1. Who is responsible
The operator and data controller for iX is Media and Journalism Research Center OÜ (MJRC), registered in Estonia under registration number 16525816.
Postal address: Tartu mnt 67/1-13b, 10115 Tallinn, Estonia.
Privacy and account enquiries: contact@ixinformation.com.
MJRC decides how personal data is used to run the exchange. Information providers and buyers may be separate controllers for their own collection, disclosure and use of information. Their responsibilities and any additional privacy information should be identified in the relevant transaction. This notice does not give anyone permission to disclose or use personal data unlawfully.
2. Information we collect
- Account and professional details: your name, email address, organisation, professional role, stated purpose, correspondence, country, capacity to act, organisation registration reference where applicable, and professional references provided for identity or professional review. We record your accuracy declaration, the application reviewed, dated operator decisions, check methods, evidence references and necessary review notes.
- Operational email alerts: your confirmed email address, alert preference and limited delivery records. When enabled and a notification sender is connected, we email a generic notice about a new iX message or update. Message text, document names, transaction amounts and bank details are not included. You can turn these alerts off in My account → Account settings.
- Authentication and access records: account identifiers, email confirmation, authentication credentials handled by our authentication provider, two-factor authentication status, sessions, confidentiality acknowledgements, permissions and access decisions.
- Requests, offers and submissions: descriptions, budgets or quotes, source and permission records, review notes, supporting documents, uploaded files and messages. These may include personal data about other people.
- Transaction records: when a transaction is arranged, contact and billing details, contracts, licences, invoices, payment references, supplier payment details, commissions, delivery records, refunds and disputes. Our transaction review records identify the buyer and provider, link their account decisions, and record checks of intended use, sharing rights, agreed terms and the payment recipient. MJRC arranges buyer payments and payments to providers. Banks and payment services also process information under their own terms.
- Technical and security information: connection and device information, IP addresses where recorded by our service providers, session cookies, timestamps, errors and activity needed to operate and protect the service.
We receive information from you, representatives of your organisation, providers, buyers and service providers. Where relevant to an enquiry or verification, information may also come from professional contacts, registers, MJRC archives and other identified sources. We assess the purpose, accuracy and rights associated with material before reusing it.
Required form fields are marked. Without the information needed for an account, enquiry or access decision, we may be unable to provide that service. Optional fields, such as an initial budget, can be left blank. Please do not send identity documents or sensitive source material unless we request them through an appropriate channel.
3. Why we use personal data
We use personal data for the following purposes and legal bases under the General Data Protection Regulation (GDPR):
- Providing the service: creating accounts, responding to enquiries, assessing submissions, arranging information exchanges, delivering agreed access and handling support. Where you are a party to a contract, we rely on steps you request before entering into that contract or performance of it (Article 6(1)(b)). For representatives of organisations, we rely on our legitimate interest in communicating with and serving those organisations (Article 6(1)(f)).
- Protecting the exchange and the people involved: reviewing professional purpose, controlling confidential disclosures, preventing misuse, recording access decisions, handling complaints and establishing or defending legal claims. We rely on legitimate interests in security, trustworthy transactions and protecting confidential information (Article 6(1)(f)), subject to necessity and a balance with individuals’ rights.
- Meeting legal obligations: keeping required accounting and tax records and responding to valid legal requirements (Article 6(1)(c)).
- Activities based on consent: where a particular optional use requires consent, we ask for it separately and explain the use (Article 6(1)(a)). You can withdraw that consent. Opening an account is not consent to marketing.
The lawful basis for personal data within an information package must be assessed separately from the basis for running an account. Special-category data, such as information revealing political opinions, and data about criminal offences require additional legal conditions. A professional interest, confidentiality agreement or payment does not by itself satisfy those conditions.
5. International processing
The Supabase project used for authentication is configured in Frankfurt, Germany. This does not mean that all iX data, technical support or service-provider processing stays within the European Economic Area (EEA). Website hosting, database and file storage, email delivery and provider support use separate infrastructure and may involve processing outside the EEA, including in the United States.
International processing is subject to the applicable provider terms and data-protection requirements. Provider transfer safeguards include European Commission standard contractual clauses for relevant transfers, and adequacy decisions where applicable. The mechanism depends on the provider, recipient and service.
Further details are available in OpenAI’s Data Processing Addendum and Europe Privacy Policy, Cloudflare’s Data Processing Addendum, Supabase’s Data Processing Addendum and Hostinger’s Data Processing Addendum. These describe the safeguards for processing covered by each document. Contact us for information about the arrangements applicable to your data or a copy of relevant safeguards.
6. How long we keep information
We keep personal data only for as long as needed for its purpose, including applicable legal obligations and the resolution of claims. The criteria differ by record:
- Account and profile information: while needed to provide your account, followed by any limited retention necessary to close outstanding enquiries, transactions or legal matters.
- Enquiries and correspondence: while an enquiry is active and for a proportionate period needed for follow-up, agreed work, complaints or related claims.
- Verification material and rejected submissions: only while needed for the review, a challenge to its outcome, security or a legal requirement. We favour keeping the necessary decision record over unnecessary copies of supporting documents.
- Security and access records: for the period needed to detect and investigate misuse, protect confidential information and establish what was authorised.
- Contracts, invoices and payment records: for the retention periods required by applicable accounting and tax law and, where relevant, for the duration of contractual rights or legal claims.
- Licensed material and source records: for the agreed access or licence period and as needed to demonstrate authority, permitted use or resolve a dispute. Retention does not extend a buyer’s permission to use the material.
When deciding whether continued retention is necessary, we consider the record’s purpose, sensitivity, ongoing activity, contractual commitments, legal requirements and claim periods. You can ask us to close an account or delete information. If some records must be retained, we will explain why and limit their use accordingly. Removal from active systems may precede expiry from restricted backups or provider logs.
7. Cookies and security
iX uses necessary cookies and similar browser storage for sign-in, maintaining sessions, email confirmation and password recovery. Some support a single flow or session; others maintain sign-in until expiry or sign-out. Blocking them may prevent account features from working.
The iX application does not currently include advertising trackers or optional audience-analytics tools. Hosting and authentication providers may process technical data needed to operate and secure the service. If we introduce optional tracking that requires consent, we will explain it and request that consent before use.
We use account permissions, two-factor authentication for confidential actions, staged disclosure and access records to reduce unauthorised access. These controls cannot guarantee absolute security or prevent an authorised recipient from copying information after disclosure.
8. Your rights
Subject to the conditions in applicable law, you can:
- Ask for access to your personal data and information about how it is used.
- Ask us to correct inaccurate or incomplete information.
- Ask for erasure or restriction of processing.
- Receive data in a portable format where the right to portability applies.
- Object to processing based on legitimate interests, including any direct marketing.
- Withdraw consent where processing relies on it, without affecting the lawfulness of processing before withdrawal.
Contact contact@ixinformation.com with enough information for us to locate the relevant records. Where reasonably necessary, we may request proportionate information to verify your identity through an appropriate channel.
We respond without undue delay, normally within one month. If a lawful extension is necessary because of the complexity or number of requests, we will notify you within that first month. Some rights may be limited by legal duties, the rights of others or the need to establish or defend claims; we will explain any restriction that applies.
You may complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, or to the relevant supervisory authority where you live, work or believe an infringement occurred. You do not need our permission or have to contact us first.
9. Information about other people
If a request, offer or information package concerns you, contact us with its reference or enough detail to identify it. Tell us if you believe the information is inaccurate, excessive or unlawfully disclosed. We will assess the issue and whether access should be restricted or information corrected or removed, while taking account of the rights of others and lawful source protection.
When personal data is obtained indirectly, we assess the obligation to inform the person concerned and provide the required information within the applicable deadlines, unless a specific legal exception applies. Permission from a source does not replace that assessment. Research or journalism is not a blanket exemption from data-protection duties.
10. Other information and changes
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you through iX.
The exchange is intended for professional users aged 18 or over. It is not directed at children.
We may update this notice as the service or our processing changes. We will update its date and version and provide additional notice of material changes where appropriate. Where a new use requires consent, we will request it separately.