Privacy Statement

Last updated: 3 November 2026

1. Who we are

This privacy statement explains how ITCA Global Services B.V. (“ITCA”, “we”) processes personal data. ITCA is a software license compliance company that acts for software publishers (“our clients”) to resolve the unlicensed use of their software.

ITCA Global Services B.V.
Velperplein 23, Office 121
6811 AH Arnhem
The Netherlands
Chamber of Commerce (KvK) number 55046207
Privacy questions: privacy@itca.com

2. Whose data we process

  • Visitors of itca.com, including people who use our contact or piracy report forms.
  • People and organizations we contact about the use of our clients’ software, and people who view or accept a settlement on our settlement pages.
  • People who contact us by email, letter, WhatsApp or our voicemail line.
  • Business contacts at our clients, partners and suppliers.

3. What we process, why, and on what legal basis

3.1 Website visits

Our web host processes technical data such as IP address, browser type and the pages requested, to deliver the website and keep it secure (legitimate interest in operating a secure website). Cookies and similar technologies are described in our cookie policy. Marketing technologies, including Lead Forensics, which identifies the organizations that visit our site, run only after you give consent in the cookie banner. You can change your choice at any time.

Our forms use Google reCAPTCHA to stop spam and abuse (legitimate interest in protecting our forms). reCAPTCHA loads only on pages that contain a form.

3.2 Contact and piracy report forms

We process the details you enter, such as your name, organization, email address and message, to handle your message or report (legitimate interest; where you report on behalf of your organization, also the performance of tasks you ask us to carry out). You may report anonymously where the form allows it.

3.3 License compliance matters

When we act for a client, we process data about the use of that client’s software. This can include the name of the organization or person concerned, business contact details, and technical usage data supplied by our client, such as computer names, IP addresses, internet provider, approximate location (city level), software version and dates of use. We use this data to inform the organization or person concerned, to verify the facts, to offer and administer a settlement, and, where no settlement is reached, to support our client in protecting its rights.

Legal basis: the legitimate interests of our client and ITCA in enforcing intellectual property rights and resolving unlicensed use, and where applicable the establishment, exercise or defense of legal claims.

In our communications and on settlement pages we show computer names and IP addresses only partly, to limit the personal data we disclose.

3.4 Settlement pages and acceptance

Each settlement page can only be opened with a personal link and code. When you accept a settlement we record the details you enter (name, company, address, email address, tax number), the plan you choose, your typed signature, and the date, time, IP address and browser used. We use this to conclude and evidence the settlement agreement, to arrange the license and payment with our client, and to send you a confirmation (performance of a contract, and legitimate interest in being able to prove the agreement). Payment is made to our client directly; ITCA does not receive or process payment details.

3.5 Communications and voicemail

We keep a record of emails, letters and WhatsApp messages exchanged about a matter. Calls to our voicemail line are recorded and transcribed so that we can respond to your message in writing (legitimate interest in handling your message accurately).

3.6 Automated support

We use software tools, including AI-based tools, to help prepare and manage our communications and case files. Decisions with legal effect for you, such as the terms of a settlement, are set by our client’s policy and approved by our staff; we do not take decisions about you based solely on automated processing.

4. Who receives your data

  • Our clients, the software publishers we act for, to the extent needed for the matter that concerns you.
  • Service providers that process data for us under a data processing agreement, including our web host (WP Engine), our CRM and communication platform (HubSpot, which uses Twilio for telephony), our email and office software provider (Google Workspace), Google reCAPTCHA, and Lead Forensics (website visitor identification, only with consent).
  • Advisors and authorities, such as our lawyers and, where required by law or needed for legal proceedings, courts and authorities.

5. Transfers outside the European Economic Area

Some recipients, including our clients and service providers, are located outside the EEA, for example in the United States. Where the receiving country does not offer an adequate level of protection, we rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, where the recipient is certified. You can ask us for more information about these safeguards.

6. How long we keep data

  • Website server logs: up to 30 days.
  • Contact and report form messages: up to 2 years after the last contact.
  • License compliance matters and settlement records: for the duration of the matter and 7 years after it is closed, to meet statutory retention duties and to be able to establish or defend legal claims.
  • Voicemail recordings: up to 12 months; transcripts are kept with the matter file.
  • Cookies: as described in the cookie policy.

7. Your rights

You have the right to access, correct or delete your personal data, to restrict or object to processing, and to data portability, within the limits of the law. Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object; we will then stop unless we have compelling legitimate grounds, or need the data to establish, exercise or defend legal claims.

To exercise your rights, write to privacy@itca.com. We may ask you to verify your identity. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You can also contact the authority in the country where you live or work.

8. Security

We protect personal data with appropriate technical and organizational measures, including access controls, encrypted connections, and settlement pages that can only be opened with a personal code and are excluded from search engines.

9. Changes

We may update this statement. The date at the top shows the latest version.