This Privacy Policy explains how [ENTITY NAME], registered with the Dutch Chamber of Commerce (KVK) under number [KVK NUMBER], with its registered office at [ADDRESS], the Netherlands ("we", "us", "our") collects, uses, and protects your personal data when you use the STOq Terminal platform ("Service").

We are committed to protecting your privacy in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection legislation.

---

1. Data Controller

[ENTITY NAME] is the data controller responsible for processing your personal data. For any questions regarding your data, please contact:

Email: privacy@stoqterminal.com
Address: [ADDRESS], the Netherlands

2. Data We Collect

We collect and process the following categories of personal data:

Data Category	Data Collected	Purpose	Legal Basis
Account Data	Username, email address	Account creation and authentication	Contract performance (Art. 6(1)(b) GDPR)
Authentication Data	Password (stored as cryptographic hash only)	Secure account access	Contract performance (Art. 6(1)(b) GDPR)
Portfolio Data	Portfolio positions (tickers, quantities, weights)	Providing risk analytics and portfolio analysis	Contract performance (Art. 6(1)(b) GDPR)
Analysis Cache	Cached analysis results	Performance optimization and faster loading	Legitimate interest (Art. 6(1)(f) GDPR)
Session Data	Session cookies	Maintaining authenticated sessions	Contract performance (Art. 6(1)(b) GDPR)

2.1 Data We Do Not Collect

We do not collect or store:

• Payment card numbers or banking details (handled exclusively by Stripe).
• Tracking or advertising cookies.
• Browsing history or behavioral profiling data.
• Location data beyond what is inherent in IP addresses.

3. How We Use Your Data

We process your personal data for the following purposes:

• Service delivery: To provide, maintain, and improve the risk analytics platform.
• Account management: To create and manage your user account and authenticate your sessions.
• Subscription management: To manage your subscription status and coordinate with our payment processor.
• Service communications: To send essential service-related communications such as account verification, subscription changes, and security notifications.
• Security: To protect against unauthorized access and maintain the integrity of the Service.

4. Data Processors

4.1 Stripe

We use Stripe, Inc. as our payment processor. When you subscribe to the Service, Stripe processes your payment data directly. We do not have access to your full payment card details. Stripe acts as an independent data controller for payment data. Please review Stripe's privacy policy at stripe.com/privacy.

Data shared with Stripe includes your email address and subscription details, as necessary to process payments and manage your subscription.

4.2 Hosting

The Service is hosted on infrastructure that may process your data as part of providing hosting services. All hosting providers are bound by data processing agreements in accordance with GDPR requirements.

5. Data Retention

We retain your personal data according to the following schedule:

• Active account data: Retained for the duration of your account's existence.
• Cancelled account data: Retained for 90 days after the end of your final billing period, then deleted.
• Cached analysis results: Automatically purged periodically and upon account deletion.
• Session data: Expires when the session ends or after a period of inactivity.
• Invoicing records: Retained for 7 years as required by Dutch tax law.

You may request earlier deletion of your data at any time (see Section 7).

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Passwords are stored using secure cryptographic hashing (never in plain text).
• All data in transit is encrypted using TLS/HTTPS.
• Access to personal data is restricted to authorized personnel only.
• Session-based authentication with secure cookie handling.

7. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): You may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction (Art. 18): You may request restriction of processing in certain circumstances.
• Right to data portability (Art. 20): You may request your personal data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, please contact us at privacy@stoqterminal.com. We will respond to your request within 30 days.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

10. Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Autoriteit Persoonsgegevens
https://autoriteitpersoonsgegevens.nl

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice within the Service. The "Last updated" date at the top of this policy indicates when it was last revised.

12. Contact

For any questions or requests regarding this Privacy Policy or your personal data, please contact:

[ENTITY NAME]
[ADDRESS]
KVK: [KVK NUMBER]
Email: privacy@stoqterminal.com