1. Who we are
Incmply Solutions Limited ("Incmply", "we", "us") is the controller of the personal data described in this policy.
| Company | INCMPLY SOLUTIONS LIMITED |
|---|---|
| Registered in | Republic of Ireland, CRO no. 768826 |
| Address | 59-60 O'Connell Street, Limerick, Ireland |
| VAT number | IE4316908FH |
| Privacy contact | [email protected] |
You can contact us about anything in this policy at the email address above or by post to our address.
2. Scope and our role
This policy covers personal data we process as a controller when you visit incmply.com, fill in one of our forms, request a report, receive our emails, or do business with us.
It does not cover the data our customers upload to the Incmply platform about their own clients. For that data, Incmply acts as a processor on behalf of the customer (for example, a law firm), under a data processing agreement. If a firm uses Incmply to carry out due diligence on you, please contact that firm about your data. We will pass on any request we receive to them.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Contact details | First and last name, work email, company name, job title | You, through our forms or emails |
| Company details | Company registration number, country of residence | You, through our forms |
| Form answers | AML areas you want reviewed, expected case files, users and checks, services selected | You, through the Identify GAPs and solution estimate forms |
| Consent records | Whether you agreed to our Privacy Policy and to marketing emails, with date, time and form used | You, when you submit a form |
| Communications | Emails, meeting notes, support requests | You |
| Customer account data | Platform users' names, work emails, login and activity logs | Your employer or you, when using Incmply |
| Billing data | Billing contact, invoice address, VAT number | Your company |
| Technical data | IP address, browser, device, pages visited, cookie identifiers | Your device, through our website |
| Public company data | Publicly available information about the company named in a report request, such as its registration details and the names and roles of its directors and owners | Public registers and other public sources |
Please only give us a colleague's details if they know you are doing so.
4. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Generate and send the AI Onboarding Report you request | Steps you ask for before a contract (6(1)(b)) |
| Reply to gap reviews, estimate requests and other enquiries | Steps you ask for before a contract (6(1)(b)) |
| Provide the platform, manage accounts, support and billing | Performance of a contract (6(1)(b)) |
| Send AML 6 updates, news and product emails | Your consent (6(1)(a)) |
| Include public data on directors and owners in a report | Our legitimate interest in providing accurate company reports that the requester has asked for (6(1)(f)) |
| Keep proof of consent and handle your rights requests | Legal obligation (6(1)(c)) |
| Keep accounting and tax records | Legal obligation under Irish law (6(1)(c)) |
| Secure the website and platform, prevent fraud and misuse | Legitimate interests (6(1)(f)) |
| Understand how the website is used and improve it | Your consent, where non-essential cookies are used (6(1)(a)) |
| Establish, exercise or defend legal claims | Legitimate interests (6(1)(f)) |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.
5. Marketing emails
We only send you marketing emails if you tick the marketing box on one of our forms. Agreeing to our Privacy Policy alone does not sign you up.
You can withdraw your consent at any time by clicking "unsubscribe" in any of our emails or by writing to [email protected]. Withdrawing does not affect emails sent before, and it does not stop service emails about a report or account you have with us. We keep a record of your opt-in and opt-out so we can prove your choice.
6. AI-generated reports
The AI Onboarding Report is produced automatically. Our system collects publicly available information about the company you name, and an AI model provided by OpenAI summarises it into a report.
- The report is sent only to the person who requested it.
- Risk levels in the report are indicative. They are not a decision about you and have no legal or similarly significant effect on you (GDPR Art. 22).
- Our AI provider processes the data on our instructions and does not use it to train its models.
- If you are a director or owner named in a report and think the information is wrong, contact us and we will correct or remove it.
8. International transfers
We store your data in Ireland. Some providers, including Google (Google Analytics 4) and OpenAI, may process it in the United States, outside the European Economic Area.
When that happens, we protect it with one of these safeguards:
- A European Commission adequacy decision for the country, including the EU-US Data Privacy Framework for certified US companies
- The European Commission's Standard Contractual Clauses, with a transfer risk assessment
You can ask us for a copy of the safeguards we use.
9. How long we keep your data
We keep personal data only as long as we need it for the purposes above.
| Data | Retention |
|---|---|
| Enquiries and form submissions that don't become customers | 24 months after our last contact |
| AI Onboarding Reports | 12 months after they are generated |
| Marketing list | Until you unsubscribe; the consent record for 3 years after that |
| Customer account data | For the contract, then 6 years |
| Invoices and accounting records | 6 years, as required by Irish tax law |
| Website logs | 90 days |
After that, we delete or anonymise the data.
10. Security
We protect your data with encryption in transit and at rest, role-based access controls, and confidentiality commitments from everyone who handles it. If a personal data breach is likely to put your rights at risk, we will notify the Data Protection Commission within 72 hours and tell you where the law requires it.
11. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy
- Correct data that is wrong or incomplete
- Have your data erased
- Restrict how we use your data
- Receive your data in a portable format
- Object to processing based on our legitimate interests
- Object to direct marketing at any time, without giving a reason
- Withdraw consent at any time
To use these rights, email [email protected]. We may ask you to confirm your identity. We reply within one month, extendable by two months for complex requests, and we don't charge a fee in normal cases.
You can also complain to the Irish supervisory authority, the Data Protection Commission, or to the authority where you live or work. We'd appreciate the chance to resolve your concern first.
12. Cookies, children and changes
Cookies. We use essential cookies to run the website. We use Google Analytics 4 and other non-essential cookies only with your consent. You can change your cookie choices at any time through the cookie banner on our website.
Children. Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect children's data.
Changes. We may update this policy. The "Last updated" date at the top shows the latest version, and we will tell you about significant changes by email or on our website.
Contact. Incmply Solutions Limited, 59-60 O'Connell Street, Limerick, Ireland. Email: [email protected]