1. Data Controller Information

Altruon B.V. is the data controller for the personal data described in this policy (unless otherwise stated). Our details are:

• Company: Altruon B.V. (registered in the Netherlands)
• Headquarters: Amsterdam, Netherlands
• Contact Email (for privacy inquiries): operations@altruon.io

As Altruon is established in the European Union, we do not require an EU representative under GDPR. If you have any questions about this policy or how we handle your data, please reach out to us at the email above.

2. Categories of Personal Data

We only collect and process personal data that is necessary for the purposes described in this policy. The categories of personal data we handle include:

Merchant Business Information

If you are a merchant (our customer), we collect information such as your name, business name, business email address, billing address, payment or billing details, and account credentials. This information is needed to create your account, provide our services, and communicate with you.

End-Customer Personal Data

Through our payment orchestration platform, we process certain personal data about your end-customers on your behalf. This may include identifiers like customer names, email addresses, order or invoice details, and transaction information provided via the billing platforms or payment gateways. Important: Altruon does not collect or store sensitive payment card details or bank account numbers of end-customers. We utilize tokenization and let connected payment gateways handle actual payment data, meaning that credit card or payment details are stored by the third-party payment gateway, not by Altruon. We only store non-sensitive reference tokens or IDs related to those payment details for transaction processing.

API Credentials and Webhook Data

To enable our integrations, merchants provide us with API keys, tokens, or credentials for their chosen billing platforms and payment gateways. We store these credentials securely to connect to those services. We also process webhook event data sent from billing platforms and gateways (for example, notifications of transactions, subscription events, or payment status). These events may contain personal data such as customer IDs, names, email, transaction amounts, and statuses necessary for us to orchestrate payments and update the relevant systems.

Website Visitor Data

When you visit our website (including our documentation or dashboard), we collect certain data automatically through cookies and similar tracking technologies. This includes your IP address, browser type, device information, pages viewed, and browsing behavior on our site. We also collect cookie preferences and analytics data if you have consented (see Section 9 on Cookies). This information helps us understand how our site is used, to improve user experience, and to ensure security (e.g., detecting unusual activities).

No Special Category Data

We do not intentionally collect any special categories of personal data as defined by GDPR (such as data about racial or ethnic origin, political opinions, religious beliefs, health, genetic or biometric data, or sexual orientation). Our services are business-oriented and not designed to process sensitive personal information. We also do not knowingly collect any data relating to criminal convictions or offenses.

3. Purposes and Legal Bases for Processing

We process personal data only for specific, explicit purposes and as permitted by GDPR. For each processing activity, we rely on one or more of the legal bases allowed under Article 6 GDPR. Below are the purposes for which we use personal data and the corresponding legal bases:

Account Creation and Service Provisioning

We use merchant business information to set up and maintain your account, authenticate you, provide our middleware services, and offer customer support. This is necessary for the performance of our contract with you (GDPR Article 6(1)(b)). Without this data, we cannot provide you with the Altruon services you've requested.

Payment Transaction Facilitation

As a core function of our platform, we process end-customer personal data by transmitting it between your billing platform and your chosen payment gateway to execute transactions (e.g., charging a customer's card for a subscription invoice). We do this to fulfill our service contract with the merchant and in furtherance of our legitimate interest in ensuring the payment transactions are completed smoothly (GDPR Article 6(1)(b) and Article 6(1)(f)). This includes using stored tokens/reference IDs to retrieve payment information from the gateway and sending transaction results back to the billing system. Our involvement in processing end-customer data is strictly for facilitating the transaction workflow you have initiated.

Security Monitoring and Fraud Prevention

We monitor activities on our platform (including analyzing IP addresses, device information, and transaction patterns) to detect and prevent fraudulent transactions, security breaches, or misuse of our services. This processing is based on our legitimate interests (GDPR Article 6(1)(f)) in safeguarding our platform, protecting our merchant clients and their customers, and maintaining the integrity of financial transactions.

Marketing and Communications

We may use contact information (such as your email address) to send you product updates, newsletters, event invitations, or other marketing communications. If you are an existing customer, we may send marketing based on our legitimate interest (“soft opt-in”). If you are not yet a customer, we will only send marketing with your consent (GDPR Article 6(1)(a)). You can withdraw consent or opt out at any time. We do not share your contact details with third parties for their own marketing without your explicit consent.

Compliance with Legal Obligations

We process personal data when necessary for compliance with our legal obligations (GDPR Article 6(1)(c)). This includes financial and tax regulations, regulatory compliance (KYC/AML), and legal process and rights (retaining or disclosing information as required to enforce contracts, resolve disputes, or protect our legal rights).

In any case where we rely on legitimate interests as a legal basis, we have balanced those interests against your rights and freedoms to ensure they do not override your privacy rights. If you have questions about the specific legal basis for any processing, please contact us.

4. Cross-Border Data Transfers

Altruon primarily stores and processes personal data on servers located within the European Union. We strive to keep your data within the EU/European Economic Area (EEA) to benefit from the GDPR's protections. However, in certain situations, your personal data may be transferred to or accessed from countries outside the EEA:

• Use of Third-Party Service Providers: We may use trusted third-party services that are based outside of the EEA. Your data may be stored or processed on servers in those countries.
• Standard Contractual Clauses (SCCs) and Safeguards: Whenever we transfer personal data outside the EEA to a country without adequate data protection, we ensure appropriate safeguards using the European Commission's approved Standard Contractual Clauses or other transfer mechanisms.
• Transfers to Our Merchants: If you are an end-customer whose data we process on behalf of a merchant, transfers will occur according to the merchant's instructions, in compliance with GDPR requirements.

We remain responsible for the protection of your personal data, regardless of where it is processed. Contact us for more information about our safeguards for cross-border transfers.

5. Data Retention Policies

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, and to comply with our legal and contractual obligations. Key retention periods include:

Merchant Account Data

We keep your account information for the duration of our business relationship. After termination, relevant data is retained for a limited period for reactivation or post-termination issues. Financial and invoicing records are retained for the period required by Dutch law (typically 7 years for tax and accounting records).

End-Customer Transaction Data

We usually handle end-customer data transiently. Logs of transactions may be retained for recordkeeping, dispute resolution, and fraud prevention purposes. When no longer needed, data is either deleted or anonymized.

API Credentials and Webhook Data

API credentials are retained as long as you use our service. You can update or revoke them at any time. Webhook event logs are kept for troubleshooting and audit purposes for a limited period.

Website Visitor Data

Essential cookies are generally session-based. Analytics cookies (used only with consent) are configured not to retain personal data longer than necessary. IP addresses collected for security are stored briefly and then deleted or anonymized.

When retention periods expire or upon valid deletion requests, we securely delete, destroy, or anonymize the personal data. We periodically review data we hold and erase information that is no longer needed.

6. Data Subject Rights

Under the GDPR, you have the following rights regarding personal data we hold about you:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Have inaccurate or incomplete data corrected.
• Right to Erasure: Request deletion of your personal data when there is no compelling reason to keep it.
• Right to Restrict Processing: Request that we pause processing under certain circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used format or have it transmitted to another controller.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Withdraw consent at any time where processing is consent-based.
• Right regarding Automated Decision-Making: Not be subject to solely automated decisions with significant effects without human review.

Exercising Your Rights: Contact us at operations@altruon.io with your request. We will respond within one month as required by GDPR. If you are an end-customer of one of our merchants, we recommend directing requests to the merchant first, as they are the primary data controller. We will assist in facilitating your request.

We do not charge a fee for reasonable requests. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act, with explanation.

7. Third-Party Disclosures

We do not sell your personal data to third parties. We may share personal data with:

• Payment Gateways and Billing Platforms: As part of our orchestration service, we transmit necessary data to process transactions.
• Service Providers (Processors): Including hosting providers, email tools, analytics services, and security providers who act under our instructions with appropriate Data Processing Agreements.
• Business Partners: In cases where integrations or collaborative features require data exchange based on your instructions.
• Corporate Transactions: In the event of a merger, acquisition, or sale, personal data may be transferred to the successor entity.
• Legal and Regulatory Disclosures: When required by law, legal process, or to protect rights, property, or safety.

We minimise data shared to what is strictly necessary and require confidentiality and security from all recipients. Contact us for an up-to-date list of subprocessors.

8. Security Measures

Altruon takes the security of personal data very seriously. Key measures include:

• Encryption: All data in transit is protected using HTTPS/TLS. Sensitive data at rest is encrypted. Passwords are stored in hashed form and API keys are encrypted.
• Tokenization: We do not store raw payment card details. We use tokenization through payment gateways, storing only non-sensitive reference tokens.
• Access Control: Role-based access controls, multi-factor authentication, and the principle of least privilege. All staff with access are bound by confidentiality obligations.
• Monitoring: Firewalls, intrusion detection systems, security patches, and activity logging for threat detection.
• Regular Assessments: Periodic vulnerability scanning, penetration testing, and code reviews.
• Organizational Practices: Staff training on data protection, defined incident response procedures, and restricted use of production data in testing.
• Compliance Alignment: We align with PCI DSS (by not storing card data and using compliant gateways) and strive to follow ISO/IEC 27001 principles.

No method of transmission or storage is 100% secure, but we continuously update and improve our practices. In the event of a data breach posing high risk, we will notify affected parties and authorities as required by GDPR.

9. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and platform. Upon your first visit, we request consent for non-essential cookies via a cookie banner.

• Essential Cookies: Necessary for website functionality (e.g., session, login). Do not require consent.
• Analytics Cookies: Collect usage data to improve performance and experience. Only deployed with consent. Data is aggregated and not intended to identify you directly.
• Marketing Cookies: Used occasionally for campaign tracking. Only deployed with consent.
• Functionality Cookies: Enable enhanced features like live chat. Consent may be required for optional features.

You can adjust your preferences at any time through our Cookie Settings or your browser settings. Rejecting cookies may impact your experience. Our website does not respond to “Do Not Track” signals, but we honor your selections in our cookie consent tool.

10. Children's Privacy

Our services are not directed to children and we do not knowingly collect personal data from individuals under the age of 16. Altruon is a B2B platform intended for use by companies and adult representatives. If we discover we have collected data from a child under 16, we will take immediate steps to delete that information and block the account. Parents or guardians should contact us if they believe their child has provided personal data without consent.

11. Automated Decision-Making

Altruon does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. We do employ automated processes for security and fraud detection:

Fraud and Risk Monitoring

We use automated algorithms to identify potentially fraudulent or suspicious activities (e.g., high-risk IP ranges, multiple failed payment attempts, known fraud patterns).

Outcome of Automated Flags

Flagged transactions may be temporarily prevented, trigger manual review alerts, or in clear cases automatically declined. We include human oversight either before or immediately after such events. Significant actions (like account suspension) always involve human review.

No Automated Profiling for Marketing

We do not engage in profiling that results in automated decisions affecting access to services, pricing, or legal rights. Any profiling is aggregated and business-focused.

If you believe you have been subject to a decision based solely on automated processing, you have the right to request human intervention, express your point of view, and contest the decision. Contact us and we will ensure proper human review.

12. Policy Updates

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last Updated” date. For material changes, we will notify merchant customers via email or in-app notification, and post a prominent notice on our website.

We encourage you to review this policy periodically. Continued use of our services after an update signifies acceptance of the updated terms (to the extent permitted by law). For changes requiring consent, we will obtain it. We maintain an archive of previous versions available upon request. We will not reduce your rights without your consent.

13. Complaint Procedures

If you have questions, concerns, or complaints about our data practices:

Contact Altruon First

Email us at operations@altruon.io. We will acknowledge and investigate your inquiry and aim to respond within one month.

Supervisory Authority

If you are not satisfied with our response, you have the right to lodge a complaint with a data protection supervisory authority. Altruon's lead authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority):

• Website: autoriteitpersoonsgegevens.nl
• Address: PO Box 93374, 2509 AJ DEN HAAG, Netherlands
• Telephone: +31 (0)70-8888-500

If you reside in another EU/EEA country, you may contact your local Data Protection Authority. A list is available on the European Data Protection Board's website.