Privacy Policy

Who controls your data

IntelliCycle Inc., incorporated in British Columbia, Canada. IntelliCycle is the controller of the personal data described in this policy for the purposes of the UK and EU General Data Protection Regulation (GDPR), and is an organisation subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). This policy explains what personal data we collect through this website and the application at app.intellicycle.net, why we collect it, and the rights available to you.

Personal data we collect

We collect personal data directly from you, whether you submit the enquiry form, apply to open an account on the application, or write to us. We do not buy personal data from third parties, and we do not collect personal data about you from public sources except where that forms part of verification described below.

• Enquiry form data: name, company, country, whether you are buying or selling, material and approximate volume, email address, and phone number, submitted through the enquiry form on this website.
• Account and verification data: information submitted when opening or maintaining an account on the application, including company registration details, beneficial ownership information, sanctions screening results, and trade licence documentation. Some of this information may relate to identifiable individuals connected with the counterparty, such as directors or beneficial owners, rather than to you personally.
• Correspondence: the content of emails, messages, and other communications you send us.
• Technical logs: standard web server logs, such as IP address, browser type, and request timestamps, kept by our hosting provider for security and reliability. This website sets no cookies of its own and runs no analytics or tracking; see our Cookie Notice.

How we use it, and the lawful basis

We use personal data for the purposes below. Where the GDPR applies, each purpose is matched to a lawful basis under Article 6. We do not use personal data to make decisions about you based solely on machine processing without human review.

Responding to an enquiry submitted through the website

Legitimate interests, and steps taken at your request before a contract is entered into.

Opening and administering an account on the application, including verification

Performance of a contract with you or your company, and legal obligation, where verification is required by anti-money-laundering, sanctions, or export control law.

Communicating with you about an enquiry, account, or a trade

Performance of a contract, and legitimate interests in providing a responsive service.

Maintaining the security and reliability of the website and the application

Legitimate interests in protecting our systems and users.

Complying with legal and regulatory obligations, including sanctions screening and record keeping

Legal obligation.

Any other use for which we ask your consent

Consent, which you may withdraw at any time.

Decisions that affect you

Verification decisions, including whether to open, decline, or close an account, are made by our staff. We do not use personal data to make a decision that produces a legal effect concerning you, or a similarly significant effect, based solely on machine processing without human review.

Who we share it with

We share personal data only as needed to operate the website and the application, or to perform a contract for a specific trade. We do not share personal data with third parties for their own marketing purposes, and we do not sell personal data. The recipients we use are:

• our hosting provider, which stores the website and keeps technical logs;
• inspection, logistics, and escrow partners, strictly as needed to perform a contract for a specific trade;
• our professional advisers, including legal and accounting advisers, under confidentiality obligations; and
• regulators, law enforcement, or other authorities, where required by law.

Each of these recipients receives only the personal data it needs to carry out its role, and where a recipient processes personal data on our behalf, we require it by contract to protect that data and to use it only for the purpose we specify.

International transfers

IntelliCycle Inc. is based in Canada. Personal data collected through the website or the application may be transferred to and processed in Canada, which the European Commission and the UK recognise as providing adequate protection for personal data transferred to organisations subject to PIPEDA. Where a service provider we use processes personal data in another country, including our hosting provider, we rely on standard contractual clauses or another transfer mechanism recognised by applicable law.

How long we keep it

We keep personal data only for as long as needed for the purposes set out above, taking into account the sensitivity of the data, the risk of harm from unauthorised use, and any applicable legal or regulatory retention requirement. As a general schedule:

• an enquiry that does not lead to an account is kept for up to 24 months after our last exchange about it, then deleted;
• correspondence is kept while the relationship it relates to is active, and for up to 24 months afterwards;
• account, verification, and trade records are kept while the account is open, then for the period required by applicable anti-money-laundering, sanctions, and tax law, which in Canada is generally at least six years; and
• technical logs are kept by our hosting provider for a limited period, for security and reliability.

Where personal data is no longer needed, we delete it or render it anonymous.

Canadian privacy principles

For personal data subject to PIPEDA, we handle personal data in line with Canada’s fair information principles: we are accountable for the data we hold, we identify our purposes before or when we collect data, we limit collection to what a purpose requires, we limit use and disclosure to those purposes, we keep data as accurate as the purpose requires, we safeguard it, and we give individuals access to their own data and a way to challenge our compliance with this policy.

Your rights

Depending on where you are, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request erasure of your data;
• restrict or object to our processing of your data;
• receive your data in a portable format; and
• withdraw consent at any time, where consent is the basis for processing, without affecting processing carried out before the withdrawal.

To exercise a right, contact us using the details below. If you are in the EEA or UK, you may also complain to your local supervisory authority. If you are in Canada, you may complain to the Office of the Privacy Commissioner of Canada.

Security

We use administrative, technical, and organisational measures designed to protect personal data against unauthorised access, loss, or misuse, including access controls that limit which staff can view account and verification data to those who need it to do their job. No method of transmission or storage is completely secure, and we cannot promise perfect security.

Marketing communications

We do not use the personal data described in this policy to send you marketing communications unless you ask us to. If we ever do, each message will include a way to opt out.

Children

The website and the application are not directed at, and are not intended for use by, individuals under 18. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. A material change will be reflected in the “Last updated” date above.

Contact

Questions about this policy, or requests relating to your rights, can be sent to trade@intellicycle.net, marked for the attention of our Privacy Officer, who is accountable for our compliance with this policy.