Personal Information Notice

Who this notice is for

This notice explains how VLOUM SAS, trading as Icypeas ("Icypeas", "we" or "us"), collects, generates, uses and discloses professional personal information when acting as a controller. It covers individuals in our independently maintained professional database, including people who have never registered for an Icypeas account.

You can object to inclusion in our database and request removal at https://www.icypeas.com/opt-out or by emailing dpo@icypeas.com. This notice is publicly available without an account and may also be linked from individual privacy notifications.

Who is responsible and how to contact us

The controller is VLOUM SAS, SIREN 919 561 266, SIRET 919 561 266 00017, with its registered office at 31 rue Victor Massé, 75009 Paris, France.

Privacy Contact: Pierre Landoin, CEO
Privacy enquiries and rights requests: dpo@icypeas.com
Postal correspondence: Privacy Contact, VLOUM SAS, at the address above.

Our general Privacy Policy, covering matters such as accounts and use of our website, is available at https://www.icypeas.com/legal/privacy-policy.

Our role depends on the processing

Icypeas is an independent controller for the collection, maintenance and disclosure of information in its own professional database, including matching records disclosed through Find People or other services. Customers are responsible for their subsequent use as controllers or under the instructions of their own controllers.

Where we process customer-supplied data and search results solely on a customer’s behalf, we act as processor or subprocessor under our Data Processing Agreement. That processing does not authorise us to incorporate customer data into a shared commercial database or reuse it for unrelated purposes. We assist the relevant customer with rights requests concerning that processing. A service name or an input alone does not determine the applicable role.

Information we process

Depending on the record and service, professional information may include your name; business email address; job title, department, seniority and professional location; employer, company website and domain; public professional profile URLs and identifiers; employment history, education, skills and languages; employer firmographic or technographic information linked to your record; professional telephone numbers, including business direct lines and mobile numbers used in a professional context; and available source, recency, accuracy and verification information.

We may infer or generate information, such as likely business email formats or verification status. Our services are not intended to collect special-category data or criminal-conviction data.

Where the information comes from

We obtain information from publicly accessible professional sources, including company websites, public professional profiles and social networks such as LinkedIn, directories, publications and other public web pages, and from third-party data providers, including Avanteer. We may generate or verify professional email information using company domains, observed business email formats and technical checks, including SMTP queries to mail servers.

Customers also submit information for searches and verification. Such submissions are handled according to the applicable controller or processor role described above. Information from several independent sources may be combined in a professional record. On request, we provide the source information and dates available to us; where information is not retained or available, we explain that limitation.

Why we process information and our legal bases

We process professional information to create, organise, maintain and update professional records; provide business contact discovery, search, enrichment, email verification, reverse email lookup and professional phone number discovery; and make relevant records available to business customers through our application, APIs and partner integrations. Customers may use the information for lawful B2B sales, marketing, recruitment and business research.

For these controller activities, we rely on legitimate interests under Article 6(1)(f) GDPR: providing accurate professional information and enabling relevant professional connections and business research. We assess those interests against individuals’ rights and reasonable expectations, taking account of the information, its sources and our safeguards.

We also process limited information to secure and troubleshoot services, prevent misuse, maintain accuracy, handle objections and suppression, and establish or defend legal claims, relying on legitimate interests where applicable. Processing necessary to comply with applicable legal obligations, including responding to statutory rights requests, is based on Article 6(1)(c) GDPR.

Who receives professional information

Recipients may include business customers; authorised partners, distributors and resellers and, where permitted, their business customers; providers supporting hosting, infrastructure, communications, security and customer support; professional advisers and prospective purchasers or investors subject to appropriate confidentiality safeguards; and competent authorities where disclosure is legally required or otherwise lawful.

Professional information may be disclosed commercially, including through APIs and partner integrations. Customers and partners must comply with their own legal obligations and our contractual terms. Information about our service providers is available at https://www.icypeas.com/legal/gdpr-statement.

International transfers

Our core application infrastructure and databases are hosted in the EEA, including with OVHcloud and Scaleway in France. Information may also be accessed by customers, partners or providers outside the EEA. Where a transfer requires safeguards, the applicable mechanism may be an adequacy decision, including the EU–US Data Privacy Framework for recipients whose active certification covers the transfer, or the European Commission’s Standard Contractual Clauses under Decision (EU) 2021/914, with supplementary measures where required.

For transfers subject to UK or Swiss law, the applicable UK Addendum or Swiss adaptations are used where relevant. You may request information about the safeguards applicable to your data and a copy of relevant safeguards by emailing dpo@icypeas.com, subject to lawful redactions protecting confidential information.

How long we keep information

Independent professional database records. We do not apply a fixed retention period to records in our independently maintained professional database. We retain professional information for as long as it remains relevant, sufficiently accurate and necessary to provide our business information services, and its continued processing remains supported by a valid legal basis. We periodically review these conditions and update, delete or irreversibly anonymise information that no longer meets them. Records may therefore remain in our database over an extended period, subject to these ongoing assessments and individuals’ rights. Following a valid opt-out or erasure request, we remove the relevant information from active database outputs and retain only the limited records described below.

Search records and results: API and individual web application searches are retained for six months after completion; bulk web application jobs are retained for three years after completion, subject to earlier lawful deletion instructions and applicable obligations. These records support service delivery and traceability when handling rights requests.

Suppression records: following an opt-out, we remove the relevant professional information from active database outputs and retain only the minimum suppression identifiers, including hashes where appropriate, for as long as necessary to prevent reintroduction and further disclosure. Suppression applies even if matching information is subsequently collected, inferred or verified again. Limited information may be retained where legally required or necessary for legal claims, with access and use restricted to that purpose.

Your rights and permanent opt out

Under the GDPR, you may request access, correction, erasure or restriction, subject to the applicable conditions. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing is for direct marketing, your right to object is unconditional and we stop processing for that purpose. Data portability applies where its legal conditions are met.

Use https://www.icypeas.com/opt-out or email dpo@icypeas.com. We respond without undue delay and normally within one month. Where a lawful extension is necessary, we explain the reasons within the initial month. Requests are normally free. If we have reasonable doubts about identity, we may request proportionate additional information.

Where required by Article 19 GDPR, we communicate rectification, erasure or restriction to recipients, unless this proves impossible or involves disproportionate effort. We identify those recipients on request. An Icypeas opt-out does not itself erase copies independently held by other controllers; those controllers must address their own obligations.

You may lodge a complaint with the CNIL (https://www.cnil.fr/) or another competent supervisory authority, without first contacting Icypeas. Additional rights may apply under UK, Swiss or other applicable privacy laws, including rights concerning sale or sharing where relevant.

Automated processing and updates

We use automated methods to match, infer, enrich and verify professional information. We do not use professional records to make solely automated decisions producing legal or similarly significant effects concerning you.

We update this notice when our practices change and display the current revision date above. Where required, we provide additional information about material changes or new processing purposes.

‍