Privacy Notice

1. In brief

InnovA is a cloud-based software SaaS (software as a solution) platform that enables companies to sell inventory through their own company-branded website. Our platform allows customers to grow and facilitate their businesses through a wide variety of software solutions. InnovA’s back-office inventory management platform enables its customers to sell inventory via retail, virtual auctions, simulcast auctions, and via 3rd party marketplaces.

InnovA’s platform allows Our Customers to:

  • Save time running their business by aggregating tools into a single platform.
  • Keep buyers on their own branded website.
  • Retain and use their own data.
  • Grow their company brand while creating multiple channels to sell inventory.

This Privacy Notice, (the “Privacy Notice” or the “Notice”) was created by InnovA LLC (“InnovA”, “We”, “Us”, “Our”) to inform website visitors, users on InnovA’s platform or customers of InnovA, collectively further referred to as “You” or “Your” on how We may collect, process and share Your Personal Data when visiting this website or using the platform of InnovA. The Notice will treat the processing activities separately hereunder (i.e. chapters 3-6). Items that are not treated in the dedicated chapters, are generally applicable to all specific scenarios listed under chapters 3-6.

This Notice will generally inform You about:

  • How do We collect your Personal Data;
  • The type of Personal Data We process;
  • The purposes for which We process your Personal Data;
  • The parties with whom We may share your Personal Data;
  • What are Your rights;
  • How is the information protected;
  • How and who to contact in case you need more information.

We process Personal Data on a worldwide basis and we are taking all reasonable measures to comply with any applicable data privacy laws, but in particular with laws in the United States and the EU General Data Protection Regulation (GDPR) and UK Data Protection Act. This is why We will also apply the stringent rules, principles and obligations of the GDPR to the processing of Personal Data of persons outside of the EEA.

Please review this notice attentively. This Privacy Notice may be revised and reissued from time to time.

2. Definitions

For the purposes of this Notice, unless the context requires otherwise, the following terms shall have the meaning as defined hereunder:

  • “CCPA” means the California Consumer Privacy Act of 2018 and the California Privacy Rights Act together with any subordinate legislation or regulations.
  • “Controller” means the natural person or legal person, public authority or agency, which alone or jointly with others, determines the means and purposes of processing Personal Data.
  • “Customer” means the organization/business with which InnovA is under a contractual relationship as a service provider.
  • “Customer Data” means the Personal Data, which is populated by our Customers on Our platform, which may include Personal Data of buyers on InnovA’s platform.
  • “Data Subject” means and identified or identifiable natural person.
  • “EU Personal Data” means Personal Data the processing of which is regulated by the General Data Protection Regulation.
  • “General Data Protection Regulation” or “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council together with any subordinate legislation or regulation implementing the General Data Protection Regulation.
  • “Personal Data” means information about an individual that (a) can be used to identify, contact or locate a specific individual; (b) can be combined with other information that can be used to identify, contact or locate a specific individual; or (c) is defined as “Personal Data” or “Personal Information” under the Applicable Law or regulations relating to the collection, use, storage or disclosure of information about an identifiable individual.
  • “Processing” and its cognates mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • “Processor” means a natural person or legal person, public authority or agency which processes Personal Data on behalf of the Controller.
  • “UK General Data Protection Regulation” or “UK GDPR” means the UK General Data Protection Regulation, which supplements and sits alongside the Data Protection Act 2018.UK GDPR mirrors the EU GDPR and is to be considered included when references are made to the GDPR.
  • “UK Personal Data” means Personal Data the processing of which is regulated by the Data Protection Act 2018.

3. Website visitors

3.1. In brief

We provide You with this page in order to inform You about InnovA’s services, make sure that the website remains secure at all times and to distinguish the unique users.

3.2. Purpose

Our purpose to process your Personal Data is to:

  • Provide the website to You. This involves processing traffic data;
  • Use Your Personal Data for ensuring the security of the page.

3.3. Personal Data

In these circumstances, We may process the following Personal Data as traffic data:

  • IP address;
  • Device / Internet Connection Information;
  • Location information.

3.4. Storage of the Personal Data

We will not store the traffic data.

In case of an incident that is identified by Our security system, the information therein will be kept for a period of seven (7), unless there is a particular legal requirement to keep this information for a longer period.

3.5. Legal basis

For the processing of the traffic data as explained under item 3.2(a) above, We will use Your consent to receive Our page.

We base ourselves on Your consent when You send Us an email (“affirmative action” when sending an email to a recipient) and, in certain cases, Our legitimate interest or legal duty to keep the related communication as evidence.

With reference to security log data, this is based on Our legitimate interests. We process the Personal Data for security reasons to maintain the use of the Website and fulfill InnovA’s legal duties to keep the website secure.

3.6. Outsourcing activities to processors

InnovA uses trustworthy processors that process Your Personal Data in relation to Your use of Our website.

Our processors process the Personal Data for the reasons mentioned under item 3.2 above.

Processors may change occasionally. The information processed by the foregoing is stored in their systems. InnovA has privacy agreements in place that safeguard Your data.

3.7. Cookies

We use cookies on our Website. More information about the cookies we use are available here.

3.8. InnovA’s role under the GDPR

InnovA processes the Personal Data as controller as defined under Article 4(7) of the GDPR.

4. Customers of InnovA

4.1. In brief

We will process information about Our customers and their employees when We are in a contractual relationship with Our Customers or in preparation for such relationship. The processing of information is performed within the B2B environment.

4.2. Purpose

Our purpose to process your Personal Data is for the following purposes:

  • Service enhancement;
  • Account management;
  • Logistics;
  • Customer support;
  • Customer relationship and marketing;
  • Contractual obligations;
  • Billing;
  • Tax purposes.

4.3. Personal Data

For this processing activity, We may process the following Personal Data in relation to Our Customers:

  • Personal information: First and Last Name;
  • Contact data: e-mail address; phone number; company name; account ID on InnovA’s platform;
  • Address: billing address; company address;
  • Accounting: bank account;
  • Buying information: legal documents relevant to the auction that the Customer organizes via Our platform.

4.4. Storage of the Personal Data

The retention period for the Personal Data pertaining to Customers of InnovA is set for three years from the date of collection. However, in certain circumstances, We will retain the personal data in a form which will enable the identification of individuals, which may include:

  • For the operational purpose that the personal data was collected for, and which the relevant individual has been informed of;
  • In order to comply with any applicable statutory or regulatory retention requirements; or
  • To enable the exercise of legal rights and/or defense against legal claims necessary for InnovA or its Customer.

Once the Personal Data related to You will no longer be necessary, We will delete it in a secure manner.

4.5. Legal basis

InnovA may process Your Personal Data in order to:

  • Enter into and continue performing the contract between our Customers and Us;
  • Legal obligations resulting from the foregoing contract(s); and
  • Our legitimate interests.

Processing based on legitimate interests is related to Our commercial interests and those of Our Customers. With respect to this legal basis, We have carefully assessed our processing activities and determined that they are compatible with Your interests and fundamental rights and freedoms as a data subject.

4.6. Outsourcing activities to processors

InnovA uses trustworthy processors that process your Personal Data in relation to the Your use of Our website.

Our processors process the Personal Data for the reasons mentioned under item 4.2 above.

Processors may change occasionally. The information processed by the foregoing is stored in their systems. InnovA has privacy agreements in place that safeguard Your data.

Generally, We may use processors for the following processing activities:

  • Cloud storage;
  • Communication with You;
  • E-mail delivery service;
  • Electronic signature;
  • Address verification;
  • Tax compliance.

4.7. InnovA’s role under GDPR

InnovA processes the Personal Data as controller as defined under Article 4(7) of the GDPR.

5. Users on InnovA’s platform

5.1. In brief

We will process information of users that will use and interact with InnovA’s platform. We will process the information to provide You with access to our tools, an enhanced experience and support, if needed. This implies that InnovA will collect, use, transmit store, share and erase your information.

This processing activity stems from the contractual relationship that InnovA has with its Customers as a service providers. Customers are responsible for the Personal Data that they introduce in InnovA’s platform from their own systems.

Under certain jurisdictions, in particular in the EEA or the UK, the legislation differentiates between the “controller” and the “processor”. When You make use of Our platform, InnovA’s Customers are responsible for Your personal data as they populate our platform from their lists.  In this case, the controller of the Personal Data pertaining to You is our Customer (business/organization) that had integrated your Personal Data on Our platform.

5.2. Purpose

Our purpose to process your Personal Data is for the following purposes:

  • To provide, update, maintain and protect Our services, website, platform and business;
  • To communicate with You on the platform by responding to requests, comments or questions or any other customer support related issue;
  • As required by applicable law, legal process or regulation;
  • To develop and provide search, learning and productivity tools and additional features;
  • To send service, technical and other administrative emails, messages, and other types of communications.
  • To inform You about changes in Our services, offerings, and important services-related notices, such as security and fraud notices);
  • To investigate and help prevent security issues and abuse.
  • Due to contractual obligation as service provider;
  • Account management;
  • Logistics in case of successful auctions;
  • Billing;
  • Tax purposes.

5.3. Personal Data

For this processing activity, We may process the following Personal Data pertaining to You:

  • Personal information: First and Last Name;
  • Contact data: e-mail address; phone number; account ID on InnovA’s platform;
  • Address: billing and delivery address; IP address
  • Accounting: bank account;
  • Buying information: legal documents relevant to the auction that the customer organizes via Our platform, outstanding balance, deposit balance, buying limit, buying power, invoices, auctions won/lost; legal documents.

5.4. Storage of the Personal Data

The retention period for the Personal Data pertaining to Users on InnovA’s platform is set by the controllers responsible for Your Personal Data. For more information, please contact the business/organization that is responsible for Your Personal Data.

You can also contact Us at: privacy@innova.com and We will transfer Your request to the appropriate controller.

5.5. Legal basis

InnovA may process Your Personal Data when necessary for:

  • The performance of a contract to which You are party or in order to take steps at Your request prior to entering into a contract;
  • Legal obligation to which InnovA is subject to; and
  • Our legitimate interests.

Processing based on legitimate interests is related to the provision of Our services when You make use of Our platform. With respect to this legal basis, We have carefully assessed our processing activities and determined that they are compatible with Your interests and fundamental rights and freedoms as a data subject.

5.6. Outsourcing activities to processors

InnovA uses trustworthy processors that process your Personal Data in relation to the Your use of Our website.

Our processors process the Personal Data for the reasons mentioned under item 5.2 above.

Processors may change occasionally. The information processed by the foregoing is stored in their systems. InnovA has privacy agreements in place that safeguard Your data.

Generally, we may use processors for the following processing activities:

  • Cloud storage;
  • Communication with You;
  • E-mail delivery service;
  • Electronic signature;
  • Address verification;
  • Payments;
  • Tax compliance.

5.7. InnovA’s role under GDPR

InnovA processes the Personal Data as a processor as defined under Article 4(8) of the GDPR.

6. Messages via our Contact page

6.1. In brief

We may receive general requests or questions via the contact tool on Our website. Should you submit such a request, the latter will go through a ticket system.

6.2. Purpose

The purpose for this processing activity is to assign the ticket to an employee of InnovA in order to reply to Your request.

6.3. Personal Data

We will process the Personal Data that You will choose to disclose to Us.

6.4. Retention period

Tickets are automatically deleted within thirty six (36) months from the last communication, unless there is a legal obligation to keep the ticket, such as accounting regulations or keeping evidence of legal requests.

6.5. Legal basis

We will process this information based on Your consent when You submit Your request.

In certain cases, We may process this information based on our legitimate interest or legal duty to keep the communication exchange as legal evidence.

6.6. Processors

InnovA uses trustworthy processors that process Your Personal Data in relation to the Your use of Our website.

Our processors process the Personal Data for the reasons mentioned under item 6.2 above.

Processors may change occasionally. The information processed by the foregoing is stored in their systems. InnovA has privacy agreements in place that safeguard Your data.

Generally, we may use processors for the following processing activities:

  • Cloud storage;
  • Communication with You;
  • E-mail delivery service.

6.7. InnovA’s Role under the GDPR

InnovA will process the Personal Data as a controller as defined under Article 4(7) of the GDPR.

7. Sharing personal data with other recipients

It is important to highlight that We will not use the Personal Data we had collected for materially different, unrelated, or incompatible purposes without providing You notice.

InnovA will not disclose personal data that it processes to any other third party than the processors used for the processing activities mentioned above under Chapters 3.6, 4.6, 5.6 and 6.6.

However, InnovA may receive requests from law enforcement agencies/institutions as required by applicable law, court order, or governmental regulations. These requests may be necessary to investigate an alleged crime, to establish, exercise or defend legal rights. However, InnovA will only fulfill such requests when allowed by the applicable law.

8.   International transfers

InnovA processes Personal Data on a global basis, in particular in the United States, European Union and the United Kingdom.

Personal Data of individuals in the EEA/UK may be transferred to Our processors, which are based / process this data outside the EEA/UK under strict compliance rules pursuant to the GDPR. We ensure that all necessary measures have been taken in order to protect the Personal Data in accordance with the applicable law.

The Personal Data will only be transferred if the recipient ensures an adequate level of protection for the rights and freedoms of the data subjects or the transfer is performed in accordance with Chapter V of the GDPR and in particular, with any of the safeguards that are provided under Article 46 of the GDPR.

9. EU /UK data subject rights

We are aware that persons across the globe, including the European Economic Area (EEA) and the United Kingdom, have certain statutory rights in relation to their Personal Data. In all cases mentioned above, individuals in the EEA or the United Kingdom have the rights mentioned hereunder. It is however important to mention that InnovA will generally apply the data subject rights pursuant to the GDPR also to individuals that are not protected by the GDPR, unless provided otherwise by the applicable law to which InnovA is subject to.

9.1. Right of access

You have the right to request confirmation as to whether or not Personal Data concerning You is processed by InnovA. You are entitled to receive the following information:

  • The purpose of the processing;
  • The categories of Personal Data concerned;
  • The recipients or categories of recipients to whom the Personal Data has been or will be disclosed, in particular, recipients in third countries (i.e. non-EEA countries) or international organizations;
  • Where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
  • The right to lodge a complaint with the relevant data protection authority;
  • Where the Personal Data wasn’t collected directly from You, any available information in relation to the source;
  • The existence of automated-decision making tools.

You can request a copy of all the Personal Data we are processing related to you in a machine-readable format at any time.

9.2. Right to rectification under the GDPR

You have the right to request rectification of any inaccurate Personal Data that is processed by InnovA.

You have the right to provide additional Personal Data that is necessary to complete any missing information.

If this request will also affect Personal Data that was further disseminated to third parties, We will make our best efforts to contact the foregoing third-parties in relation to your request.

9.3. Right to erasure

You are given the possibility to be able to completely or partially delete the Personal Data related to You that is processed by InnovA.

The GDPR right only applies if this request meets one of six specific conditions as described under Article 17 of the GDPR:

  • The Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • You withdraw Your consent on which the processing is based according to point (a) of Article 6(1) GDPR, or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing;
  • You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or You object to the processing pursuant to Article 21(2) GDPR;
  • The Personal Data has been unlawfully processed by InnovA;
  • The Personal Data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
  • The Personal Data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

9.4. Right to data portability

In some circumstances, You may be entitled to obtain Your personal data from a data controller in a format that makes it easier to reuse Your information in another context, and to transmit this data to another data controller of Your choosing without hindrance.

This is referred to as the right to data portability.

9.5. Right to object to, or limit to restrict, the use of data

You can object to the processing activities performed by Us at any time, for the following reasons:

  • You contest the accuracy of the Personal Data that is processed by InnovA, for a period enabling us to verify the accuracy of the Personal Data;
  • The processing is unlawful and You oppose the erasure of the Personal Data and request the restriction of its use instead;
  • We no longer need the Personal Data for the purposes of the processing, but it is required for the establishment, exercise or defence of legal claims;
  • You object to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of InnovA override Yours’.

In case Personal Data was disseminated in advance to processors of InnovA, We will make Our best efforts to inform the latter about Your request. However, InnovA’s third-party contracts will ensure that Your rights are also respected by Our Customers or Processors.

9.6. Information about data recipients

You are entitled to request information about the identities of recipients to whom We have disclosed or intend to disclose Your Personal Data.

9.7. Right to filing complaints

To exercise your rights described above, please submit a verifiable request to us by sending us an email at privacy@innova.com.

You have the right to file complaints with the relevant data protection authority in your country if you are in the European Union in relation to InnovA’s processing of you Personal Data.

More information about this is available at the following address: https://edpb.europa.eu/about-edpb/board/members_en. If you are not in the European Union/UK, We advise You to contact Your national data protection authority in for further guidance.

Data subjects in the UK can contact the Information Commissioner’s Officer at the following link: https://ico.org.uk/make-a-complaint/

The response we provide will also explain the reasons we cannot comply with a request, if applicable.

10. Rights of California Residents

Under the CCPA, if You are a California resident, You may have the following rights:

  • Right to access and correct your personal information;
  • Right to request disclosure of the categories of information collected about you, the categories of sources from which the information is collected, the business or commercial purpose for collecting or selling information, the categories of third parties with whom we share your information, and specific pieces of information we have collected about you;
  • Right to opt out of certain privacy practices, including any sale of information;
  • Right to request deletion of personal information collected about you; and
  • Right to no discriminatory treatment (and we will not discriminate against you, for example, by charging you a different price for exercising your rights);

Any disclosures will only be available for a 12-month period preceding the verifiable request’s receipt.

11. Children’s Privacy

InnovA takes the protection of children’s privacy very seriously. InnovA does not process Personal Data of persons under the age of 16.

If InnovA is informed about the processing of such Personal Data from a child under the relevant age without parental consent, We would take all reasonable steps to delete that data.

12. Security of Personal Data

InnovA takes the security of all data it processes very seriously as the security of the foregoing data is at the heart of InnovA’s concern. We had put in place a framework of policies, procedures, and training to cover professional secrecy, data protection, confidentiality and security. A regular audit of the appropriateness of the measures is put in place to keep the data secure.

Your information is stored in accordance with this Privacy Notice and any applicable laws in secure locations and servers in the United States as follows:

  • Strict security measures are applied to ensure the confidentiality and integrity of Your Personal Data when We process it. InnovA follows strict data security procedures and standards.
  • We use physical, technical and organizational measures to counter the risk of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Your Personal Data.
  • Only designated persons and a limited amount of our personnel have access to the information. Our personnel have been trained to observe data security in their work. Where Your Personal Data needs to be disclosed to our processors, We require them to process and safeguard the data in a manner consistent with applicable laws and this Privacy Notice.

Despite Our continuous efforts to protect Your Personal Data, You should acknowledge that:

  • Due to the fast development of the IT development sector, in particular, in the security and privacy sector of the Internet, there are limitations which are beyond Our control;
  • The security, stability of the IT systems, and privacy of the information processed cannot be guaranteed; and
  • Any such information and data may be read or interfered with a third-party, despite Our continuous efforts to avoid that.

13. Changes to this statement

We are aware that transparency and accountability for Our processing practices are an ongoing responsibility, therefore, this Privacy Notice will be kept under regular review.

Any changes to this Privacy Notice will be published on Our website. We encourage You to periodically review it in order to be informed.

14. Contact information

We are happy to answer if You have any questions about this Privacy Notice, Your rights or Our data processing practices.

For any inquiries, You can submit Your request at privacy@innova.com

Our contact details are the following:

INNOVA TECHNOLOGIES, LLC
777 Main Street, Suite 3900, Fort Worth
Postal code : TX 76102

privacy@innova.com

15. Complaints

If You do not receive timely acknowledgement of your question or complaint, or if your complaint is not satisfactorily addressed, You can also submit your complaint to PrivacyTrust, an independent third party. You can do this by accessing the following : https://www.privacytrust.com/drs/innova

As mentioned under Chapter 7.7, data subjects in the EEA can also submit their complaint directly to the relevant data protection in their country. This can be identified by accessing the following link: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Data subjects in the UK can submit a complaint before the ICO here: https://ico.org.uk/make-a-complaint/.