Protecting personal data is a priority. This Privacy Policy explains how personal data is collected, used, disclosed, and protected when individuals visit the Qartora website, use the Qartora platform, contact Qartora, or interact with Qartora services in connection with online ordering and messaging-based commerce.
1. Controller
The controller for the processing of personal data described in this Privacy Policy is Qartora GmbH, Rothenbaumchaussee 40, 20148 Hamburg, Germany, email: info@qartora.com. Public Hamburg registry sources also list the company at the same address under HRB 198139.
2. Scope
This Privacy Policy applies to personal data processed through the Qartora website, merchant onboarding, account administration, customer support, and the use of Qartora services for taking and managing orders through digital and messaging-based channels.
3. Categories of Personal Data
Depending on the nature of the interaction with Qartora, the following categories of personal data may be processed:
- Contact data, such as name, email address, phone number, postal address, and business contact information.
- Account data, such as login credentials, account settings, merchant profile information, and user identifiers.
- Billing and transaction-related data, such as billing contact details, invoices, payment-related metadata, and tax information where required.
- Communications data, such as inquiries, support requests, and other correspondence sent by email, forms, or messaging channels.
- Order-related data, such as customer name, phone number, order content, delivery information, and status information processed through the Qartora service.
- Technical usage data, such as IP address, browser type, device information, pages viewed, timestamps, referring URLs, and system log data.
- Cookie and similar technology data, as described in the Cookies section below.
4. Purposes of Processing
Personal data may be processed for the following purposes:
- To provide, operate, maintain, and improve the Qartora website and platform.
- To create and manage merchant accounts and provide onboarding, support, and account administration.
- To facilitate order handling, customer communication, and related merchant service functions.
- To monitor service performance, maintain security, prevent misuse, and troubleshoot technical issues.
- To communicate with users regarding inquiries, service updates, administrative notices, and support matters.
- To comply with legal obligations, enforce contractual rights, and protect legitimate business interests.
5. Legal Bases for Processing
Where the General Data Protection Regulation applies, Qartora processes personal data on one or more of the following legal bases:
- Consent, where a user has given consent for a specific processing activity.
- Performance of a contract, where processing is necessary to provide requested services or to take steps prior to entering into a contract.
- Compliance with legal obligations, where processing is necessary to satisfy applicable legal or regulatory requirements.
- Legitimate interests, where processing is necessary for the operation, protection, and improvement of Qartora's business and services, unless such interests are overridden by the rights and freedoms of the individual concerned.
6. Role of Qartora
Qartora may process personal data both as a controller and, in certain situations, as a processor acting on behalf of merchant customers. Qartora generally acts as controller for personal data processed in connection with its own website, merchant account administration, billing, support, compliance, and business operations. Where personal data of end-customers is processed on behalf of a merchant through the Qartora platform, the relevant merchant may be the controller for that data and Qartora may process such data on the merchant's instructions, subject to applicable contractual arrangements.
8. International Data Transfers
If personal data is transferred to recipients located outside the European Union or the European Economic Area, Qartora will take steps to ensure that such transfers are subject to appropriate safeguards as required by applicable data protection law. These safeguards may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.
9. Data Retention
Personal data is retained only for as long as necessary for the purposes described in this Privacy Policy, including the provision of services, account administration, dispute resolution, security monitoring, and compliance with legal obligations. Where longer retention is required by law, contract, or legitimate business need, the relevant data may be retained for that period and then deleted or anonymized where appropriate.
11. Data Subject Rights
Subject to applicable law, individuals may have the right to:
- Request access to personal data processed by Qartora.
- Request correction of inaccurate or incomplete personal data.
- Request deletion of personal data, subject to legal limitations.
- Request restriction of processing in certain circumstances.
- Receive personal data in a structured, commonly used, and machine-readable format, where applicable.
- Object to certain processing activities based on legitimate interests.
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
12. Right to Lodge a Complaint
Individuals also have the right to lodge a complaint with a competent data protection supervisory authority. As Qartora is based in Hamburg, the competent authority may include the Hamburg Commissioner for Data Protection and Freedom of Information.
13. Data Security
Qartora implements appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful access, alteration, disclosure, loss, or destruction. While no method of transmission or storage can be guaranteed to be completely secure, appropriate safeguards are used to reduce risk and support secure service operation.
14. Changes to this Privacy Policy
Qartora may update this Privacy Policy from time to time. The current version will be made available on the Qartora website.
15. Contact
Questions regarding this Privacy Policy or the processing of personal data may be directed to:
Qartora GmbH
Rothenbaumchaussee 40
20148 Hamburg, Germany
Email: info@qartora.com