Privacy Policy

1. Data controller

BCrypto (company in formation), founder Pavel Ivanov, operational office Torino, Italia. Privacy contact: privacy@q-audion.com.

Note: the company is being formally incorporated. Once registration with the Italian Companies Register is complete, VAT, REA number and registered office will be published on this page and in the Legal Notice.

A Data Protection Officer has not been designated, as current data processing activities do not meet the criteria of Art. 37 GDPR. The privacy contact above handles all data protection inquiries.

2. Data we collect

• Contact data voluntarily provided via forms: name, email, organisation, message, request subject.
• Newsletter subscription: email and subscription/confirmation timestamp (double opt-in).
• Anonymous browsing data (only with analytics consent): anonymized IP, browser, pages visited, time on page, referrer.
• Strictly necessary cookies: session, language preference, cookie-consent choice.

3. Purposes and legal bases

Purpose	Legal basis	Retention
Respond to contact requests, deliver requested documents	Art. 6(1)(b) GDPR — pre-contractual measures	24 months from request
Newsletter	Art. 6(1)(a) GDPR — consent (double opt-in)	Until unsubscribe + 30 days
Aggregate stats (Google Analytics 4, Vercel Speed Insights)	Art. 6(1)(a) GDPR — consent	14 months (GA4 limit)
Security, abuse prevention	Art. 6(1)(f) GDPR — legitimate interest	90-day logs

4. Third-party processors

Data may be processed by the following processors, each under a GDPR-compliant DPA:

• Vercel Inc. (hosting + edge) — California, USA. Standard Contractual Clauses 2021/914.
• Google Ireland Limited (Analytics 4) — Ireland, EU. IP anonymization enabled. Google Privacy.
• Resend Inc. (optional, newsletter audience) — Delaware, USA. SCCs 2021/914. Only consented subscriber emails.
• SMTP provider (transactional email delivery): EU servers.
• MySQL database: European hosting provider, data encrypted at rest.

5. Transfers outside the EU

Transfers to third countries (USA for Vercel/Resend) rely on Standard Contractual Clauses approved by EU Commission Decision 2021/914 and, where applicable, the EU-US Data Privacy Framework.

6. Your rights (GDPR Arts. 15–22)

• right of access;
• right to rectification;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to data portability;
• right to object;
• right to withdraw consent at any time (does not affect lawfulness of processing before withdrawal).

To exercise these rights, email privacy@q-audion.com. We respond within 30 days (Art. 12 GDPR).

You may also lodge a complaint with the Italian Data Protection Authority (Garante).

7. Cookies and analytics

See Cookie Policy for details. Consent can be withdrawn at any time via the "Cookie preferences" link in the footer.

8. Security

We apply appropriate technical and organisational measures (Art. 32 GDPR): TLS 1.3 in transit, password hashing where applicable, least-privilege DB access, access logs, encrypted backups.

9. Changes

This notice may be updated. Material changes will be notified via banner and, for newsletter subscribers, by email. The "consent version" is bumped when changes require renewed consent.