Introduction

We at IC Research Institute (“IC Research” or “we”) respect data privacy and are committed to protecting it through our compliance with this policy. As a leading provider of B2B-SaaS solutions in consultant relationship management, we are committed to providing a high calibre data led solution for all of our clients, as part of that we take data compliance extremely seriously and are pro-active in ensuring the compliance of both the B2B-SaaS solution we provide to our customers as well as ensuring compliance as a business entity in our own right. With this Privacy Policy, we would like to inform how we manage personal data.

Responsible body

IC Research Institute GmbH
TaunusTurm | Taunustor 1
60310 Frankfurt am Main | Germany

Data Protection Officer

ePrivacy GmbH
Burchardstrasse 14
20095 Hamburg | Germany
www.eprivacy.eu

Certifications

Purpose of this Statement

The purpose of this statement is to provide information regarding how and why we collect, process, store, and share data with our customers as well as how we protect information in connection with the service and use of information of a data subject. This Privacy Policy explains how we collect business information pertaining to institutional investment consultants and related people as well as all other types of information through our website and B2B-SaaS online platform; how we maintain, use and share that information; and how data subjects can manage the way information about them is handled. For all three groups of data subjects we provide the appropriate contact information to request the information we hold, withdraw from processing or request deletion of any data.

IC Research welcomes the GDPR as an important step forward in streamlining data protection requirements across the EU and beyond via the EU-U.S. Privacy Shield Framework and as an opportunity to deepen our commitment to data protection. Similar to other existing legal requirements, compliance with the GDPR requires a partnership between IC Research and our customers in their use of our services. We are committed to our customers’ success, including compliance with the GDPR. Therefore, we comply with the GDPR in the delivery of our services to our customers and we are dedicated to helping our customers comply with the GDPR.

Under the EU General Data Protection Regulation (GDPR) there are six lawful bases for processing personal data. These are Consent, Contract, Legal Obligation, Vital Interests, Public Task, and Legitimate Interests. In case of Legitimate Interests processing is necessary for an individual’s legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

IC Research also welcomes the California Consumer Privacy Act (CCPA) as an important step forward in streamlining data protection requirements across the State California and as an opportunity to deepen our commitment to data protection. Similar to other existing legal requirements, compliance with the CCPA requires a partnership between IC Research and our customers in their use of our services. We are committed to our customers’ success, including compliance with the CCPA. Therefore, we comply with the CCPA in the delivery of our services to our customers and we are dedicated to helping our customers comply with the CCPA.

Data Protection and ePrivacy

At IC Research, trust is our highest value and nothing is more important to us than the protection of the personal data stored, processed and managed on our B2B-SaaS online platform as well as the protection of our customers’ personal data. Our robust privacy and security program meets the highest standards in the industry. IC Research has implemented measures designed to secure personal data from accidental loss and from unauthorized access, use, alteration and disclosure. All information is stored in Germany [EU] within a secure environment and on servers powered by Host Europe Group protected by state-of-the-art firewalls, malware detectors, SQL injection and cross-site scripting, vulnerability checks, cross-site request forgery as well as other cybersecurity software. All processed transactions, regardless of their nature, are encrypted using SSL technology provided by GeoTrust, one of the world’s leading certificate authorities. In addition to technology, administrative and physical security measures have also been implemented in order to manage the security of personal data and to prevent unauthorized access or use. The International Organization for Standardization (ISO) provides a systematic approach to managing sensitive information including people and processes in addition to IT systems, by applying a risk management process. Globally, it is the best-known standard providing requirements for an Information Security Management System (ISMS).

Personal Data on our B2B-SaaS Online Platform

As an organization that processes business related data and information for and of professionals, IC Research advised by several external legal advisors, has assessed all six grounds for lawful processing of personal data and has selected ‘Legitimate Interests’ as the most suitable lawful ground for the processing of data on our B2B-SaaS online platform. We collect, process and store publicly available and generally accessible data relating to businesses and business professionals in institutional investment consulting. We believe that the individuals that we process the data of are likely to have an interest in the IC Research online services. The typical segmentation of institutional investment consultants includes manager researchers, field consultants, portfolio managers, analysts, actuaries and related job functions. The personal data we collect are first, middle and last name, job title, job function, asset classes covered, business email address, office phone number (switchboard), office location (city, area, country), business network link, and business CV. IC Research will only ever collect, process and store the essential information required for making contact with the data subjects within a business environment (B2B). Other business-related data may be processed; however we do not collect further personal data such as those classed under ‘Sensitive Personal Data’ like private, political, religious or medical data. We do not do profiling as defined by the GDPR/CCPA which is more than just the collection of personal data, but its use to evaluate certain aspects related to the individual and to predict the individual’s behavior and take decisions regarding it. The data collected will be used to communicate business, marketing and sales messages by our clients. Our clients specifically only send messages to data subjects they believe are likely to be interested in based upon the organization they are employed by and based upon their job function within that organization. Messages could be delivered via email, social media, telephone, letter or any other business to business (B2B) marketing methods that may be relevant.

Procurement of Data

IC Research creates data sets of companies and business people in the institutional investment consulting industry from different sources. The resulting directory (The IC Research Global Database) is then made available to our clients. The data originates from publicly available sources only, including company websites, company information providers, associations, the U.S. Securities and Exchange Commission (SEC), the Financial Conduct Authority (FCA) in the UK, social business networks, and news articles of digital publishing magazines. Research is conducted by digital as well as manual procedures. Categories of our customers are institutional investors and asset management companies.

Lawful Bases is ‘Legitimate Interests‘

IC Research has carried out a Legitimate Interests Assessment (LIA) advised by several external legal advisors. Based upon these assessments it is deemed that the rights and freedoms of the data subjects would not be overridden in our correspondence regarding IC Research and that in no way would a data subject be caused harm. Founded on our segmentation by organization and by specific job function, we are convinced that any individual included in our database could be legitimately interested in being listed. As only personal related data within the context of a business environment (B2B) from publicly available and generally accessible sources are processed on our B2B-SaaS online platform, the collection, combination and transfer of the data to our clients is lawful within the framework of the GDPR/CCPA.

Per external and therefore objective legal advisor’s guidance, IC Research can confirm:

• We have checked that legitimate interests is the most appropriate basis
• We understand our responsibility to protect the individual’s interests
• We have conducted a legitimate interests assessment (LIA)
• We have identified the relevant legitimate interests
• We have checked that the processing is necessary and there is no less intrusive way to achieve the same result
• We have done a balancing test, and are confident that the individual’s interests do not override those legitimate interests
• We only use individuals’ data in ways they would reasonably expect
• We are not using people’s data in ways they would find intrusive or which could cause them harm
• We have considered safeguards to reduce the impact where possible
• We will always ensure there is an opt-out / ability to object
• Our Legitimate Interests Assessment (LIA) did not identify a significant privacy impact
• We keep our Legitimate Interests Assessment (LIA) under permanent review
• We include information about our legitimate interests in our privacy notice
• We do not process the data of children

Data Retention

We will retain personal data for as long as it is needed to provide an up-to-date B2B-SaaS online platform. IC Research has an in-house data verification team, who is responsible for ensuring the validity and quality of the data contained within The IC Research Global Database. The team continually, i.e. on a daily basis, cleanses the data held. Any records found to be out of date are securely purged immediately. IC Research will retain and use personal related data only as long as necessary in order to comply with our legal obligations, resolve disputes, and enforce our agreements.

Transfers of Personal Data outside the European Economic Area (EEA)

IC Research may transfer personal data outside the European Economic Area (EEA). For any transfers of personal data outside the EEA, IC Research is required to provide appropriate safeguards to protect such information. This may be done in a number of ways, for instance:

• The country that we send the data to is approved by the European Commission as offering an adequate level of protection for personal data like Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay
• The recipient has signed “model contractual clauses” approved by the European Commission, obliging the recipient to protect personal data

If none of the above listed ways applies, IC Research will not transfer any personal data outside the European Economic Area (EEA).

Request to Modification or Deletion of Personal Data

Upon request to B2Bdata@ic-research.com data subjects of our B2B-SaaS online platform can request for modification or deletion of personal data at any time. This request will be executed within 24 hours. This applies only to the processing of personal related data, not of business related data which does not fall under the remit of GDPR/CCPA.

Personal Data of our Customers

The typical segmentation of our customers includes institutional investors, asset management companies and global placement agencies, represented by their staff within portfolio management, pension management, consultant relationship management, institutional relationship management, distribution, institutional marketing, sales, business development and related job functions.

Procurement of Data

In order to receive a username and password to login to The IC Research Global Database individuals need to be registered as a customer with first and last name as well as business email address. Prior to initial login individuals as users need to explicitly acknowledge and consent to our Privacy Policy and Terms of Service. In order to authenticate login and ensure compliance with the Terms of Service and to provide the highest service levels, the login and use are monitored, also by anonymized IP address, localization data, operating system and web browser. We also use this personal data to answer requests by the customer concerning the use of our B2B-SaaS online platform, help diagnose technical problems and to gather information about user population to optimize our services for our customers. In this respect we use personal data only in ways that are compatible with the purposes for which it was received. We do not do profiling as defined by the GDPR/CCPA which is more than just the collection of personal data, but its use to evaluate certain aspects related to the individual and to predict the individual’s behaviour and take decisions regarding it. We also take reasonable steps to ensure that personal data is relevant to its intended use, accurate, complete and current. This data is not passed on to third parties and is exclusively used to offer the best possible service. If we post customer testimonials on our website, it always obtains prior consent.

Lawful Bases is ‘Consent‘

Before using personal data of our customers in order to provide the services and features related to our B2B-SaaS online platform, individuals have provided ‘Consent’ by one of the means listed above under Procurement of Data. We immediately respect customers’ right to object from any method of correspondence at any time. When using email addresses for standard communication purposes like newsletters we always provide an opportunity to opt-out.

Data Retention

We only retain personal data of customers for as long as a customer’s account is valid or as needed to provide our services.

Transfers of Personal Data outside the European Economic Area (EEA)

Transfers of personal data outside the European Economic Area (EEA) do not take place.

Request to Modification or Deletion of Personal Data

Upon request to B2Bdata@ic-research.com customers as data subjects can request for modification or deletion of personal data at any time. This request will be executed within 24 hours.

Personal Data of our Prospects

The typical segmentation of our prospects includes institutional investors, asset management companies and global placement agencies, represented by their staff within portfolio management, pension management, consultant relationship management, institutional relationship management, distribution, institutional marketing, sales, business development and related job functions.

Procurement of Data

At IC Research we procure data in a variety of ways, collected in line with the lawful basis of ‘Consent’. If individuals have received correspondence from us, we will have procured the data in one of the following ways:

• Individuals have requested information from IC Research
• Individuals have requested a web demo from IC Research
• We have previously met at an event and the business card or contact details were handed to us willingly
• Individuals have previously connected with a member of our team via the LinkedIn and discussed our services

We do not do profiling as defined by the GDPR/CCPA which is more than just the collection of personal data, but its use to evaluate certain aspects related to the individual and to predict the individual’s behaviour and take decisions regarding it.

Lawful Bases is ‘Consent‘

Before using personal data of our prospects to process requests and to inform them by email on our services, individuals have provided ‘Consent’ by one of the means listed above under Procurement of Data. We immediately respect prospects’ right to object from any method of correspondence at any time. When using email addresses for standard communication purposes like newsletters we always provide an opportunity to opt-out.

Data Retention

We only retain personal data of prospects for as long as needed to provide our services. Any inactive records will be deleted within one month.

Transfers of Personal Data outside the European Economic Area (EEA)

Transfers of personal data outside the European Economic Area (EEA) do not take place.

Request to Modification or Deletion of Personal Data

Upon request to B2Bdata@ic-research.com customers as data subjects can request for modification or deletion of personal data at any time. This request will be executed within 24 hours.

Google analytics

We use Google Analytics, a web analytics service provided by Google, Inc., on our site. Google Analytics uses cookies or other tracking technologies to help us analyze how users interact with and use the site, compile reports on the site’s activity, and provide other services related to site activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a return visitor, and any referring website. The site does not use Google Analytics to gather information that personally identifies you. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google’s privacy policies. To learn more about Google’s partner services and to learn how to opt out of tracking of analytics by Google click here.

Cookie Policy

This site uses cookies to store information on your computer. We will ask you to consent to our use of cookies in accordance with the terms of this policy. This website only uses Functionality cookies – these cookies allow the website to remember choices you make (such as your user name, language or the region you are in) and provide enhanced, more personal features. For instance, this website may be able to provide you with local news by storing in a cookie the region in which you are currently located. These cookies can also be used to remember changes you have made to text size, fonts and other parts of web pages that you can customize. They may also be used to provide services you have asked for, such as, watching a video or commenting on a blog. The information these cookies collect may be anonymized and they cannot track your browsing activity on other websites. Please note that this website does not use targeting cookies or advertising cookies. Most browsers are set to accept cookies. However, you have the ability to disable cookies if you wish, generally through changing your internet software browsing settings. It may also be possible to configure your browser settings to enable acceptance of specific cookies or to notify you each time a new cookie is about to be stored on your computer enabling you to decide whether to accept or reject the cookie.

Changes to our Privacy Policy

It is our policy to disclose any changes we make to our Privacy Policy on this page. If we make material changes to how we treat data subjects’ personal information, we will inform on this website. This Privacy Policy was last revised on 30th August 2019.

Contact Information

To ask questions or comment about this Privacy Policy and our privacy practices, contact us at IC Research Institute GmbH | TaunusTurm | Taunustor 1 | 60310 Frankfurt am Main | Germany or by sending an email to contact@ic-research.com at any time.