1. WHO WE ARE
1.1. The controller of your personal data is QUANTETICA OÜ, a private limited company incorporated in the Republic of Estonia, registry code 17544537, registered office at Narva mnt 7, Kesklinna linnaosa, 10117 Tallinn, Harju maakond, Estonia, email: general@quantetica.com (“QUANTETICA”, “we”, “us” or “our”).
1.2. We have not appointed a data protection officer. Any questions about this Privacy Notice or our processing of personal data may be sent to the contact details above.
2. OUR ROLE AS CONTROLLER AND AS PROCESSOR
2.1. When we provide payment gateway services to our clients (merchants), we process personal data of their customers and cardholders, such as card data, transaction data, contact and device data, on behalf of and on the documented instructions of our clients. In doing so, we act as a processor, and the relevant merchant is the controller. Such processing is described in the merchant’s own privacy notice, and cardholders should direct requests about it to the merchant.
2.2. We act as an independent controller, and this Privacy Notice applies, where we process personal data for our own purposes, namely: (a) managing our relationships with clients, prospective clients and partners; (b) complying with our own legal and regulatory obligations, including sanctions, accounting and tax obligations, and carrying out due diligence and risk assessments; (c) ensuring the security and integrity of, preventing fraud and abuse of, and improving the Website, the Client Portal and our payment gateway, including by using data in aggregated or anonymised form; and (d) establishing, exercising or defending legal claims.
3. PERSONAL DATA WE COLLECT
Individuals | Personal data | Source |
Website visitors | IP address, device and browser information, pages visited, referring website, date and time of visit, cookie identifiers | Automatically, through cookies and similar technologies (see section 5) |
Representatives of prospective clients and partners | Name, job title, company, business email address and telephone number, content of enquiries and correspondence | You; your employer; public sources such as company registers and company websites |
Directors, shareholders, ultimate beneficial owners and authorised representatives of clients | Name, date of birth, nationality, residential address, copy of identity document, role and shareholding, politically exposed person status, results of sanctions and adverse media screening | The client; you; public registers; screening and verification service providers; our technology providers; acquirers and processors |
Client Portal users | Name, business email address, role, login credentials (in hashed form), multi-factor authentication data, IP address, access and activity logs | You and your employer; automatically when you use the Client Portal |
Billing contacts | Name, business email address, invoicing and payment details | The client |
Merchants’ customers and cardholders (only for the purposes in clause 2.2(b) to (d)) | Transaction and technical data, fraud and risk signals, results of sanctions screening | Our processing of transactions on behalf of our clients |
4. PURPOSES AND LEGAL BASES
4.1. We process personal data for the following purposes and on the following legal bases under Article 6(1) of the GDPR:
Purpose | Legal basis |
Responding to enquiries, communicating with prospective clients and partners, preparing proposals | Our legitimate interests in developing our business (Art. 6(1)(f)); steps prior to entering into a contract where you are the contracting party (Art. 6(1)(b)) |
Client onboarding, due diligence (KYC/KYB), risk assessment and meeting the requirements of acquirers, processors, card schemes and technology providers | Our legitimate interests in preventing fraud, financial crime and reputational risk and in meeting the requirements of our partners (Art. 6(1)(f)); compliance with legal obligations where applicable (Art. 6(1)(c)) |
Screening against sanctions lists | Compliance with EU restrictive measures and the Estonian International Sanctions Act (Art. 6(1)(c)); our legitimate interests in complying with other applicable sanctions regimes, such as those of the UK and the US, and in complying with the restrictions on high-risk jurisdictions required by our technology and payment partners (Art. 6(1)(f)) |
Performing and managing contracts, administering Client Portal accounts, providing support, sending service and legal notices | Performance of a contract where you are the contracting party (Art. 6(1)(b)); otherwise our legitimate interests in performing our contracts with our clients (Art. 6(1)(f)) |
Invoicing, accounting and tax | Compliance with legal obligations under the Estonian Accounting Act and tax laws (Art. 6(1)(c)) |
Security, integrity and fraud prevention of the Website, the Client Portal and our payment gateway, including monitoring logs and detecting abuse | Our legitimate interests in ensuring network and information security and preventing fraud (Art. 6(1)(f); Recitals 47 and 49 GDPR) |
Improving our services and producing statistics using aggregated or anonymised data | Our legitimate interests in developing and improving our services (Art. 6(1)(f)) |
Business-to-business marketing, such as product updates, newsletters and event invitations | Our legitimate interests in promoting our services to business contacts (Art. 6(1)(f)), with the right to opt out at any time; your consent where required by law (Art. 6(1)(a)) |
Website analytics and other non-essential cookies | Your consent (Art. 6(1)(a)) |
Establishing, exercising or defending legal claims and responding to requests of competent authorities | Our legitimate interests (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c)) |
4.2. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may request information about this assessment using the contact details in section 1.
4.3. Providing the information requested during onboarding and due diligence is a condition for entering into a contract with us. If it is not provided, we will be unable to provide our services.
5. COOKIES
5.1. The Website uses cookies that are strictly necessary for its operation and security. We use analytics and other non-essential cookies only with your consent, which you may give or withdraw at any time through the cookie banner or settings on the Website. Further details are set out in our [Cookie Policy].
6. WHO WE SHARE PERSONAL DATA WITH
6.1. We share personal data only to the extent necessary for the purposes described in section 4, with the following categories of recipients:
- service providers acting as our processors, such as hosting and cloud providers, IT security, email and customer relationship management providers, identity verification and sanctions screening providers, and accounting service providers, under written contracts that meet the requirements of Article 28 GDPR;
- technology and infrastructure providers engaged by us for the provision of our payment gateway services, which process personal data as our processors or, for their own compliance, risk-assessment and fraud-prevention purposes, as independent controllers;
- acquirers, processors, card schemes, banks and other payment service providers, to the extent required for the provision of our services, due diligence, fraud prevention and dispute handling;
- our professional advisers, auditors and insurers;
- courts, regulators, law enforcement and other public authorities, where required by law or necessary to establish, exercise or defend legal claims; and
- prospective buyers or successors of our business in the event of a merger, acquisition or restructuring, subject to confidentiality obligations.
7. INTERNATIONAL TRANSFERS
7.1. We process personal data primarily within the European Economic Area (EEA). Where personal data is transferred to a country outside the EEA, we ensure that the transfer is based on an adequacy decision of the European Commission (such as the decision in respect of the United Kingdom), the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, or, in exceptional cases, a derogation under Article 49 GDPR.
7.2. Where personal data subject to the UK GDPR is transferred outside the United Kingdom, we rely on UK adequacy regulations or on the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses issued by the UK Information Commissioner.
7.3. You may request a copy of the relevant safeguards using the contact details in section 1.
8. HOW LONG WE KEEP PERSONAL DATA
Personal data | Retention period |
Enquiries and data of prospective clients where no contract is concluded | 2 years after the last contact |
Due diligence (KYC/KYB) and sanctions screening data | 5 years after the end of the business relationship |
Contracts and business correspondence | For the term of the contract and 3 years thereafter, or longer where a claim is pending |
Accounting documents | 7 years from the end of the financial year to which they relate |
Security and access logs | 12 months |
Marketing preferences | Until you opt out or withdraw your consent |
Cookie data | As set out in our Cookie Policy |
8.1. At the end of the applicable period, we delete personal data or irreversibly anonymise it.
9. YOUR RIGHTS
9.1. Subject to the conditions and exceptions under the GDPR, you have the right to:
- access your personal data and receive a copy of it;
- request rectification of inaccurate or incomplete personal data;
- request erasure of your personal data;
- request restriction of processing;
- receive your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means;
- object to processing based on our legitimate interests, and object at any time to processing for direct marketing purposes; and
- withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
9.3. You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority of your place of residence, place of work or place of the alleged infringement. If you are in the United Kingdom, you may also complain to the Information Commissioner’s Office (www.ico.org.uk).
10. AUTOMATED DECISION-MAKING
10.1. We use automated tools for sanctions screening and fraud detection, which may flag potential matches or risks. Any such flag is reviewed by our staff before a decision is taken. We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.
11. SECURITY
11.1. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure, including encryption, access controls, logging and monitoring, and staff confidentiality obligations.
12. CHILDREN
12.1. The Website and our services are intended for businesses and are not directed at persons under 18 years of age. We do not knowingly collect personal data of children.
13. CHANGES TO THIS PRIVACY NOTICE
13.1. We may update this Privacy Notice from time to time. The current version is always available on the Website, with the date of the latest update indicated at the top. Where changes are material, we will take reasonable steps to inform our clients.
14. CONTACT
QUANTETICA OÜ, Narva mnt 7, Kesklinna linnaosa, 10117 Tallinn, Harju maakond, Estonia. Email: general@quantetica.com.