Cloudflare participates in the EU Standard Contractual Clauses. See Cloudflare's privacy policy for details.

We do not use advertising or third-party marketing cookies. Beyond the strictly necessary cookies required for security and core functionality, such as the bot-protection token described in Section 6, this Site displays a cookie banner offering you the choice to accept or decline Microsoft Clarity analytics cookies (see Section 4). Clarity is only activated after you actively accept it; if you decline, no analytics cookies are set. Your choice is remembered on your device so the banner does not reappear on every visit. These analytics cookies do not identify you personally and are not used for advertising. You can change your mind at any time by clearing your browser's local storage for this Site, which will show the banner again, or by adjusting your browser's cookie settings directly. This does not affect the strictly necessary cookies required for the Site to function.

Subject to the conditions set out in the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15 GDPR);
• request rectification of inaccurate data (Art. 16 GDPR);
• request erasure of your data ("right to be forgotten", Art. 17 GDPR);
• request restriction of processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on our legitimate interest, including profiling (Art. 21 GDPR);
• withdraw consent at any time, without affecting processing carried out before withdrawal (Art. 7(3) GDPR);
• lodge a complaint with a supervisory authority — for Ibency GmbH, the competent authority is the data protection authority of North Rhine-Westphalia (Art. 77 GDPR).

To exercise any of these rights, contact us using the details in Section 2.

We share personal data only with the processors described above (Google Firebase Hosting, Cloudflare, Google Workspace, Microsoft, geojs.io) to the extent necessary to operate the Site, and with public authorities where we are legally obliged to do so. We do not sell personal data. Where a processor is located outside the EU/EEA, the transfer is safeguarded by the EU Standard Contractual Clauses or an equivalent adequacy mechanism.

We may update this Privacy Policy from time to time to reflect changes to the Site or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.