Privacy Policy

1. What Information Do We Collect?

2. How Do We Process Your Information?

Depending on context, we process your personal information either on behalf of your employer (as processor) or for IDM's own operational purposes (as controller). Processing purposes include:

• Service Delivery (Processor Role): To facilitate account creation, authentication, and the generation of verified merchandising reports under the relevant Client's documented instructions.
• Communication: To send administrative notifications, provide product updates, and respond to support requests.
• Security & Integrity: To monitor for fraud, detect anomalies, protect platform integrity, and prevent automated abuse.
• Statistical Insights (Processor Role): To calculate and display individual and aggregate performance statistics — such as reports completed, images uploaded, and work time — visible to the user, authorized moderators, and administrators within the platform.
• Analytics & Improvement: To understand how the application is used and to improve performance and user experience.
• Legal Compliance: To fulfil obligations under Georgian law, including tax and audit record-keeping requirements.

We do not process your information for advertising purposes, nor do we use your data to build consumer profiles for marketing to third parties.

3. Legal Bases for Processing

We process personal information in accordance with the Georgian Law on Personal Data Protection (as amended) and, where applicable, the EU General Data Protection Regulation (GDPR) and UK GDPR. Legal basis depends on whether IDM acts as processor or controller in the specific context:

• Processing on Controller Instructions (Processor Role): For account, report, geolocation, and workforce analytics data processed within client workspaces, IDM processes data on the documented instructions of the relevant Client or End Client controller under the Terms of Service and DPA. In these contexts, the legal basis is determined by that controller.
• Performance of a Contract (Art. 6(1)(b) GDPR): Where IDM acts as controller, processing may be necessary to provide requested website and support functionality and to administer business communications.
• Legitimate Interests (Art. 6(1)(f) GDPR): Where IDM acts as controller, we process data for fraud prevention, platform security, and service improvement. We have assessed that these interests do not override your fundamental rights.
• Legal Obligation (Art. 6(1)(c) GDPR): We retain certain data to comply with Georgian tax and accounting requirements and to cooperate with lawful regulatory or law enforcement requests.
• Device Permissions and Withdrawal: Precise geolocation, camera, and storage access are controlled through your device operating system permissions and can be withdrawn at any time. Withdrawal does not affect prior lawful processing, but may prevent use of core features (for example, report submission). In employment contexts, the legal basis for processing that data is determined by the relevant controller.

4. When and With Whom Do We Share Your Information?

We do not sell, rent, or share your personal information with third parties for advertising or marketing purposes. We may share your data only in the following limited circumstances:

5. Cookies and Tracking Technologies

We use a small number of tracking technologies solely to maintain the security and operation of our Services and to measure internal usage metrics.

First-Party Analytics Script: We operate a proprietary analytics script that records aggregate usage metrics (session duration, feature interactions). This script does not share data with any advertising network and does not track you across third-party websites.

Session Cookies: We use session cookies necessary to keep you authenticated during your use of the application. These are deleted when you close your session.

Google reCAPTCHA: Our web platform uses Google reCAPTCHA to protect against automated abuse. reCAPTCHA may set a _GRECAPTCHA cookie and process behavioural and device signals. This cookie is strictly necessary for security purposes and is not used for advertising. It is subject to Google's privacy policy.

Embedded YouTube Videos (youtube-nocookie.com): Videos are configured for click-to-load playback and are not loaded automatically. No persistent YouTube cookies are set before you press play. When you choose to start playback, YouTube may process technical data in accordance with its own privacy policy and cookie policy. Each embedded player includes a clear notice before playback and encourages you to review those policies first.

We do not use third-party advertising cookies, retargeting pixels, or any tracking technology for commercial advertising purposes. No advertising networks have access to your data through our Services.

Most web browsers allow you to control cookies through their settings. Disabling strictly necessary cookies may affect your ability to use the Services.

If you use our mobile application, you may also clear locally stored data — including cached session data and application preferences — by clearing the application's cache through your device's application settings. Please note that clearing all application data (rather than only the cache) will sign you out of your account and remove any locally stored report drafts.

6. How Long Do We Keep Your Information?

We retain personal information only for as long as necessary for the purposes described in this Policy, or as required by law.

If your personal information has been stored in backup archives, we will securely isolate it from further processing until deletion from backups is possible.

7. How Do We Keep Your Information Safe?

We implement appropriate technical and organisational security measures to protect your personal information, including:

• Encryption of data in transit and at rest.
• Usage of advanced Firewall and intrusion detection systems.
• Access controls limiting internal access to personal data on a need-to-know basis.
• Regular review of our security practices.

However, no method of electronic transmission or storage is 100% secure. While we apply strict procedures to prevent unauthorised access, we cannot guarantee absolute security. Transmission of data to our Services is undertaken at your own risk. You should only access the Services within a secure environment.

In the event of a personal data breach affecting personal data processed on behalf of a business client, IDM will notify the relevant client (as controller) without undue delay and in line with the Data Processing Agreement. The relevant controller remains responsible for notifying supervisory authorities and affected data subjects where required by law. Where IDM acts as controller for its own processing activities, IDM will make any notifications required under applicable law.

8. Do We Collect Information From Minors?

Our Services are intended exclusively for business use by adults. We do not knowingly collect, solicit, or market to individuals under 18 years of age (or the equivalent minimum age in your jurisdiction).

By using our Services, you confirm that you are at least 18 years of age (or the equivalent minimum age in your jurisdiction). If we become aware that we have collected personal information from a person under the applicable minimum age, we will deactivate the account and promptly delete such data. To report such cases, contact us at privacy@idm.llc.

9. Your Global Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information. We will respond to all requests in accordance with applicable data protection law.

To exercise any of these rights, visit https://idm.llc/en/contact or email privacy@idm.llc. We may need to verify your identity before processing your request. Where your data is controlled by your employer (or, in partner arrangements, the relevant End Client), IDM may coordinate request handling directly while copying the controller and, where practicable, the Partner.

If you are located in the EEA or UK and believe we are processing your data unlawfully, you have the right to lodge a complaint with your Member State's data protection authority or the UK ICO. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC).

10. Controls for Do-Not-Track Features

Some web browsers and mobile operating systems include a Do-Not-Track ("DNT") signal. Because no uniform technical standard for recognising and honouring DNT signals has been finalised, our Services do not currently respond to DNT signals. If an enforceable standard is adopted, we will update this Policy accordingly.

11. Do We Make Updates to This Notice?

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal obligations. The "Last updated" date at the top of this Policy indicates when it was last revised. Where changes are material, we will notify you by email or by posting a prominent notice on our website prior to the changes taking effect. We encourage you to review this Policy regularly.

12. How Can You Contact Us About This Notice?

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

13. How Can You Review, Update, or Delete Your Data?

Based on the laws of your country or state of residence, you may have the right to request access to, correction of, or deletion of the personal information we hold about you. You may also have the right to withdraw your consent to processing.

To submit a request, visit https://idm.llc/en/contact or email privacy@idm.llc. We will verify your identity before processing the request and will respond within the timeframe required by applicable law. Where your data is controlled by your employer (or, in partner arrangements, the relevant End Client), IDM may coordinate request handling directly while copying the controller and, where practicable, the Partner.

Note regarding Photoreport data: Because reports are owned and controlled by your employer (our business client), requests for deletion of report data should also be directed to your employer's account administrator, or the relevant Partner account contact where your employer uses a partner arrangement.