Legal
Privacy Policy
Last Updated: · Questions? support@quicksrv.io
Introduction
This Privacy Policy explains how ClearStack B.V., operating under the brand quicksrv.io ("Company", "we", "us", or "our"), collects, uses, discloses, and protects personal data in connection with our website, client portal, and Services. We take your privacy seriously and process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Dutch Implementation Act (UAVG), the ePrivacy rules as implemented in the Netherlands, and, where applicable, the UK GDPR.
This Policy applies to personal data that you provide to us, that is generated through your use of our Services, or that we receive from third parties in connection with our Services. It does not apply to personal data that you, as a Customer, process on our infrastructure in your role as Data Controller — that data is governed by our Data Processing Agreement (DPA).
Who We Are (Controller)
The controller responsible for the processing of your personal data is:
We have not appointed a statutory Data Protection Officer because the legal thresholds under Art. 37 GDPR do not apply to our activities. Privacy-related enquiries can be directed to the contact above.
Scope of this Policy
This Policy covers:
- visitors to our public website at quicksrv.io;
- prospective customers who contact us or place an order;
- account holders and authorised users of the client portal;
- recipients of operational, transactional, and (where applicable) marketing communications;
- individuals whose personal data we process for fraud prevention, security, abuse handling, or legal compliance.
Where we act as a Data Processor on behalf of a Customer (i.e. personal data the Customer stores or transmits through our infrastructure), the relationship is governed by our DPA and the Customer's own privacy notice, not this Policy.
Personal Data We Process
Depending on your interaction with us, we may process the following categories of personal data:
Account & Identification Data
Name, company name, billing and contact address, country, email address, phone number (optional), VAT/KVK or comparable business identifiers, account username, and — where required for verification or compliance — proof of identity, address, or beneficial ownership.
Authentication & Security Data
Hashed passwords, two-factor authentication secrets, API keys, SSH keys, session tokens, login timestamps and source IP addresses, and records of security events.
Billing & Transaction Data
Order history, invoices, services purchased, billing cycle, currency, payment method (card, SEPA, Klarna, cryptocurrency), partial payment-instrument identifiers (e.g. last four digits of a card, transaction hash for crypto), and tax information. We do not store full card numbers, CVCs, or Klarna credentials on our systems — these are handled directly by our payment service providers (see Section 7).
Service & Configuration Data
Hostnames, assigned IP addresses, plan and resource configuration, control-panel settings, technical contacts, and similar metadata necessary to provide and operate the Services.
Support & Communications Data
Tickets, emails, chat messages, abuse reports, attachments, and any information you choose to provide when contacting us.
Log & Operational Data
Server, network, authentication, mail, and application logs, including timestamps, IP addresses, user agents, request paths, error codes, and similar technical information generated by your use of the Services or by automated abuse/security monitoring.
Analytics Data (Website)
Aggregated, privacy-friendly usage statistics about our public website (see Section 6).
Compliance & Risk Data
Information processed for fraud prevention, anti-money-laundering, sanctions screening, abuse handling, and legal-request response, including records of decisions taken and the reasons for them.
We try to minimise the data we collect. Some data is mandatory to enter into and perform the contract with you (in particular account, billing, and identification data); without it we cannot provide the Services. Other data (e.g. phone number) is optional.
Purposes and Legal Bases
We process personal data only where we have a valid legal basis under Art. 6 GDPR. The main purposes and bases are:
Providing and operating the Services
Including account creation, provisioning, configuration, support, maintenance, and incident response. Legal basis: performance of a contract with you, or steps prior to entering into one (Art. 6(1)(b) GDPR).
Billing, payment processing, and accounting
Including invoicing, collecting payments, handling refunds, and bookkeeping. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with our legal obligations, in particular tax and accounting law (Art. 6(1)(c)).
Communication with you
Including operational notices, security alerts, service announcements, and responses to your enquiries. Legal basis: performance of a contract (Art. 6(1)(b)) and/or our legitimate interest in operating our business (Art. 6(1)(f)).
Security, fraud prevention, and abuse handling
Including authentication, rate-limiting, intrusion detection, log analysis, sanctions and fraud screening, investigation of abuse complaints, and protection of our infrastructure and third parties. Legal basis: our legitimate interest in protecting the Services, our customers, our network, and third parties (Art. 6(1)(f)), and compliance with legal obligations (Art. 6(1)(c)).
Compliance with legal obligations
Including tax retention, responding to lawful requests from authorities, and statutory data-protection obligations. Legal basis: Art. 6(1)(c) GDPR.
Website analytics
Measuring aggregated usage to improve our website. Legal basis: our legitimate interest in understanding and improving the website (Art. 6(1)(f)); see Section 6 for why no consent is required.
Establishing, exercising, or defending legal claims
Including dispute resolution, enforcement of our Terms, and defence against claims. Legal basis: our legitimate interest (Art. 6(1)(f)) and, where applicable, legal obligation (Art. 6(1)(c)).
Where we rely on legitimate interests, we have carried out a balancing test and consider that our interests are not overridden by your interests, rights, or freedoms. You can ask for more information about this balancing test using the contact details in Section 2, and you have the right to object (see Section 11).
Recipients and Sub-Processors
We do not sell personal data. We share personal data only with carefully selected recipients and only to the extent necessary for the purposes described in this Policy.
Within ClearStack B.V.
Access is restricted to authorised personnel on a need-to-know basis, subject to confidentiality obligations.
Payment service providers
Depending on the payment method you choose, personal data necessary to process the payment (such as name, billing address, email, amount, currency, and order reference) is shared with the providers below, each acting as an independent controller under its own privacy policy. We pass on only the information that is necessary to initiate, complete, reconcile, and document the transaction.
Paylinq
For payments by card and Klarna. Paylinq acts as an independent controller for payment processing, fraud prevention, and regulatory compliance under applicable financial services law.
NowPayments.io
For payments by cryptocurrency. NowPayments.io acts as an independent controller for crypto-payment processing, conversion, and related compliance.
Service infrastructure
We operate our own software stack and rely on our own and leased infrastructure located in the Netherlands and the United Kingdom. We do not transfer personal data to third-party cloud providers for the operation of our core Services.
Operational and transactional emails (e.g. invoices, payment reminders, password resets, security notices) are sent from our own self-hosted mail servers. No third-party email-delivery provider is involved in this communication.
Professional advisors
Lawyers, auditors, accountants, and tax advisors, bound by professional confidentiality, where this is necessary for legal, tax, or audit purposes.
Authorities and third parties
Where required by law, court order, or binding request from a competent authority, or where necessary to establish, exercise, or defend legal claims, prevent fraud or imminent harm, or enforce our Terms.
Business transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred to the acquiring party, subject to appropriate safeguards and, where required, prior notice to you.
A current overview of sub-processors used to process Customer Data on behalf of our Customers (as Data Processor) is maintained separately under the DPA.
International Data Transfers
We seek to keep personal data within the European Economic Area (EEA). Where personal data is transferred to a country outside the EEA — for example because a payment service provider operates infrastructure outside the EEA — such transfers take place only where:
- the European Commission has adopted an adequacy decision for the recipient country; or
- appropriate safeguards under Art. 46 GDPR are in place, in particular the EU Standard Contractual Clauses (SCCs), supplemented by additional technical and organisational measures where required; or
- another lawful transfer mechanism applies (e.g. Art. 49 GDPR derogations).
For the United Kingdom, the European Commission's adequacy decision applies, and transfers between the EEA and the UK do not require additional safeguards. For transfers originating in the UK, the UK International Data Transfer Addendum (IDTA) is used where necessary.
You may request a copy or summary of the safeguards in place for a specific transfer by contacting us using the details in Section 2.
Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, including to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.
The actual retention period depends on the type of data and the purpose of processing. The main criteria we apply are:
Contractual necessity
For as long as you maintain an account or use a Service, and for a reasonable period afterwards to allow for reactivation, reconciliation, or follow-up.
Legal obligations
In particular, invoices, accounting records, and related tax documentation are retained for the periods required by Dutch tax and accounting law.
Security and abuse handling
Log data and security records are retained for as long as necessary to detect, investigate, and respond to incidents and to defend against claims, in line with industry-standard practice.
Establishment, exercise, or defence of legal claims
Until the relevant limitation periods have expired.
Consent-based processing
Until you withdraw your consent, after which we delete the data unless another legal basis applies.
Once none of these criteria apply, we delete, anonymise, or securely archive the data. You can request more specific information about the retention period applicable to a particular category of data by contacting us using the details in Section 2.
Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, alteration, or disclosure, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as required by Art. 32 GDPR. These measures include, where appropriate:
- encryption of data in transit (e.g. TLS) and, where relevant, at rest;
- strict access controls, role-based permissions, and multi-factor authentication for administrative access;
- network segmentation, firewalls, and intrusion detection;
- logging, monitoring, and regular review of administrative activity;
- secure development, change-management, and patching practices;
- regular backups and tested recovery procedures for our own systems;
- confidentiality obligations for all personnel with access to personal data.
No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to handling personal data responsibly and to notifying you and the competent authorities of any qualifying personal data breach without undue delay, in accordance with Art. 33 and 34 GDPR.
Your Rights
Subject to the conditions and limitations set out in the GDPR, you have the following rights regarding your personal data:
Right of access (Art. 15 GDPR)
To obtain confirmation of whether we process your personal data and, if so, a copy of that data and information about the processing.
Right to rectification (Art. 16 GDPR)
To have inaccurate or incomplete personal data corrected or completed.
Right to erasure / "right to be forgotten" (Art. 17 GDPR)
To have personal data deleted where one of the legal grounds applies and no overriding obligation requires us to retain it.
Right to restriction of processing (Art. 18 GDPR)
To have processing restricted in certain circumstances.
Right to data portability (Art. 20 GDPR)
To receive personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where processing is based on consent or contract and carried out by automated means.
Right to object (Art. 21 GDPR)
To object, on grounds relating to your particular situation, to processing based on our legitimate interests, including any processing for analytics purposes.
Right to withdraw consent (Art. 7(3) GDPR)
Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.
Right not to be subject to automated decision-making (Art. 22 GDPR)
See Section 14.
Right to lodge a complaint
See Section 16.
How to Exercise Your Rights
You can exercise your rights by contacting us at support@quicksrv.io, ideally from the email address associated with your account. We may need to verify your identity before responding, in particular to prevent unauthorised disclosure. We will respond without undue delay and in any case within one month of receipt of your request; this period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month.
Where requests are manifestly unfounded or excessive — for example because they are repetitive — we may charge a reasonable fee or refuse to act on the request, as permitted by Art. 12(5) GDPR.
Children
Our Services are directed at businesses and adult consumers. We do not knowingly process personal data of children in connection with our own services as controller. Account holders must meet the age requirement set out in our Terms of Service. If you believe that we may have inadvertently collected personal data from a child, please contact us so we can take appropriate action.
Automated Decision-Making
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. Certain operational processes (such as automated fraud screening, rate-limiting, or abuse detection) involve automated tooling, but final decisions with significant impact on you (such as account closure) are reviewed by a human.
Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our Services, technology, legal requirements, or business practices. The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We will inform you of material changes by email or through the client portal in advance of the changes taking effect. The current version is always available on our website.
Contact and Complaints
For any questions, requests, or concerns regarding this Privacy Policy or our processing of your personal data, please contact:
You also have the right to lodge a complaint with a competent supervisory authority. Our lead supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Bezuidenhoutseweg 30, 2594 AV Den Haag, Netherlands — autoriteitpersoonsgegevens.nl.
If you are located in another EU/EEA Member State, you may also lodge a complaint with the supervisory authority in your country of residence, place of work, or place of the alleged infringement. UK residents may additionally contact the Information Commissioner's Office (ICO) at ico.org.uk.