Privacy Policy

This policy explains how Dema IQ handles personal information on its public website and in its screening service. It covers prospective clients, authorised users, people whose identity information is submitted for screening and people represented in the source records used by the service.

A client organisation decides why and when it submits screening information. Dema IQ processes that information to provide the service. The applicable client agreement may describe the parties' privacy responsibilities in more detail.

Depending on how you interact with Dema IQ, this may include:

• Demo enquiries: name, work email, organisation, and any optional phone number or message you provide.
• Account information: name, work email, organisation, role, account status and invitation history.
• Authentication and security information: one-time code records, session identifiers, IP address, browser or device information, request timing and security events.
• Screening information: submitted name, optional date of birth, selected lists, results, possible candidates, explanations, certificates and the client's recorded decisions, reasons and notes.
• Operational records: timestamps, dataset and rule versions, user attribution, audit history, uploaded document metadata and support communications.
• Register and sanctions information: names, roles, dates and other details obtained from official records, official lists and supporting public sources.

Dema IQ uses personal information where needed to:

• respond to a demo enquiry or administer a client relationship;
• invite, authenticate and support authorised users;
• run requested screening, explain a result and issue or verify a certificate;
• preserve evidence, attribution and an audit trail for compliance work;
• secure the service, enforce access boundaries, prevent abuse and investigate incidents; and
• comply with applicable law, legal process or a lawful hold.

Dema IQ does not sell personal information or use screening information for advertising.

Information comes from you, your organisation and its authorised users; from operation and security of the service; and from official records, official sanctions data and other public sources reviewed for the Dema IQ register. Source material is kept separate from client screening submissions and is accessible only to authorised Dema IQ staff.

Personal information may be made available to:

• authorised users of the client organisation that submitted the screening, according to their role;
• authorised Dema IQ administrators or reviewers who need it to operate, secure, support or maintain the service;
• infrastructure, database, private storage and email providers that process information for Dema IQ under service arrangements; and
• a regulator, court, law-enforcement body or other person where disclosure is required or permitted by law.

Client screening records are tenant-separated. Dema IQ does not give one client organisation access to another client's submissions, results or certificates.

Some technology providers may process or store information outside Namibia. Where that occurs, Dema IQ uses contractual, access-control and security measures appropriate to the service and the information involved. A client agreement may record additional hosting or transfer requirements agreed with that organisation.

Dema IQ assigns retention periods by record type. The current schedule assigns five calendar years to screening reports, screening evidence, audit events, client relationship records and source snapshots; 30 days to abandoned screening input; 365 days to authentication security logs; and up to 35 days for backups after primary deletion.

A legal hold, applicable law or a client agreement may require a longer period. Deletion is handled through a controlled administrative process, and records are not removed where doing so would break an active hold or the integrity of related audit evidence.

Dema IQ uses invitation-only accounts, one-time-code authentication, role and organisation access controls, private file storage, short-lived file access, audit records and server-only credentials. Access to source documents is restricted more tightly than access to ordinary screening results.

No online service can promise absolute security. Users must protect their sign-in access and tell their organisation administrator if they suspect misuse.

Dema IQ uses essential cookies and similar storage needed to maintain a secure signed-in session and protect authentication flows. Blocking those cookies may prevent the private service from working.

Dema IQ does not currently use advertising cookies or third-party behavioural tracking on the public website.

You may ask for access to or correction of personal information about you, object to or question its use, or ask whether it can be deleted. Some requests may be limited by another person's rights, legal duties, a legal hold or the need to preserve an auditable compliance record.

If information was submitted by your employer or another client organisation, contact that organisation first. Its administrator can correct account details and raise a screening-data request with Dema IQ through the client's established service contact.

Dema IQ is a business compliance service and is not directed to children. Do not create an account for a child or submit a child's information unless your organisation has a lawful compliance reason and authority to do so.

Dema IQ may update this policy when the service, providers or applicable requirements change. The date above identifies the latest version. Material changes affecting client use will be communicated through the organisation's established contact where reasonably practicable.

Client users should send privacy or security questions through the contact named in their organisation's service agreement. If you are not yet a client, contact Dema IQ through the demo request form. The terms governing the service are in the Terms & Conditions.