Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this platform is:

2. Scope of Data Processing

Q72 is a portfolio optimisation software tool for professional wealth managers. We process the following categories of data:

• Account data: Email address, full name, professional credentials (firm name, regulatory licence number, country), and password (stored as a salted hash).
• Portfolio data: Ticker symbols, capital amounts, and risk profile selections submitted for optimisation. We do not process client names, account numbers, or personal financial data belonging to your end-clients.
• Usage data: Log data, IP addresses, browser type, pages visited, and timestamps, collected automatically for security and performance monitoring.
• Email engagement data: Where Q72 sends a recipient-specific website or booking link, we may record that the link was used, the time of the interaction, booking-page visits, selected meeting slots, and completed bookings. The tracking URL contains an opaque token rather than the recipient's email address. These events are used for CRM follow-up and conversion measurement.
• Payment data: Billing information is processed exclusively by Stripe, Inc. Q72 does not store full payment card details.

3. Legal Basis (GDPR)

• Art. 6(1)(b) GDPR — processing necessary for the performance of the contract (platform access, subscription management).
• Art. 6(1)(c) GDPR — processing necessary for compliance with a legal obligation.
• Art. 6(1)(f) GDPR — legitimate interests (platform security, fraud prevention, service improvement).
• Art. 6(1)(a) GDPR — consent, where explicitly obtained (e.g. marketing communications).

4. Third-Party Service Providers

We use the following third-party services which may process your data:

5. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), in particular in the United States. Such transfers take place on the basis of adequacy decisions by the European Commission or on the basis of appropriate safeguards (standard contractual clauses pursuant to Art. 46(2) GDPR).

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by applicable law. Account data is deleted within 30 days of account termination upon request. Certain billing and compliance records may be retained for up to 10 years in accordance with German commercial law (§ 257 HGB, § 147 AO).

7. Your Rights (GDPR Art. 15–22)

You have the following rights with respect to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time without affecting the lawfulness of prior processing

To exercise your rights, contact us at contact@q72.capital. You also have the right to lodge a complaint with the competent supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, www.baden-wuerttemberg.datenschutz.de.

8. Cookies

We use technically necessary cookies and session tokens required for the operation of the platform. We do not use tracking or advertising cookies without your prior consent. Where consent-based cookies are used, a cookie consent mechanism will be presented to you.

9. Changes to This Policy

We reserve the right to update this Privacy Policy. The current version is always available at this URL. Material changes will be communicated to registered users by email.