Privacy Policy

FOREUS Intelligence GmbH (“we”, “us”) respects your privacy. This policy explains what personal data we process when you use the Foreus FOSX mobile app (“App”) and your rights under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

FOREUS Intelligence GmbH
Schönbrunner Straße 59-61/B01
1050 Vienna, Austria
Email: office@foreusgroup.com

If we are required to appoint a Data Protection Officer, you can reach them at the address above.

2. What data we process

We process the following categories of personal data:
Account data: email address, password (hashed), first and last name, birthdate, role.
Profile data: customer type (individual / business), company name, industry, company website, company size, postal address (street, city, postal code, country), and for address autocomplete, approximate geographic coordinates.
Case data: information submitted when requesting an intelligence product, including questionnaire answers, case descriptions and scope details.
Uploaded files: PDFs, images and Office documents up to 20 MB per file.
Communications: messages exchanged with our Analyst Team, including abuse reports.
Appointments: intake and kickoff call information.
Risk score: internal customer risk assessment.
Device & technical data: push notification tokens, platform (iOS, Android or Web), app version and diagnostic logs.
Authentication metadata: login timestamps, email confirmation status and session tokens.

We do not knowingly collect data from children under 18.

3. Purposes and legal bases

Creating and managing your account – Art. 6(1)(b) GDPR (performance of contract).
Delivering requested intelligence products – Art. 6(1)(b).
Processing case files, messages and reports – Art. 6(1)(b).
Internal risk scoring – Art. 6(1)(f) (legitimate interest in preventing misuse and supporting AML/KYC compliance).
Push notifications – Art. 6(1)(a) (consent).
Security, fraud prevention and abuse reporting – Art. 6(1)(f).
Legal and tax record keeping – Art. 6(1)(c).

We do not use your data for automated decisions with legal effect or advertising profiling.

4. Who receives your data

We share data only with processors acting under GDPR Art. 28 Data Processing Agreements:
Supabase – authentication, database, storage and backend infrastructure.
Mapbox – address autocomplete.
Firebase Cloud Messaging (Google) – push notifications.
Apple and Google – app distribution and platform-level push delivery.
FOREUS Analyst Team – to perform requested services under confidentiality obligations.

Data may also be disclosed where legally required.

5. International transfers

Some processors (such as Firebase and Mapbox) may process data outside the EU/EEA. Such transfers are protected through the European Commission’s Standard Contractual Clauses or an adequacy decision.

6. Retention

Account and profile data: retained while your account is active and deleted within 90 days after account closure unless legal obligations require longer retention.
Case files, reports and chat messages: retained for the duration of the engagement plus up to 7 years in accordance with Austrian legal obligations.
Push tokens: deleted upon sign-out or when invalidated.
Diagnostic logs: retained for up to 90 days.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict processing, data portability, object to processing based on legitimate interests and withdraw consent at any time. To exercise your rights, contact office@foreusgroup.com. We respond within one month.

You also have the right to lodge a complaint with the Austrian Data Protection Authority:
Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
https://www.dsb.gv.at

8. Security

We protect personal data through TLS encryption, encryption at rest, row-level access controls, authenticated sessions, signed download URLs, restricted staff access, and validation of uploaded files by MIME type and size. While we implement appropriate safeguards, no system can guarantee absolute security. Please report suspected vulnerabilities to office@foreusgroup.com.

9. Push notifications

Push notifications are optional and can be disabled in the App under Account → Notifications or through your device settings. Disabling notifications removes your push token from our servers.

10. Changes to this policy

We may update this Privacy Policy to reflect changes in our services or applicable law. Material changes will be communicated within the App. The “Last updated” date indicates the current version.

11. Contact

FOREUS Intelligence GmbH
Schönbrunner Straße 59-61/B01
1050 Vienna, Austria
Email: office@foreusgroup.com