Privacy notice
Company details, regulatory information and actual operations still need verification. This draft requires completion and legal review before it can be used as a contract or final policy.
1. Scope of this draft
This draft covers website visits and initial business enquiries. Customer identity checks, transaction monitoring and end-user wallets require separate notices before data collection. Our compliance model stores programme transactions in the Single Control back-end. The purposes, data roles and retention periods for that processing must be documented separately. This draft still needs to be checked against actual website and contact-data processing.
2. Data controller
Single Control AB, Kungsholmstorg 5, Stockholm, Sweden, is the proposed website operator. Registration number: [To be confirmed]. Its controller role and processing arrangements remain unconfirmed. Contact hello@singlecontrol.com with questions. Any required data protection officer and contact details must be identified once the organisation and its duties are established.
3. Data that may be processed
The contact form collects your name, company, email address and answers about your programme. The server forwards this information by email through Google Workspace. Cloudflare Turnstile processes browser and network signals to check for automated submissions. We also use short-lived submission counters to limit abuse. We still need to verify provider logs and retention periods before this notice is final.
4. Purposes and legal bases
The proposed legal basis for business correspondence is legitimate interests under Article 6(1)(f) GDPR. This covers answering enquiries, assessing service fit and requested follow-up, subject to a documented balancing assessment. Article 6(1)(b) applies to pre-contract steps only when the individual is the prospective contracting party and the conditions are met. Security processing needs a documented basis. A legal-obligation basis requires a specific statutory duty.
5. Retention
Keep data only as long as its purpose requires. The proposed rule for inactive or concluded sales enquiries is deletion within 12 months of the last meaningful contact, unless a documented need justifies retention. This rule is not a verified operational policy. Contracts, security logs, legal claims and regulated services need separate retention rules.
6. Recipients and service providers
Authorised staff handling enquiries may access contact data. The website uses Netlify hosting and storage, Cloudflare Turnstile, and Google Workspace for email delivery. During setup, enquiries are routed to hello@vopy.com. Contractual safeguards, processing roles and subprocessors remain to be confirmed. A valid legal requirement may require disclosure to authorities.
7. Transfers outside the EEA
Processing locations and transfers outside the EEA still need to be mapped. Transfers require a valid mechanism, such as an adequacy decision or standard contractual clauses with any necessary additional measures. This draft does not establish that all processing stays within the EEA.
8. Your rights
Your rights depend on the processing and legal basis. They may include access, correction, deletion, restriction, portability and objection. You can withdraw consent where processing relies on it and object to direct marketing. Statutory requirements may limit some requests.
9. Requests and complaints
Send data questions or requests to hello@singlecontrol.com. Requests should normally be handled without undue delay and within one month. GDPR allows extensions in certain circumstances, and identity verification may be necessary. You can complain to an appropriate supervisory authority, including IMY in Sweden. The competent authority for the controller still needs to be confirmed.
10. Automated decisions and voluntary contact
Submitting the form sends your information to our server for security checks and email delivery. Turnstile can block submissions suspected of being automated; you can contact us by email if the check fails. These checks concern website security, rather than credit or customer acceptance. Contact is voluntary, and the form identifies the information needed to answer your enquiry.
11. Updates
Draft revised 8 September 2026. The notice must reflect changes to processing, providers, purposes and contact details. The final notice should be available where personal data is collected.
Official background information
Bank of Lithuania: EMI authorisation ↗Bank of Lithuania: prudential and safeguarding requirements ↗EDPB: transparency and individuals' rights ↗These sources provide general background. They do not verify Single Control's authorisation or operations.