Privacy Policy

This notice describes Digicust's processing as a controller, particularly when you visit our website, communicate with us, or when we administer business relationships, accounts and billing.

Where Digicust processes Customer Content and Customer-related usage, permission or log data on documented instructions to provide the Platform or agreed support, Digicust acts as a processor or subprocessor. The relevant Customer Agreement and Data Processing Agreement (DPA) govern that processing.

Customer Content processed on instructions is not used for Digicust's own advertising, general model training or independent product development. This notice does not grant Digicust additional rights over Customer Content.

Customer Content and Customer-related usage, permission and log data are processed on documented instructions to provide, secure, integrate and support the Platform. The Customer Agreement and DPA determine the nature, purposes, data categories, recipients, return and deletion.

At the end of processing, data is returned or deleted at the Customer's choice; backups are protected from productive use until deletion or overwrite unless mandatory law requires retention. Contractual transition, retrieval and deletion rules apply where a provider switch is relevant.

Data subjects should normally exercise rights regarding Customer-controlled content with the relevant Digicust Customer. Digicust assists that Customer under the DPA.

Depending on the activity, hosting, infrastructure, security, analytics, advertising, CRM, form, newsletter, communications, payment and professional advisory providers receive only necessary data. For Customer Content, the Digicust Trust Portal provides the current subprocessor register; the DPA and Appendix 2-C govern the contractually approved initial set and change process.

Cloudflare operates a globally distributed edge network and may process data, particularly in the United States. Where applicable, transfers rely on the EU-US Data Privacy Framework and, additionally, EU Standard Contractual Clauses. Other providers may permit limited third-country or remote access under their agreements. Such transfers rely on an adequacy decision or appropriate safeguards under Chapter V GDPR.

Personal data is deleted or anonymised when its purpose and applicable statutory or contractual evidence, security and limitation periods cease to apply. In the event of litigation, an authority investigation or a statutory retention duty, deletion may be suspended until the matter closes and the relevant period expires.

The seven-year period described in section 3 generally applies to relevant accounting and tax records. The provider periods or retention criteria stated in section 4 apply to LinkedIn Insight Tag and Apollo data. Section 5 and the relevant Agreement/DPA govern Customer Content retention.

Subject to the GDPR, you have rights including:

• access and a copy of your data;
• rectification of inaccurate and completion of incomplete data;
• erasure or restriction;
• data portability where applicable;
• objection under Article 21 GDPR, particularly to direct marketing;
• withdrawal of consent for the future without affecting prior lawfulness;
• protection against solely automated decisions producing legal or similarly significant effects, where applicable; and
• a complaint to a supervisory authority.

Austrian authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. To exercise your rights, contact privacy@digicust.com.

Version 1.2 · Effective 2 September 2026.

We update this notice following material changes to our processing or the law. Where required, we communicate material changes through appropriate channels.

This English version is provided for information only. The German version is the governing and authoritative version.