Privacy Policy

1. Introduction

The protection of your personal data is important to us. This Privacy Policy explains how Algogrid Software GmbH (hereinafter "we", "us", "our", or "Company") collects, uses, shares, and protects personal data when you:

• Visit our website (www.gridtraderpro.com)
• Register for and use our GridTraderPro desktop software
• Make payments through our payment provider
• Contact us via forms or email

This Privacy Policy is based on the Swiss Federal Act on Data Protection (DSG/FADP, revised 2023). For users in the EU/EEA, the General Data Protection Regulation (GDPR) applies additionally. If you are located outside Switzerland or the EU, your local data protection laws may also apply.

Please read this Privacy Policy carefully. It informs you about how we process data; it is not a consent declaration. Where we require your consent for a particular processing activity, we obtain it separately.

2. Data Controller and Contact

The data controller responsible for processing your personal data is:

If you have any questions about this Privacy Policy or our data processing practices, please contact us using the above information.

3. Collection and Processing of Personal Data

3.1 Server Log Files and Download Log

Every time you access our website, our web servers automatically record technical data in log files:

• IP address of your computer or device
• Date and time of your access
• URL of the page requested
• Browser type and version
• Operating system (Windows, macOS, Linux)
• Referrer URL (previously visited website)
• HTTP status code and amount of data transferred

Purpose: These logs are used solely for technical website administration, security monitoring and statistical evaluation.

Retention: Server logs are kept by our hosting provider under its normal rotation and deleted after 90 days at the latest. Longer retention only occurs where a specific security incident requires it.

Download log: When you download the installer we log the timestamp, IP address, user agent and the version downloaded. These raw entries feed an internal daily report and are then deleted; only an anonymous counter per version and country is kept.

Legal basis (GDPR): Legitimate interest (website security and operational management) under Art. 6(1)(f) GDPR.

Visitor analytics pixel: We use a server-side analytics pixel (tracker.php) on every page of our website. It records: IP address, page visited, browser identification (user agent) and timestamp. This data is processed daily into an internal visitor report — number of visits, countries, pages requested and a list of the individual requests including IP addresses — and then deleted. The report itself is kept internally and deleted after twelve months at the latest. Countries are determined from a copy of the DB-IP country database held on our own server. No data is transmitted to third-party providers. Processing is based on Art. 31(1) FADP (overriding legitimate interest in analysing website usage).

3.2 Customer Account

A customer account is created with your first purchase. We collect and process:

• First and last name
• Email address (access to the account and primary contact)
• Password, stored only as a hash (bcrypt) — we do not know it in clear text and cannot recover it
• Billing address: street and number, postal code, town, country
• Phone number, if provided
• Company name, if provided
• Customer number assigned by us
• Customer number at our payment provider, so that you can view invoices and cancel
• Preferred broker, if provided
• Language for our messages
• Timestamps of account creation, activation and last sign-in

We do not collect a salutation or a date of birth.

Purpose:

• Account management and login authentication
• License activation and validation
• Customer support and communication
• Fraud detection and account security
• Compliance with legal and regulatory obligations

Legal basis (GDPR): Contract performance (Art. 6(1)(b)) and legitimate interest in fraud prevention and account security (Art. 6(1)(f)).

Retention: for as long as your account exists. If you delete it, your master data is anonymised immediately (see 10.3). Invoices and payment records must be kept for ten years (Art. 958f Swiss Code of Obligations); they contain the name and billing address of the purchase concerned and are deleted only after that period.

3.3 Hardware Fingerprint and Licence Validation

To validate your licence and prevent unauthorised copying, our desktop software generates a hardware fingerprint which is:

• derived from the CPU identifier, disk serial number and MAC address of your computer
• cryptographically hashed (one-way hash; we do not store raw hardware identifiers)
• transmitted at every application start — the Software validates the licence online each time it starts
• never sold, shared or used for tracking or analytics

On each validation the licence key and hardware fingerprint are transmitted and stored server-side together with your IP address, the client identification, the validation result and a timestamp in a validation log.

Purpose: binding the licence to one device, detecting misuse, and supporting support cases.

Legal basis (GDPR): performance of a contract and legitimate interest in preventing misuse (Art. 6(1)(b) and (f)).

Retention: The licence record including the hardware fingerprint is retained for the term of the licence and thereafter within the statutory retention periods. The validation log is deleted after 12 months.

3.4 Crash Reports (Optional)

The GridTraderPro desktop application writes log files to ~/.gridtrader-pro/logs/ on your own computer. Nothing is transmitted automatically. If you contact support, you may attach these files to an email yourself. They may contain:

• Error message and stack trace
• Software version and build information
• Operating system details
• System memory and CPU information (no personal data)
• Timestamp of crash

IMPORTANT: Crash reports do NOT contain:

• Your trading data (symbols, prices, orders, account balances)
• Broker credentials or API keys
• Personal information (name, email, address)

Purpose: Diagnosing and fixing software bugs to improve application stability and user experience.

Legal basis (GDPR): Legitimate interest (Art. 6(1)(f)) and your explicit consent when submitting a report.

Retention: Crash reports are deleted after analysis (typically 6 months) unless needed for ongoing debugging.

3.5 Contact Form and Email Communication

When you contact us via the contact form on our website or send an email to info@gridtraderpro.com, we collect:

• Your name
• Your email address
• Subject line (if provided)
• Message content
• Your IP address and the time of submission (to counter form spam)

Purpose: Processing your inquiry, providing customer support, and responding to your questions.

Legal basis (GDPR): Contract performance (Art. 6(1)(b)) and legitimate interest in customer support (Art. 6(1)(f)).

Retention:

• Support tickets: Retained for 3 years after resolution for customer service records
• Marketing inquiries: Deleted after handling (typically 30 days)
• Legal matters: Retained for 10 years per Swiss legal requirements

3.6 Payment Information

GridTraderPro is a commercial product sold through a payment processor (currently Stripe). When you purchase a license, the following information is collected:

• Name and billing address
• Email address (for license delivery)
• Payment status (we store no card data at all — not even the last four digits; card details remain solely with Stripe)
• Transaction ID and amount
• Purchase date and subscription status
• Subscription renewal dates (for recurring payments)
• Discount or partner code used at checkout and the resulting partner commission. We use it to attribute your purchase to a sales partner. No personal data is passed to the partner; partners receive aggregated settlement figures only

IMPORTANT: We do NOT store or process:

• Full credit card numbers (PCI DSS compliance)
• Card security codes (CVV/CVC)
• Complete bank account details
• PayPal account passwords

All sensitive payment data is processed exclusively by Stripe according to their privacy policy and PCI DSS standards.

Purpose:

• License key generation and delivery
• Subscription management and renewal
• Invoice and receipt generation
• Fraud detection and prevention
• Refund processing

Legal basis (GDPR): Contract performance (Art. 6(1)(b)).

Retention: Payment records are retained for 10 years (required by Swiss and EU tax law).

3.7 Embedded YouTube Videos

On some pages (e.g. "Knowledge") we embed videos hosted on YouTube. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use a click-to-load preview (two-click solution): as long as you do not click the preview, no connection to Google is established. The preview image is served from our own server. No data is transferred and no cookies are set.

Only when you click the preview is the video loaded from youtube-nocookie.com. From that moment Google may process in particular:

• Your IP address
• Device and browser information (operating system, browser type, screen resolution)
• The page you are on and the time of access
• Playback information (which video, how long you watched)

If you are signed in to your Google account at the time, Google may associate this data with your account. If you do not want that, sign out of Google before clicking.

The youtube-nocookie.com mode reduces cookie usage but does not eliminate it — Google may still store or read information on your device during playback.

Purpose: product demonstrations and explainer videos, without slowing down page loading for every visitor.

Legal basis (GDPR): your consent (Art. 6(1)(a)), given by clicking the preview. Consent is voluntary — the page is fully usable without it. Storing or accessing information on your device is additionally governed by Art. 5(3) of the ePrivacy Directive as implemented in your country.

Withdrawal: you can withdraw consent at any time by leaving or reloading the page — only the local preview is shown again. Transfers that have already taken place are not affected.

Further information: Google's privacy policy: policies.google.com/privacy. We have no influence over the nature or extent of Google's data processing.

4. Cookies and Tracking Technologies

4.1 Cookies and Local Storage

This website sets no cookies. It only stores two technically necessary values in your browser's local storage:

• Language choice — remembers which language you last read the website in
• Billing period — remembers whether you viewed monthly or annual prices on the pricing page

These values never leave your browser and are not transmitted to us. You can delete them at any time via your browser's site data.

4.2 What We Do NOT Use

We explicitly do NOT use:

• Google Analytics or similar web analytics tools
• Marketing cookies from advertising networks
• Retargeting cookies or similar tracking technologies
• Session recording tools (Hotjar, Crazy Egg, etc.)
• Heatmap tracking

Your browsing behavior on our website is not tracked, profiled, or shared with advertising networks.

4.3 Consent

Because we set no cookies, and the two stored values are necessary for the website to work and never leave your browser, no consent is required for them. Should we introduce optional cookies or third-party analytics in future, we will obtain your prior consent.

Embedded videos: if you click a video (see section 3.7), Google may set cookies and similar technologies in your browser. These are not ours and are not technically necessary — they are triggered solely by your click.

5. Purpose of Data Processing

We process your personal data for the following purposes:

• Account management: Creating and maintaining your user account
• License validation: Authenticating your license and preventing fraud
• Payment processing: Billing and subscription management
• Customer support: Responding to your inquiries and providing assistance
• Software improvement: Analysing the error logs you actively send us. The software performs no usage or behavioural telemetry
• Security: Detecting and preventing fraud, abuse, and unauthorized access
• Legal compliance: Meeting tax, accounting, and other legal obligations
• Communication: Sending product updates, security notifications, and policy changes (with your opt-in for marketing communications)
• Website functionality: Ensuring the website operates correctly and securely

We do NOT:

• Sell your personal data to third parties
• Use your data for advertising or marketing without explicit consent
• Receive your trading, position, order or market data at all — it never reaches our servers. GridTraderPro runs entirely on your own computer and connects directly to your broker; we are technically not part of that connection and cannot see it
• Monitor your trading activity or performance
• Use your data to profile you or make automated decisions that affect your account

6. Legal Basis for Data Processing (GDPR)

Under the GDPR, we process personal data only on one of these legal bases:

• Art. 6(1)(a) — Consent: You have given explicit, informed consent (e.g., for marketing emails)
• Art. 6(1)(b) — Contract: Processing is necessary to perform our contract with you (account creation, license delivery, payment processing)
• Art. 6(1)(c) — Legal obligation: Processing is required by law (tax records, accounting, regulatory compliance)
• Art. 6(1)(f) — Legitimate interest: Processing is in our legitimate interest (security, fraud prevention, website optimization)

For each type of processing described in Section 3, we have indicated the applicable legal basis.

7. Data Sharing and Disclosure

7.1 Data We Share

We only share personal data with third parties in these limited circumstances:

• Payment processor (Stripe): Name, email, billing address, and payment information (necessary to process your purchase)
• Web hosting provider (Hosttech AG): Technical access to server data for website administration and security (Swiss servers, bound by Swiss confidentiality laws)
• Email delivery: Support and licence emails are sent via our hosting provider's mail server (Hosttech AG, Switzerland). We do not use an external ticketing system
• YouTube / Google Ireland Limited: IP address, device and browser data, and playback information — only if you actively click an embedded video (see section 3.7)
• Legal authorities: Only when required by valid court order, subpoena, or law enforcement request

7.2 Data Protection in Shared Relationships

We have:

• Data Processing Agreements (DPAs) with all service providers under GDPR Art. 28
• Confidentiality agreements with all third parties handling personal data
• Explicit contractual prohibitions on selling, sharing, or using data for unauthorized purposes
• Security requirements (encryption, access controls, audit logs) in all contracts

7.3 International Data Transfers

Default location: Our own licence and customer database and all server logs are held exclusively on servers in Switzerland. Our hosting provider (Hosttech AG) operates servers exclusively in Switzerland, subject to Swiss data protection law. In addition, Stripe maintains its own customer record for payment processing; the following paragraph applies to it. When you enter your email address on the login page, it is transmitted to Stripe in order to open your customer portal.

Payment processor transfers: Your payment information is processed by Stripe, which may operate data centers outside Switzerland or the EU. If such transfers occur:

• We rely on appropriate safeguards including Standard Contractual Clauses (SCCs) or adequacy decisions
• Stripe is a PCI DSS Level 1 certified payment processor, subject to stringent security requirements
• We have reviewed Stripe's security certifications (SOC 2 Type II)

YouTube transfers: if you click an embedded video, your counterparty is Google Ireland Limited (Ireland, EU). Google may pass data on to Google LLC in the USA and relies on Standard Contractual Clauses and the EU-US Data Privacy Framework for such transfers. Without a click on the preview, no transfer takes place.

Your rights: If you are in the EU and concerned about international transfers, you may request information about the specific safeguards in place by contacting info@gridtraderpro.com.

7.4 Data NOT Shared

We never share:

• Your password (encrypted; we cannot access it)
• Broker API keys or credentials (stored encrypted locally on your computer)
• Trading data or account information (stays on your local machine)
• Your email address with advertisers or marketing partners
• Any data for sale, rental, or commercial licensing

8. Data Security

8.1 Technical Security Measures

• Transport encryption: All website traffic is encrypted via TLS (HTTPS)
• Hardware fingerprint: The fingerprint is hashed on your own computer and stored only as a one-way hash
• Database protection: The licence and customer database is stored outside the public web directory and blocked from web access by server configuration
• Broker credentials: Your broker credentials and API keys are stored solely in the local configuration file on your own computer and are never transmitted to us. They are not additionally encrypted; protecting that file — operating system account permissions, disk encryption, anti-virus, physical access — is your responsibility. We recommend granting your broker access only the permissions you actually need and revoking it with your broker immediately if you suspect compromise
• Access restriction: Access to personal data is limited to management; the administration area is password-protected
• Security updates: Operating systems, databases and software are updated promptly

8.2 Organizational Security Measures

• Confidentiality: Everyone with access to personal data is bound by confidentiality obligations
• Data minimisation: We collect only the data required for licensing, billing and support
• Processing agreements: We have entered into the data processing agreements offered by our service providers (Stripe, Hosttech AG) and select providers on the basis of their documented security certifications
• Incident handling: Documented procedure for responding to security breaches (see Section 12)

8.3 Limitations

While we employ comprehensive security measures, no system is completely immune to attack. You are responsible for:

• Keeping your password confidential and changing it regularly
• Not sharing your account access with others
• Securing your computer and network (firewalls, antivirus, OS updates)
• Recognizing phishing attacks and not clicking suspicious links

9. Data Retention

We retain personal data only as long as necessary to achieve the purposes outlined in Section 5, and in compliance with legal retention obligations:

Data Type	Retention Period	Reason
Customer and licence data (name, email, billing address, phone)	Duration of account + 10 years	Swiss commercial law (Art. 958f OR)
Server logs (with IP address)	90 days at most	GDPR, Swiss privacy principles
Licence validation log (licence key, hardware hash, IP address, client identification)	12 months	Misuse detection and support
Visitor pixel and download raw data (IP address, page, user agent)	Raw data until the internal daily report, 48 hours at most; the report itself 12 months at most	Reach measurement and misuse detection
Payment records and invoices	10 years	Swiss and EU tax law
Support tickets and emails	3 years after resolution	Customer service and dispute resolution
Crash reports	6 months unless ongoing debugging needed	Software improvement
Hardware fingerprint hash	Duration of license validity + 10 years	License activation and business records
Contact form submissions	30 days after resolution (or 3 years if legal)	Customer service

After retention period expires: Data is either:

• Permanently deleted (if no legal obligation to retain)
• Anonymized (if further processing needed for statistical purposes)
• Securely disposed of (encrypted files are securely wiped using NIST-approved methods)

You can request deletion of your personal data at any time (see Section 10, Right to Erasure). We will honor deletion requests except where legal retention obligations apply.

10. Your Data Protection Rights

Under both Swiss DSG and the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, contact us at:

info@gridtraderpro.com

Please include "DATA SUBJECT REQUEST" in the email subject line and describe your request clearly. We will respond within 30 days (or 60 days under GDPR for complex requests).

10.1 Right of Access (Data Subject Access Request)

You have the right to request confirmation of whether we are processing your personal data and, if so, to receive a copy of that data in a structured format.

What we will provide: All personal data we hold about you, including account information, logs, communications, and stored files.

Exceptions: We may redact information if it would reveal other individuals' data or is subject to legal privilege.

10.2 Right to Rectification (Correction)

You have the right to request correction of inaccurate personal data.

Examples: If your email address, name, or country is incorrect, we will update it immediately.

Process: You can also update some information yourself in your account settings.

10.3 Right to Erasure ("Right to Be Forgotten")

You have the right to request deletion of your personal data in certain circumstances.

We will delete your data if:

• You withdraw consent and no other legal basis for processing exists
• You object to processing and we have no compelling reason to continue
• The data is no longer necessary for the purpose it was collected
• You request account deletion

We may NOT delete your data if:

• We have a legal obligation to retain it (tax, accounting, regulatory records)
• Deletion would prevent us from performing a contract (e.g., billing, license management)
• An investigation or legal proceeding is ongoing
• We need it to assert or defend legal claims

Account deletion process: You can delete your account yourself in your customer account, or write to us at info@gridtraderpro.com. When deleting in the account we ask for your password again, so that nobody else can trigger it.

While a subscription is running, deletion is not possible. Please cancel it in the billing portal first. We handle it this way so that nothing is charged to you after deletion — after anonymisation you would no longer have access to cancel it yourself.

After that the following happens, immediately and not after a waiting period:

1. Your master data is anonymised: name, address, phone number and company name are removed, the email address is replaced by a placeholder, the password is deleted. Signing in is no longer possible.
2. Your active license keys are deactivated. GridTraderPro can no longer be run with them.
3. You receive a confirmation by email.

What remains: invoices and payment records. Swiss law requires us to keep them for ten years (Art. 958f Swiss Code of Obligations). They contain the name and billing address of the purchase and are deleted after that period.

10.4 Right to Restrict Processing

You may request that we limit how we use your data while you dispute its accuracy, or while we determine if a legal obligation overrides your privacy rights.

Effect: We will store your data but not actively use it (except with your consent or for legal claims).

10.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly-used, machine-readable format (e.g., JSON, CSV) and to transmit it to another service if you wish to switch providers.

What we will provide: Account information, purchase history, and any other data we hold (in a standard format like JSON or CSV).

What is not portable: Data that is our intellectual property or cannot be technically transferred (e.g., aggregated analytics).

10.6 Right to Object

You may object to processing of your personal data based on our legitimate interests, including for marketing and profiling purposes.

Marketing communications: You can opt out of marketing emails by clicking "unsubscribe" at the bottom of any email, or by emailing us.

Other processing: You can object to other processing at any time. However, we may continue processing if we have a legal obligation or to assert legal claims.

10.7 Right to Withdraw Consent

If we process your data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Examples: You can withdraw consent for marketing emails, optional analytics, or optional crash reports.

10.8 Rights Related to Automated Decision-Making

We do NOT: Make decisions about your account, license, or services based solely on automated processing. All licensing decisions are made by humans.

Fraud detection: If we flag your account for potential fraud using automated systems, you have the right to request human review and to explain your situation.

11. How to Exercise Your Rights

Step 1: Send a written request to info@gridtraderpro.com with:

• "DATA SUBJECT REQUEST" in the subject line
• Description of the right you are exercising (e.g., "request for data access")
• Your full name and email address
• Any relevant details (e.g., date of request, specific account)

Step 2: We will verify your identity (to prevent unauthorized access to others' data). You may need to provide:

• A copy of your ID or passport
• Confirmation of your email address
• Answers to security questions

Step 3: We will respond within 30 days (or up to 60 days for complex requests). The response will include:

• Confirmation of your requested action
• A copy of your data (if access request)
• Confirmation of deletion or updates (if applicable)

Step 4: If we deny your request, we will explain why and inform you of your right to lodge a complaint (Section 13).

12. Data Breach Notification

12.1 Our Commitment

In the unlikely event of a data breach (unauthorized access, loss, or destruction of personal data), we are committed to transparency and timely notification in compliance with GDPR Art. 33 and Swiss DSG.

12.2 Notification Timeline

To data subjects (you): We will notify you without undue delay if the breach poses a high risk to your rights and freedoms. Notification will include:

• Nature of the breach (what happened)
• Data affected (what information was compromised)
• Likely consequences for you
• Measures we are taking to respond
• Contact information for further details

To regulators: Breaches likely to result in a high risk to you are reported to the Swiss FDPIC as soon as possible (Art. 24 FADP). Where the GDPR applies, notification to the competent EU supervisory authority is made within 72 hours where feasible.

12.3 Breach Response Measures

Upon discovery of a breach, we will:

• Immediately isolate affected systems
• Conduct a forensic investigation to determine scope and cause
• Notify relevant law enforcement if required
• Implement remediation measures to prevent recurrence
• Document all actions taken
• Provide regular updates to affected individuals

13. Right to Lodge a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the appropriate data protection authority:

13.1 Swiss Authority (if you are in Switzerland)

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern
Switzerland

Website: www.edoeb.admin.ch
Email: contact@edoeb.admin.ch

13.2 EU Authorities (if you are in the EU)

Each EU member state has its own data protection authority. You can file a complaint with the authority in your country of residence or where the alleged violation occurred.

Find your country's authority: European Commission DPA Directory

13.3 Other Countries

If you are in another country, you may have rights under your local data protection laws. We recommend contacting your local privacy authority.

14. Third-Party Links and Services

Our website may contain links to third-party websites and services (e.g., payment processors, documentation sites). This Privacy Policy applies only to our website and software.

We are not responsible for:

• Privacy practices of linked websites (each has its own privacy policy)
• Data collected by third-party services (payment processors, hosting providers)
• Content on third-party websites

We recommend: Review the privacy policy of any third-party service before providing your personal data. Some key third-party services we use:

• Stripe - Payment processing (Privacy Policy)
• Hosttech AG - Web hosting (Privacy Policy)

15. Children and Minors

GridTraderPro is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors.

If you are under 18: Please do not create an account or use our services. If a parent or guardian discovers that a minor has created an account, please contact us at info@gridtraderpro.com and we will delete the account and associated data immediately.

For EU residents: Under GDPR Art. 8, children under 16 require parental consent for data processing. In practice, we do not knowingly offer accounts to anyone under 18.

16. Changes to This Privacy Policy

We may update this Privacy Policy as our services evolve or to comply with changes in law. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to your registered email address (30 days notice for material changes)
• Requesting your explicit consent if required by law

Your continued use of our services after changes constitute acceptance of the updated policy. We recommend reviewing this policy periodically to stay informed about how we protect your data.

17. Specific Provisions for Different Regions

17.1 Switzerland (Swiss DSG)

Under the revised Swiss Data Protection Act (DSG, effective 2023):

• You have the right to request access, correction, and deletion of your data
• We are required to notify you of data breaches (DSG Art. 25)
• Swiss commercial law requires retention of accounting records for 10 years (OR Art. 958f)
• You may file complaints with the FDPIC (Swiss data protection authority)

17.2 European Union (GDPR)

If you are located in an EU member state, the GDPR provides additional protections:

• Expanded rights (Art. 12-22 GDPR): access, rectification, erasure, restriction, portability, object
• The right to object to automated decision-making (Art. 22)
• Stricter conditions for consent and legitimate interest
• The right to lodge a complaint with your national data protection authority

17.3 Other Countries

If you are in a country not covered above, you may have additional privacy rights under your local laws. We recommend consulting your country's data protection authority or a privacy lawyer for information specific to your jurisdiction.

18. Contact and Support

If you have any questions about this Privacy Policy or our data handling practices, please contact:

Response time: We normally answer general enquiries within 10 business days. Data subject requests are governed by the deadline in Section 10.

19. Definitions

Personal data: Any information relating to an identified or identifiable natural person.

Processing: Any operation performed on personal data (collection, storage, use, transmission, deletion).

Data subject: The person to whom personal data relates (you).

Data controller: The entity determining the purposes and means of processing (us, GridTraderPro).

Data processor: An entity processing data on behalf of the controller (e.g., hosting provider, payment processor).

Data breach: Unauthorized access, loss, or destruction of personal data.

Consent: Freely given, specific, informed, and unambiguous affirmation of your willingness to process data.

Legitimate interest: Our interest in processing data for a purpose that does not override your rights (e.g., security, fraud prevention).