Privacy Policy, Cookies Policy, and Data Processing Agreement (DPA)

In accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), personal data collected through the contracting of the service or the use of the platform will be processed by:

• Owner: Armengol Trading, S.L.
• Tax ID (NIF): ESB44941649
• Contact: [email protected]
• Address: Calle Sol, 32 - 08290 Cerdanyola del Vallès (Barcelona), Spain

Registered Users (SaaS Clients) Data: We collect name, email address, encrypted password, and billing data with the sole purpose of managing the contractual relationship, providing access to the control panel, offering technical support, and issuing the corresponding invoices. The legal basis is the performance of the B2B service contract.

End Buyers Data (Leads captured via QR): The SaaS user acts as the sole Data Controller for the email addresses or other data that their buyers enter on the capture pages. Qapta acts exclusively as a Data Processor to automatically process the delivery of rewards and store the database on behalf of the user. The legal basis is the explicit consent (opt-in) granted by the end buyer when submitting the form.

Third-Party Integrations (Klaviyo and Brevo): The platform offers optional email marketing integrations, specifically with Klaviyo and Brevo. Each SaaS user (Data Controller) has the option to connect their own account in these services. If the user activates and configures these integrations, Qapta will automatically send the end buyer's email address to the user's Klaviyo or Brevo account. Qapta performs this data transmission strictly following the configuration instructions of the Data Controller and based on the consents collected in the capture form.

For the proper operational provision of the service, Armengol Trading, S.L. uses the following data processors that comply with European data protection regulations:

• Hosting and Infrastructure: Scaleway S.A.S. (France, European Union). Servers and databases located entirely within the EU territory.
• Transactional Email Service: Scaleway Transactional Email (France, European Union). Processing and automated delivery of confirmation and reward emails.
• Payment Processing: Paddle.com Market Limited (United Kingdom) or, for purchases by US-based buyers, Paddle.com Inc., trading as Paddle. Acts as the Merchant of Record (authorized registered merchant) for payment management and billing, with appropriate safeguards for international data transfers (EU/UK Standard Contractual Clauses, as applicable).
• Web Analytics: Plausible Analytics (Estonia, European Union / Servers in Germany). Privacy-friendly, anonymous web traffic measurement.
• Bot Protection and Security: Cloudflare, Inc. (USA). We use Cloudflare Turnstile on registration and lead capture forms. To verify that the user is not a robot, the IP address and a verification token are sent to Cloudflare each time these forms are submitted.

Qapta exclusively uses technical and strictly necessary cookies to enable navigation, maintain the authenticated user's session, and ensure system security. No advertising, profiling, or cross-site tracking cookies from third parties are used. Under Article 22.2 of the LSSI-CE and the guidelines of the Spanish Data Protection Agency (AEPD), prior consent (a cookie banner) is not required for these types of essential cookies.

Regarding the end buyers' data processed through QR codes, Armengol Trading, S.L., acting as the Data Processor, formally commits to:

• Process personal data only on documented instructions from the user (Data Controller).
• Ensure that persons authorized to process the personal data have committed themselves to maximum confidentiality.
• Implement appropriate technical and organizational security measures to ensure the integrity and confidentiality of the data stored in Scaleway.
• Allow the user to export their entire database in CSV format or request the complete deletion of records at any time.

Registered users may exercise their rights of access, rectification, erasure, restriction of processing, data portability, and objection at any time by sending a written request to [email protected], attaching a copy of their identity document.