United Kingdom Privacy Notice (UK GDPR)

This notice explains how Tanqory collects, uses, discloses, transfers, and protects personal data under the UK GDPR and the Data Protection Act 2018. It is written for clarity and transparency, links to our Data Processing Addendum, and covers lawful bases, consent, individual rights, cross-border transfers, security, breach notification, special category/children’s data, and subprocessors. We publish this notice (and any Reasons for Processing/Records of Processing) with clear versioning for traceability. We align this notice with Tanqory’s global privacy standards so users across regions receive equivalent protection.

Scope and roles

This notice applies to merchants, developers, end users, app/service users, and visitors in the United Kingdom, or whenever UK GDPR applies. Tanqory acts as processor when handling merchant customer data, and as controller when we provide services directly (e.g., merchant accounts, payments, support). It covers data provided directly to us, data provided by merchants, and data generated by Tanqory systems (logs/analytics), including cross-border transfers. We use clear English notices and forms; local language versions will be provided where required for accessibility and fairness. If an activity requires a UK representative under Art. 27 UK GDPR, we will appoint a Data Protection Representative and disclose name/contact in this notice and the DPA/contact page. Roles and responsibilities are set out in each contract; Records of Processing Activities (RoPA) are maintained for UK processing with named process owners.

What we collect and why

We collect only what is necessary for stated purposes:

• Account/contact data (name, email, phone, business address, role): To create accounts, provide support, billing, authentication. Basis: contract or consent.
• Transaction/payment data (orders, refunds, disputes, payment tokens via providers): To deliver services and meet financial/tax/AML obligations. Basis: contract and legal obligations.
• Technical data (IP, device/browser, event logs, cookies/pixels): To secure services, prevent fraud, and improve products. Basis: legitimate interests and consent for non-essential cookies, supported by Legitimate Interest Assessments (LIAs).
• Merchant customer data: To process orders and fulfill services on behalf of merchants. Merchant is controller; Tanqory is processor under the DPA.
• Contextual sensitive data (e.g., identity documents, biometrics, health, beliefs where relevant): Collected only with an appropriate legal basis (explicit consent, legal obligation, vital interests, substantial public interest) and subject to DPIA for high-risk activities (e.g., profiling/ADM) per ICO guidance.
• Children’s data: Collected only with a lawful basis and parental consent where required. We log purpose/source and delete or anonymize when no longer necessary.

We apply data minimization (e.g., anonymizing test data, avoiding over-collection), and we review accuracy and currency of data used for service or security decisions to reduce error risk.

Privacy by design and default

We embed UK GDPR Art. 25 principles in product and engineering processes: data minimization, purpose limitation, role-based access, short retention by default, and privacy-preserving defaults (especially for minors). New or changed features undergo security/privacy reviews, and higher-risk changes trigger DPIA/LIAs and sign-off before launch.

Transparency notices and SoRs

We provide layered, purpose-specific notices at or before collection, including categories of data, purposes, recipients, retention, transfer mechanisms, and rights. Statements of Reasons (SoRs) are maintained for high-impact processing and profiling/ADM use cases, following ICO guidance, and are available on request where required by law or contract. Where appropriate, summaries of DPIA/FRIA findings relevant to customer deployments can be shared under NDA to support customer compliance.

Lawful bases, consent, and notices

Lawful bases include contract (core services), legal obligation (tax/finance/AML), legitimate interests (security, fraud prevention, product improvement) with LIAs, consent (explicit/opt-in) for special category data, non-essential cookies, and marketing, and vital interests where applicable. We provide notices before or at collection, describing data types, purposes, recipients, retention, withdrawal rights, and consequences of refusal. Consent is granular, unbundled from non-essential services, and as easy to withdraw as to give; consent receipts are kept. Marketing and cookies comply with PECR (opt-in/soft opt-in/opt-out and consent for non-essential cookies). Our Cookie Notice (https://legal.tanqory.com/legal/platform/cookie-policy) describes cookie categories, purposes, and controls; analytics relies on consent where required. We review LIAs when purposes or technologies change to keep the balance with individual rights. Marketing by email/SMS/phone always includes clear opt-out instructions.

Where we rely on legitimate interests for fraud prevention, security monitoring, product analytics, or service improvement, we document necessity and proportionality, implement safeguards (e.g., aggregation, pseudonymization), and honour objections unless overriding compelling grounds apply. Special category processing requires explicit consent or another Art. 9(2) condition; criminal offence data relies on DPA 2018 conditions and safeguards.

Your rights

You can exercise the rights of access, rectification, erasure, restriction, objection (including direct marketing), portability, and not to be subject to solely automated decisions producing legal or similarly significant effects without human review, with the right to request human intervention and an explanation. We aim to respond within 30 days (or inform you if more time is needed for complex requests) and verify identity before acting. If we refuse, we explain why, cite any legal exemption (e.g., public security, court orders, legal obligations), and provide complaint routes to the ICO or relevant supervisory authority. We record requests and outcomes to demonstrate compliance and improve processes. Where third-party recipients are involved, we will notify them of corrections or deletions where feasible. For portability, we provide data in a structured, commonly used, machine-readable format when applicable.

Special category data, criminal offence data, and children

Special category data (health, biometric, genetic, political opinions, religion/beliefs, sex life/sexual orientation, trade union membership) is processed only with a lawful basis such as explicit consent, vital interests, legal obligation, or substantial public interest, with access controls, encryption, and audit trails. Criminal offence data, if processed, follows DPA 2018 Parts 3/4 and applicable law. Children: for under-13s, parental consent is required for consent-based services. We use proportionate age gates/age-assurance and guardian verification, disable behavioural tracking/targeted ads for children, separate age-restricted content, and offer easy parental controls to pause/delete data with audit logs. Default privacy for children is set to high (no public sharing) unless a guardian authorizes otherwise.

Cross-border transfers

For transfers outside the UK, we use approved mechanisms (UK adequacy regulations, UK IDTA, or UK Addendum with EU SCCs) or applicable derogations (explicit consent, contract necessity, vital/public interest). We disclose destinations, recipients, purposes, retention, withdrawal/objection rights, and potential impacts. Technical/organizational measures include encryption, access limits, and event logging. Transfer risk assessments and justifications are recorded; if main destinations include the US, Singapore, or the EU, we communicate this for transparency. UK/EU data-centre options are available to reduce transfers. If law or adequacy decisions change, we update contracts/measures accordingly and minimize data when relying on derogations.

Security and retention

We use encryption in transit/at rest (e.g., TLS 1.3/AES-256), RBAC/MFA, segregation of duties, 24x7 monitoring (SIEM/SOC), and regular security testing. Subprocessors are evaluated against standards (e.g., SOC 2, ISO 27001, PCI DSS). Data is retained only as needed for stated purposes and legal obligations (e.g., tax/accounting). Retention schedules are maintained at https://legal.tanqory.com/legal/data-protection/data-retention-policy; summaries for UK data are available on request. Data is deleted or anonymized when no longer needed, including from backups on scheduled cycles, with deletion logs kept. Secure SDLC and periodic access reviews are applied. Business continuity/disaster recovery (BCP/DR) plans are tested to ensure safe restoration.

Breach notification

If personal data is accessed or disclosed without authorization, we assess promptly, notify customers within 24 hours, and notify the ICO “without undue delay” and within 72 hours where required. Data subjects are notified without undue delay when there is high risk (Art. 34). Notices include the incident, data/systems affected, likely impacts, remediation, and risk-reduction guidance. Containment/mitigation begins immediately; post-incident reviews and evidence (including notification timing) are retained to demonstrate compliance. Communication channels with customers and the ICO are pre-established to minimize delay.

Automated decision-making and profiling

Where automated decision-making (ADM) or profiling is used for fraud controls, risk scoring, or personalization, we apply human oversight for decisions with legal or similarly significant effects, provide meaningful information about logic where required, and offer opt-out from direct marketing profiling. DPIAs are conducted for high-risk ADM, and thresholds are reviewed periodically to reduce bias and unintended impacts.

Where profiling/ADM produces significant effects, we describe key factors, source data categories, and safeguards in user-facing notices upon request, consistent with ICO/EDPB guidance, and offer channels for human intervention and appeal.

Anonymization and pseudonymization

Where data is anonymized for analytics or product development, it is rendered non-identifiable and re-identification is prohibited. Pseudonymous data is used internally with separated mapping tables, restricted access, and no disclosure to third parties. We rely on reduced-risk data to generate insights without undermining privacy rights and update notices if purposes change.

Subprocessors and payments

We use third-party providers (hosting, payments, analytics, security) under contracts requiring UK GDPR-level protections and PCI DSS compliance for payments. Access is limited to need-to-know, and subprocessors are periodically reviewed. For overseas providers, approved transfer mechanisms are used, and consent/notice is obtained where required. The current list of subprocessors is at https://legal.tanqory.com/legal/data-protection/subprocessor-list.

Updates and notifications

We will update this notice when UK GDPR/related laws or our services change. Material changes will be announced in advance (e.g., dashboard/email), with version/date and a summary of changes. Users who disagree may adjust settings or stop using the services. Change history is retained for reference and audit.

Contact

• Privacy: privacy@tanqory.com
• Data Protection Officer: dpo@tanqory.com
• UK channel: uk@tanqory.com
• UK Representative (if applicable): [to be published when appointed under Art. 27 UK GDPR]
• Policy site: https://legal.tanqory.com/

Change history