Privacy Policy

01Who this policy covers

This Privacy Policy explains how IKAN Talent Mobility ("IKAN", "we", "us") handles personal data in connection with the iTour by IKAN service at itinerary.ikan.com (the "Service").

It applies to three groups: relocation consultants and administrators who use the consultant workspace; Global Mobility leaders and other client representatives who engage IKAN; and relocation assignees (and accompanying household members) whose programmes are built and shared through the Service.

For most assignee data, IKAN acts as a data processor on behalf of the relocation client that engaged us. For our own account, billing, and website data, IKAN acts as a data controller.

02Data we collect

We collect the following categories of personal data:

• Account data, consultant and administrator names, work email addresses, organisation, role, and sign in identifiers from our sign in provider.
• Assignee programme data, names, contact details, home and destination cities, travel and accommodation details, household members, schedules, and notes that a consultant enters or imports to build an itinerary.
• Access data, public itinerary capability links, signed calendar feeds, and signed case invitations issued when a consultant connects an assignee to i-Navigate.
• Usage and device data, log records, IP address, browser and device type, and basic interaction events used to operate, secure, and improve the Service.
• Communications, messages you send us by email or through in-product support.

03How we use data

We use personal data only for the purposes for which it was provided, including:

• Providing the Service, running relocation cases, building and exporting programmes, publishing deliberate itinerary outputs, and operating the connected i-Navigate assignee journey.
• Authentication and access control, verifying staff at sign in, enforcing case ownership and oversight server-side, and granting assignees scoped access through signed case invitations.
• Security and abuse prevention, monitoring for unauthorised access, fraud, and service misuse.
• Service communications, sending operational notices, and responding to support requests.
• Improvement and analytics, understanding aggregate usage to maintain reliability and improve features.

04Legal bases for processing

Where the GDPR or comparable laws apply, we rely on: performance of a contract (to provide the Service to our clients and their users); legitimate interests (to secure, maintain, and improve the Service, balanced against your rights); legal obligation (to meet record-keeping and compliance duties); and consent where required (for example, certain communications).

Where IKAN processes assignee data on a client’s behalf, the client is responsible for establishing the lawful basis for that processing under its own arrangements with its employees.

05How we share data

We do not sell personal data. We share it only as needed to run the Service and meet our obligations:

• With the relocation client that engaged us, in respect of its own assignees and programmes.
• With sub-processors that operate parts of the platform under contract, currently Supabase (database and file storage), Clerk (staff sign in), Vercel (hosting), Resend (email to families and staff), Google Maps Platform (maps, places and travel times for itinerary addresses), and NVIDIA and Groq (AI that reads photos, and AI help when our own AI server cannot answer). The current list is on our trust page.
• When required by law, legal process, or to protect the rights, safety, and security of IKAN, our users, or the public.
• In connection with a merger, acquisition, or asset transfer, subject to this policy continuing to apply.

06Security and where data is stored

We protect personal data with encryption in transit and at rest, server-side ownership and oversight checks on every case route, database row-level security that closes direct client access, and scoped password-less assignee access through signed case invitations.

Data is stored with Supabase and served by Vercel. On request we tell you the exact region that holds your data. We do not hold SOC 2 or ISO 27001 certification today. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

07Data retention

We retain personal data for as long as needed to provide the Service and for legitimate business and legal purposes. Signed i-Navigate invitations expire after 7 days; public itinerary links remain available until the consultant revokes them. We delete or anonymise programme and account data when it is no longer needed, or earlier on a valid request from the controlling client.

08Your rights

Subject to applicable law, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

If IKAN holds your data on behalf of a relocation client, please direct rights requests to that client; we will support them in responding. For data IKAN controls, contact us using the details below. You also have the right to complain to your local data protection authority.

09International transfers

Where personal data is transferred across borders, we rely on contractual protections with our sub-processors, consistent with applicable data protection law.

10Changes to this policy

We may update this policy from time to time. When we make material changes we will update the “last updated” date above and, where appropriate, provide additional notice. Continued use of the Service after an update constitutes acceptance of the revised policy.