Surfboard Holding B.V. proved that its meta search engine which is provided under the names “Ixquick” and “Startpage” complies with EU data protection law. Users of Ixquick and Startpage can be sure that processing of their personal data which is related to their use of the meta search engine is in line with the high requirements of EU data protection law.
Function of Ixquick and Startpage as provided in June 2015
Qualification: IT-based services
30/06/2015 – 30/06/2017
Recertification 1 on March 15, 2013
Initial certification on February 09, 2011
Surfboard Holding B.V.
KVK: Utrecht, 34111280
Surfboard Holding B.V. runs a meta-search engine which allows users to search the Internet for web pages, images and videos, therefore making use of multiple third party search engines. Furthermore, the service provides users with a proxy to view the found web pages anonymously. The service is provided under two different names: Ixquick and Startpage. Both versions of the service use the same IT-systems, but a different look and feel.
The main changes since the last recertification in 2013 are listed below:
- A feature was added to search other databases (for example to retrieve information about flights, parcels or maps of locations);
- Yandex Safe Browsing API is used by the Proxy to protect users from pages that are listed as malicious;
- The Google Spain v. AEPD case (“right to be forgotten”) and the respective guidelines of the Article 29 Working Party have been implemented;
- A data export and data import agreement (Commisson Decision 35 C(2010)593) was duly signed by Surfboard Holding B.V., WebINTENSIVE Software LLC and its Indian subsidiary; WebINTENSIVE, having its registered office in New York, develops software for Ixquick/Startpage, and does monitoring and maintenance work.
The 2015 recertification confirmed that Ixquick and Startpage still meet all applicable EuroPriSe criteria. More detailed information is provided in the Short Public Report (a hyperlink to this report is provided above).
In the past, the meta-search engine was provided under three different names: Ixquick, Startpage and Startingpage. Meanwhile, Surfboard Holding cancelled offering the service under the name Startingpage. If an Internet user calls the website http(s)://www.startingpage.com, s/he is redirected to http(s)://www.startpage.com.
The difference between Ixquick and Startpage is that Ixquick makes use of the search results from a multitude of search engines whereas Startpage relies on the results from one search engine; both, without forwarding personal data.
Since certification in 2011, the service has been further improved from a data minimisation point of view: Ixquick and Startpage do not store any information on user agents and operating systems of their users any more. The privacy policies of the services have been amended in May 2012 to reflect this change.
Ixquick and Startpage are currently provided on the following URLs:
Initial Certification 02/2011
The ToE is the meta-search engine provided by Surfboard Holding B.V. via Ixquick.com, Startpage.com and Startingpage.com.
- web search functionality
- picture search functionality
- video search functionality
- proxy functionality
- caching of web site contents, images and videos
- interfaces to third parties
The ToE does not include
- phone search functionality
- third party search engines
- third party web sites
- hardware and software of users
- recommendation functionality (“Share” – Startingpage only)
Web search by means of Ixquick, Startpage and Startingpage makes use of several data minimization and encryption (hashing) techniques:
Firstly, search terms and IP addresses are not stored in log files. All other types of information (e.g., language and web browser category) do not qualify as personal data. Nevertheless, they are deleted after 14 days.
Secondly, the involved third parties (search engine providers and advertisement partner) do not receive information allowing them to identify the users of the Ixquick service. This applies to third party web site providers as well, if users employ the proxy functionality of the Ixquick service.
Thirdly, Ixquick caches images, videos and web pages for proxy requests for the purpose of technical availabilty. After a period of one hour, the cache content is automatically deleted.
Finally, Ixquick servers have been configured to handle HTTP requests over secure and encrypted Secure Socket Layer (SSL) connections and Ixquick makes use of the so-called POST method (instead of the GET method) to keep search terms out of the logs of webmasters of sites that users reach from Ixquick’s result pages.
Frank van Vliet
Certified Secure B.V.
2491 AJ The Hague
Lange Kerkdam 27
2242 BN Wassenaar
Formerly Certified Versions
Ixquick(tm) meta-search engine
Function as provided on
06/23/2008 for Initial Certification
01/27/2009 for Recertification