Privacy Policy

Personal Data Protection · GDPR Compliance

Version 1.1 · October 2026 · Q-Technology OÜ · applies to the website qbiohacking.com and the store shop.qbiohacking.com

1. Introduction

Q-Technology OÜ, an Estonian company with its registered office at Narva mnt 5, 10117 Tallinn, Estonia, is committed to protecting the confidentiality and security of the personal data you entrust to it when using the website qbiohacking.com and the store shop.qbiohacking.com.

This Privacy Policy describes how your personal data is collected, processed, used, stored and protected, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the Estonian Personal Data Protection Act.

2. Data Controller

Q-Technology OÜ, Narva mnt 5, 10117 Tallinn, Estonia. Email: office@qbiohacking.com.

For any question about data protection or the exercise of your rights: office@qbiohacking.com.

3. Personal Data Collected

Identification data: surname, first name, title.
Contact data: postal address, delivery and billing addresses, email address, telephone number.
Transaction data: products ordered, amounts, order dates and purchase history. Your payment details are not stored by Q-Technology OÜ: they are processed directly by our payment providers (Stripe, PayPal).
Browsing data: IP address, browser type, pages visited, visit duration and, depending on your choices, data from cookies and trackers (section 9).
Customer account data: login credentials, preferences and order history, if you create an account.
Conversations: messages you send through the site’s chat window.
Professional data of Certified Testers: exclusive geographic zone, licence status (Junior, Senior or Master) and declared profession.

4. Purposes and Legal Bases

Your data is processed for the following purposes, on the legal bases of Article 6 GDPR:

Performance of the sales contract: orders, delivery, invoicing, returns and refunds, right of withdrawal, warranties.
Customer relationship: answering your requests, including through the chat window, support and complaints.
Marketing communications: newsletters and promotional messages, only with your consent, which you may withdraw at any time.
Audience measurement and advertising: only with your consent, given or refused in the banner (section 9).
Legal and tax obligations: retention of invoices and accounting records.
Legitimate interests: fraud prevention and site security.
Certified Tester network: licence monitoring, exclusive zones, commissions and network coordination, including crediting your order to the Certified Tester who tested you or whom you named at checkout (performance of the contract and legitimate interest).

5. Recipients of Data

Within the limits of the purposes above, your data may be shared with:

Hosting: Hostinger (hosting of the websites and of the Hostinger Reach sign-up forms).
Payment: Stripe, PayPal and WooPayments (WooCommerce), to secure and collect payments.
Print on demand: Printful, to produce and ship certain items.
Delivery: carriers and logistics providers.
Email: SwipeOne, for order-related emails and, with your consent, newsletters.
Chat: Zipchat, for the site’s chat window.
Audience measurement and advertising, only with your consent: Google (Google Analytics, Google Ads) and Meta (Meta pixel).
Competent authorities: upon court order or legal obligation.

Q-Technology OÜ does not sell, rent or transfer your personal data for commercial purposes.

6. International Data Transfers

Some providers (including Hostinger, Stripe, PayPal, WooPayments, Printful, Zipchat, Google and Meta) may process your data outside the European Economic Area, in particular in the United States and Canada. These transfers are covered by appropriate safeguards under the GDPR: European Commission standard contractual clauses, adequacy decisions, or certification under the EU–US Data Privacy Framework where the recipient is certified.

7. Retention Periods

Orders and invoicing: 10 years from the last transaction (accounting and tax obligations).
Customer account: for the duration of the relationship, then 3 years after the last activity.
Prospecting and newsletter: 3 years after the last active contact, or until consent is withdrawn.
Cookies and trackers: 13 months at most; your choice in the banner is kept for 6 months, after which the banner is shown again.
Certified Tester network: for the duration of the licence, then 5 years (accounting and commissions).

8. Your Rights

Under Articles 15 to 22 GDPR, you have the rights of access, rectification, erasure, restriction, portability and objection (including to direct marketing), the right to withdraw your consent at any time without affecting prior processing, and the right to set instructions regarding your data after your death.

To exercise your rights, write to office@qbiohacking.com stating your request. If we have reasonable doubts about your identity, we may ask for additional information to verify it. We reply within one month, which may be extended by two months for complex requests.

9. Cookies and Trackers

On your first visit, a banner lets you accept, refuse or customise non-essential cookies and trackers. Refusing is as easy as accepting. No audience-measurement or advertising tracker is set before you choose. You can change your choice at any time through the “Manage consent” link at the bottom of every page.

Category	Services	Purpose	Consent
Necessary	WooCommerce (cart, session, account), security, Stripe and PayPal payment, storage of your cookie choice	Running the websites, the store and payment	Not required
Preferences	Language and display	Remembering your preferences	Required
Statistics	Google Analytics	Measuring traffic and page use	Required
Marketing	Meta pixel, Google Ads, Certified Tester affiliate cookie	Measuring the effectiveness of our ads and crediting a sale to the tester who recommended it	Required
Third-party functional	Zipchat (chat), Hostinger Reach forms	Answering you and managing your sign-up	Depending on the cookies these services set, shown in the banner

Google Ads enhanced conversions: if you have accepted marketing cookies and place an order, your email address is sent to Google in encrypted (hashed) form to measure the effectiveness of our ads. Nothing is sent if you have refused.

Cookies last 13 months at most.

10. Data Security

Q-Technology OÜ implements appropriate technical and organisational measures: encryption of data in transit (SSL/TLS), access restricted by internal role, regular backups, and monitoring of the security of the Hostinger platform and providers. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we inform you as soon as possible and notify the supervisory authority in accordance with Article 33 GDPR.

11. Complaint to the Supervisory Authority

You may lodge a complaint with the supervisory authority competent for Q-Technology OÜ: Andmekaitse Inspektsioon (AKI), Tatari 39, 10134 Tallinn, Estonia · info@aki.ee · https://www.aki.ee. You may also contact the data protection authority of your country of residence, place of work or place of the alleged breach.

12. Changes

We may amend this policy to reflect legal, regulatory or technical developments. The applicable version is the one online at the time of collection. Any material change is notified to you by email or by a banner on the site.

Q-Technology OÜ · Narva mnt 5, 10117 Tallinn, Estonia · office@qbiohacking.com