⚠ DRAFT v0.1 — NOT IN FORCE, REVIEW REQUIRED. First draft of 2026-10-09, prepared against GDPR Articles 13–14 and the platform's data-processing inventory. It is not yet approved by Paysera and binds no one; review by a lawyer is required. Items in square brackets [●] are facts not yet confirmed; [verify] marks legal references not yet checked. Do not rely on this text before a version without the "draft" mark is published.
PAYSERA Q-GO PRIVACY POLICY
This English version is a translation; in case of discrepancy the Lithuanian version prevails.
Information on the processing of personal data (Articles 13 and 14 GDPR)
| Version | 0.1-draft (draft, not in force) |
| Published | [● – date of publication of the first version in force] |
| In force from | [● – date] |
| Controller | Paysera LT, UAB, legal entity code 300060819, VAT payer code LT100001261114, registered office Pilaitės pr. 16, LT-04352 Vilnius, Lithuania; data are collected and stored in the Register of Legal Entities of the Republic of Lithuania |
| Data Protection Officer | dpo@paysera.com |
| Questions about Paysera Q-GO | qms@paysera.com |
| Languages | The original text is in Lithuanian; in case of discrepancy the Lithuanian text prevails. In other languages (except Lithuanian and English) the page shows the English text. |
IN SHORT
- Who processes the data: Paysera LT, UAB (Vilnius) – the controller for the Paysera Q-GO website and platform; Data Protection Officer – dpo@paysera.com.
- What we collect: only what is needed for the website to work and stay secure, to register an organisation, to conclude and perform the contract, and to handle bug reports and enquiries. We use no analytics, advertising or profiling, and we do not sell data.
- Where we store it: platform data are stored in the European Union (Google Cloud: Belgium; backups in an EU multi-region location); for the location of request logs and of the e-mail, error-monitoring and task-tracking systems see sections 6 and 7.
- For how long: website request logs – 30 days from the request; registration data – while the account is active and for 12 months after it is archived; Document acceptance records – 10 years from the archiving of the account; accounting documents – 10 years from issue.
- Your rights: you can access your data, rectify or erase them, restrict their processing, object to processing or have them ported – write to dpo@paysera.com. You can lodge a complaint with the State Data Protection Inspectorate.
- Data of organisations' visitors and staff: ticket, pre-booking and staff account data are controlled by the organisation itself that uses Paysera Q-GO – contact that organisation about them (section 2).
CONTENTS
- 1. About this policy
- 2. When Paysera is not the controller
- 3. What data we process, why and for how long
- 4. Whether you must provide data
- 5. Where we obtain data from
- 6. Who we share data with
- 7. Transfers of data outside the EEA
- 8. Automated decisions
- 9. Your rights
- 10. How we protect data
- 11. Children
- 12. Cookies and browser-stored entries
- 13. Changes to the policy
- 14. Contacts
- Version history
1. ABOUT THIS POLICY
1.1. This policy explains how Paysera LT, UAB (hereinafter – Paysera, we) processes your personal data when you use the Paysera Q-GO website and platform. We process them in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter – GDPR) and the legal acts of the Republic of Lithuania.
1.2. Paysera Q-GO is a queue management service provided to organisations (businesses, institutions), not to individual consumers. We therefore process most data in a business-relationship context – as data of organisations' representatives; the GDPR applies to them in full.
1.3. This policy applies where Paysera itself decides for what purposes and how data are processed, that is, where it acts as a controller. It is intended for you if you are:
- a visitor to the Paysera Q-GO website, demo version or documentation;
- a person registering an organisation on Paysera Q-GO;
- a representative of a client organisation – an administrator, contact person or invoice recipient whose data we process when concluding and performing the contract with the organisation, including Document acceptance records;
- a person sending bug or feedback reports from public pages (the home, signup, sign-in, invitation, account status, legal document or error pages) or from pages organisations provide to their visitors (for example, ticket or visit booking pages);
- a person contacting us by e-mail.
1.4. Capitalised terms not defined here have the meaning given in the Paysera Q-GO Terms of Service (hereinafter – the Terms) and the Data Processing Agreement (hereinafter – DPA).
2. WHEN PAYSERA IS NOT THE CONTROLLER
2.1. Most data on the platform are processed by our clients – organisations that use Paysera Q-GO to manage queues of their visitors. The organisation is the controller of these data, and Paysera processes them only on the organisation's instructions as a processor under the DPA. This includes:
- data of the organisation's visitors – tickets, pre-bookings and related information;
- data of the organisation's staff accounts and sign-in sessions;
- data of the organisation's workspace audit log;
- bug reports that staff send from the management or operator consoles;
- error-monitoring entries that contain the organisation's data (DPA clause 2.2.1(c)).
2.2. Where to turn. For these data – to access, rectify or erase them – contact the organisation directly: if you are a visitor, the institution or company where you took a ticket or booked a visit; if you are an employee of the organisation, your employer. If you send such a request to us, we will not answer it on the merits ourselves: no later than within 3 working days we will forward it to the organisation and, where your request allows, we will inform you of this (DPA clause 9.4).
2.3. Payment card data that you provide in the Paysera Checkout environment are processed by Paysera as a payment service provider under the Paysera Privacy Policy published at www.paysera.com/v2/en/legal/privacy-policy, not under this policy. [● – applies once paid plans are offered]
3. WHAT DATA WE PROCESS, WHY AND FOR HOW LONG
The tables below set out what data we process, for what purpose, on what legal basis and for how long we retain them. Where we rely on a legitimate interest (Article 6(1)(f) GDPR), we state next to the basis what that interest is. When the retention period ends we erase or anonymise the data; erased data may remain in backups for up to 7 days from erasure. Once we can no longer recover them, including from backups, Google Cloud finally removes them from its systems within 180 days at the latest (section 6.1 of the Google Cloud Data Processing Addendum).
3.1. Website visitors
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Website operation and protection | Load-balancer request logs: IP address, request address (URL), referring page address, request time, response code and duration, browser type. Platform technical logs, in which e-mail addresses are masked [● – in the entries of some e-mail sending errors the address may still remain unmasked; to be fixed before the version in force]. Rate limiting by IP address to protect against abuse (for example of signup or password reset requests). | Article 6(1)(f) GDPR – legitimate interest in keeping the website running and protecting it and its users from attacks and abuse. | 30 days from the creation of the entry (the default period of the Google Cloud Logging infrastructure service). |
| Remembering language and appearance | Cookie qms-language – only the code of the chosen language; set only when you choose a language in the language menu. Browser-stored entries: closing of the cookie notice, light or dark theme – not sent to the server. | Article 6(1)(f) GDPR – legitimate interest in showing the website in the language and appearance you chose. No consent is needed, because the cookie and the entries are necessary for the function you requested (Article 73(4) of the Law on Electronic Communications of the Republic of Lithuania). | Cookie – 12 months from the language choice. Browser entries – until you delete them. |
| Security of the signup, sign-in and workspace pages | Cookie SESSION – sign-in session. Cookie XSRF-TOKEN – protection against request forgery. | Article 6(1)(f) GDPR – legitimate interest in protecting accounts and forms from unauthorised access and request forgery. | Both cookies – until the browser is closed. On the server the session ends 30 minutes after the last action or 12 hours after sign-in. |
We use no analytics, tag managers, pixels or heat maps on the website. Fonts, program code (scripts), images and the video are served from the platform's own server, so your visit is not shared with third parties. The demo version runs in your browser, uses no cookies, keeps its settings only in the browser and holds no personal data; the requests that load it are logged like the website's (see the first row of the table), and it sends no other data to the server, except through the bug report button (see subsection 3.3).
3.2. Registration, contract and client representatives
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Registration and creation of the workspace | E-mail address, organisation name, country of registration, company code, desired subdomain, password (stored only as an irreversible hash value), registration language, the versions of the Terms and the DPA shown to you. When registering via Google – we store the e-mail address and the Google account identifier; the e-mail verification flag we only check and do not store. Google also provides the first name, surname, profile picture address and language – we receive them but do not store them: they are held only during the registration session, until it ends. For limiting repeat verification e-mails – a hash of the e-mail address, kept for 60 seconds from the request to resend the e-mail. The verification link is valid for 24 hours from sending. | Article 6(1)(f) GDPR – legitimate interest in concluding a contract with the organisation you represent. Where the client is a natural person (for example, carrying out individual activity) – Article 6(1)(b) GDPR (conclusion and performance of the contract). | Until the account is archived; after that – 12 months from archiving, then erased within 30 days (clause 9.11 of the Terms). These 12 months are the archive retention period set in the Terms (clause 9.5.2 of the Terms), during which a former client may request an export of its data (clause 9.10.3 of the Terms; Article 25(2)(g) of the EU Data Act (Regulation (EU) 2023/2854) requires a data retrieval period of at least 30 calendar days, and point (h) erasure once it ends), and during which a legal requirement to preserve data can be met (clause 9.9 of the Terms). The administrator's e-mail address remains in the Document acceptance records (see the next row). Unverified registrations (together with the Document acceptance records saved for them) are erased within 30 days from the expiry of the last verification link; expired verification records – within 7 days. |
| Conclusion of the contract and evidence | Administrator's e-mail address. Document (Terms and DPA) acceptance records: document, version, language shown, date and time of acceptance, IP address. Platform registration audit entry with the e-mail address. | Article 6(1)(f) GDPR – legitimate interest in proving who accepted which terms on behalf of the organisation and when, and in establishing, exercising or defending legal claims related to the contract. We cannot erase these records before the period ends (Article 17(3)(e) GDPR; see clause 9.5). | 10 years from the archiving of the account (Article 1.125(1) of the Civil Code of the Republic of Lithuania – the general limitation period). Platform registration audit entries with the e-mail address are anonymised 365 days after the entry is created. |
| Service notices to administrators | E-mail address. Notices about registration confirmation, account security, the trial period, changes to the Terms and prices. | Article 6(1)(f) GDPR – legitimate interest in performing the contract and informing the organisation about its account. Notices we must send by law (for example, about a personal data breach likely to result in a high risk to your rights and freedoms, Article 34 GDPR) – Article 6(1)(c) GDPR. | Until the end of the contract (archiving of the account). |
| Orders, payments and invoices | Organisation details, invoice recipient's first name, surname and e-mail, order and order confirmation records. [● – applies once paid plans are offered; the list of data is being refined] | Article 6(1)(c) GDPR – legal obligation to keep accounts and retain invoices (Article 10(1) of the Law on Financial Accounting of the Republic of Lithuania; items 3.15 and 3.19 of the Index of Retention Periods for Internal Administration Documents; Article 78(7) of the Law on Value Added Tax of the Republic of Lithuania). | 10 years from the issue of the document. |
When you register, and when you change or reset a password, we check whether the password you chose has appeared in known data breaches. For this, only the first 5 characters of the password's SHA-1 hash are sent to the Have I Been Pwned service; neither the password itself nor any personal data are transferred.
3.3. Bug reports, error monitoring and enquiries
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Bug and feedback reports from public pages and visitor pages | Report type (bug, suggestion, feedback), text, page path (without query parameters and identifiers), browser type, time, screenshot (you may leave it out; it may show everything that was on the screen at the time, so check before sending that it contains no other persons' data), your e-mail address if you send the report while signed in, otherwise – the mark "anonymous". The IP address is used only for rate limiting (up to 20 reports per hour). | Article 6(1)(f) GDPR – legitimate interest in fixing bugs and improving the product. | On the platform – until the report is automatically moved to Paysera's internal task-tracking system (usually within minutes, and no later than 7 days after submission); once moved, it is erased from the platform. In the internal task-tracking system – 12 months from the closing of the task, but no longer than 24 months from submission; the e-mail address and the screenshot are then erased. IP address – 1 hour from the report. |
| Bug report from the demo version | When you press the bug button in the demo version, Paysera's internal task-tracking system (GitLab) opens in a new tab with the page address (including query parameters), browser type and time already filled in. These data, and – as when opening any web page – your IP address, reach the Paysera GitLab server as soon as you press the button; the report itself is created only when you submit it (a GitLab account is required). | Article 6(1)(f) GDPR – legitimate interest in fixing bugs and improving the product. | Button requests in the Paysera GitLab server logs – up to 30 days. A submitted report in the internal task-tracking system – as set out in the previous row. |
| Error monitoring (Sentry system operated by Paysera) | Technical error entries, the organisation identifier and, if the error occurred while you were signed in, an internal user identifier. IP addresses, cookies and request headers are not sent, but other personal data may accidentally appear in an error description or request address. This row covers errors on public pages and in the platform infrastructure; errors in clients' workspaces we process as a processor (section 2). | Article 6(1)(f) GDPR – legitimate interest in detecting and fixing platform errors. | Up to 90 days from the creation of the entry. |
| Enquiries by e-mail (qms@paysera.com, dpo@paysera.com) | E-mail address, name; telephone number and position, if you provide them; content of the correspondence. | Article 6(1)(f) GDPR – legitimate interest in answering enquiries and managing client relationships. | Correspondence on the conclusion and performance of the contract – 10 years from the end of the contract (archiving of the account; clause 9.11 of the Terms). Other enquiries – 12 months from the last correspondence. Requests concerning data subject rights and our replies to them – 3 years from our reply (Article 27(1)(8) of the Law on the Legal Protection of Personal Data of the Republic of Lithuania – a complaint filed more than 2 years after the infringement is not examined; Article 1.125(9) of the Civil Code of the Republic of Lithuania – 3-year limitation period for claims for damages). |
3.4. Legal claims and requests from authorities
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Defence of legal claims and requests from public authorities | The data needed for the specific claim or request. | Article 6(1)(c) GDPR – where legal acts oblige us to provide data; Article 6(1)(f) GDPR – legitimate interest in establishing, exercising or defending legal claims. | Until the dispute, proceedings or fulfilment of the authority's request ends; the data are then erased (clause 9.9 of the Terms). |
4. WHETHER YOU MUST PROVIDE DATA
4.1. The registration fields are necessary to create an account – without them we cannot create the organisation's workspace. All other data are provided voluntarily: you may choose not to send a bug report and, when sending one, not to attach a screenshot. Invoice recipient data will be necessary for issuing invoices once paid plans are offered.
5. WHERE WE OBTAIN DATA FROM
5.1. We obtain most data directly from you – when you register, fill in forms, send reports or write to us – and from your browser when you browse the website.
5.2. If you choose "Sign in with Google", we obtain data from Google: the e-mail address, the e-mail verification flag and the Google account identifier, as well as the first name, surname, profile picture address and language setting. We store only the e-mail address and the account identifier; the other data we receive but do not store – they are held only during the registration session, until it ends.
5.3. Invoice recipient data may be provided by your organisation, for example by an administrator specifying to whom invoices should be sent. [● – applies once there are paid plans]
6. WHO WE SHARE DATA WITH
6.1. We do not sell data and do not use them for advertising. We share them only with the following recipients and only to the extent needed for the stated purposes:
- Google Cloud EMEA Limited (Ireland) – platform hosting; acts as our processor under a data processing agreement.
- Systems operated by Paysera – the e-mail sending server, error monitoring (Sentry) and the internal task-tracking system (GitLab); they run on Paysera-operated servers in Paysera data centres in the European Union (Lithuania and Germany).
- Google (Google Workspace) – the e-mail service in which messages sent to qms@paysera.com and dpo@paysera.com are received and stored; it acts as our processor [● – the contracting entity and data location to be confirmed by Paysera IT].
- Cloudflare, Inc. (USA) – a provider of network protection and traffic delivery services through which the error-monitoring system is reached; the content of the technical error entry passes through its servers (error entries are sent by the platform server, so your IP address is not passed to it). The transfer to the USA takes place under the European Commission's decision on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023) and, where it does not apply, under standard contractual clauses (Commission Implementing Decision (EU) 2021/914).
- Google Ireland Limited (Ireland) – as the provider of the "Sign in with Google" service and an independent controller, only if you choose this sign-in method; such processing is subject to Google's privacy policy.
- Public authorities – for example, the State Tax Inspectorate, courts, pre-trial investigation bodies – on a lawful and justified request.
- Auditors and lawyers – where needed to fulfil our legal obligations or defend legal claims; they are bound by confidentiality obligations.
- A successor in title – in the event of Paysera's reorganisation or the transfer of its business or part of it.
6.2. The list of sub-processors we engage when processing organisations' data as a processor is published in Annex 3 to the DPA at [● – domain]/legal/dpa. The recipients we engage as a controller are listed in clause 6.1.
7. TRANSFERS OF DATA OUTSIDE THE EEA
7.1. The platform's applications, database and cache run in the Google Cloud region europe-west1 (Belgium); database backups are stored in a Google Cloud EU multi-region location. Request logs are stored in Google Cloud Logging [● – an EU location for the log storage has not been set yet].
7.2. Google Cloud technical support staff may access the data from countries outside the European Economic Area (EEA). Such access is possible only under the Google Cloud data processing addendum: to the USA – under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), in which Google LLC participates; to other countries – under the European Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914). You can request a copy of the standard contractual clauses by e-mail at dpo@paysera.com.
7.3. The only other transfers of data outside the EEA are to Cloudflare, Inc. (USA), on the basis stated in clause 6.1, the Google Cloud technical support described in clause 7.2 and the Google Workspace e-mail service [● – transfer basis to be confirmed by Paysera IT; for the location of request logs see clause 7.1]. You can request a copy of the standard contractual clauses by e-mail at dpo@paysera.com. The password breach check service Have I Been Pwned (Australia) receives no personal data (see subsection 3.2).
8. AUTOMATED DECISIONS
8.1. We do not take decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR), and we do not carry out profiling.
8.2. The password breach check and the rate limits by IP address are technical protection measures, not decisions about you as a person.
9. YOUR RIGHTS
9.1. You have the right:
- of access to your data and to obtain a copy of them (Article 15 GDPR);
- to rectification of inaccurate or incomplete data (Article 16 GDPR);
- to erasure of data when they are no longer needed for the purposes for which they were collected or when the processing is unlawful (Article 17 GDPR);
- to restriction of processing while we verify the accuracy of the data; where the processing is unlawful but you ask us to restrict rather than erase the data; where we no longer need the data but you need them to establish, exercise or defend legal claims; or while we assess your objection (Article 18(1) GDPR);
- to data portability – to receive the data in a structured, machine-readable format where we process them on the basis of a contract by automated means, that is, where the client is you as a natural person (Article 20 GDPR).
9.2. Right to object. You may at any time object to our processing of your data on the basis of a legitimate interest (Article 21 GDPR). We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data are needed for the establishment, exercise or defence of legal claims.
9.3. We currently do not process your data on the basis of consent. If we ask for consent in the future, you will be able to withdraw it at any time – this will not affect the lawfulness of processing carried out before the withdrawal.
9.4. To exercise your rights, write to dpo@paysera.com. We reply no later than within one month of receiving the request (Article 12(3) GDPR); in complex cases or where we receive many requests we may extend this period by a further two months – we will inform you of the extension and its reasons within the first month. We handle requests free of charge. We will ask you to confirm your identity only where we have reasonable doubts about who is making the request (Article 12(6) GDPR); we do not require a qualified electronic signature.
9.5. We cannot erase Document acceptance records before the end of their retention period, because they are needed for the establishment, exercise or defence of legal claims (Article 17(3)(e) GDPR).
9.6. If you believe that we process your data unlawfully, you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR): the State Data Protection Inspectorate (VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, e-mail ada@ada.lt, tel. +370 5 271 2804, vdai.lrv.lt, or the supervisory authority of the EU Member State in which you live, work or where, in your view, the infringement took place. We suggest contacting us first – in most cases we will resolve the matter faster.
10. HOW WE PROTECT DATA
10.1. We apply the following organisational and technical measures:
- the connection between your browser and the platform is encrypted;
- passwords are stored only as irreversible hashes – neither we nor anyone else can recover the original password;
- access to data is granted only to those employees who need it to perform their job functions;
- each organisation's data on the platform are separated from the data of other organisations;
- backups are kept for 7 days.
11. CHILDREN
11.1. Paysera Q-GO is intended for organisations. Only persons authorised to conclude the contract on behalf of an organisation may register (clause 2.2 of the Terms). We provide no services aimed at children and do not knowingly collect their data.
12. COOKIES AND BROWSER-STORED ENTRIES
12.1. We use only those cookies and browser entries that are necessary for the website to work and to remember your choices:
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
| qms-language | Cookie | Paysera (first party) | Chosen website language; set only when you choose a language in the language menu | 12 months from the language choice |
| SESSION | Cookie (on the signup, sign-in and workspace pages) | Paysera (first party) | Sign-in session | Until the browser is closed; on the server – 30 minutes from the last action or 12 hours from sign-in |
| XSRF-TOKEN | Cookie (on the same pages) | Paysera (first party) | Protection against request forgery | Until the browser is closed |
| qms-homepage-cookie-choice | Browser entry, not sent to the server | Paysera (first party) | Remembers that you closed the cookie notice | Until you delete it |
| paysera-qms-theme | Browser entry, not sent to the server | Paysera (first party) | Light, dark or system theme | Until you delete it |
| vitepress:local-search-filter | Browser session entry (sessionStorage) on the documentation site, not sent to the server | Paysera (first party) | Remembers the text typed in the search box | Until the browser tab is closed |
| vitepress:local-search-detailed-list | Browser entry (localStorage) on the documentation site, not sent to the server | Paysera (first party) | Remembers the chosen search results view | Until you delete it |
| paysera-qms-demo-lang, paysera-qms-demo-tenant-langs, paysera-qms-demo-service-name-overrides, paysera-qms-demo-soft-identity, paysera-qms-demo-walk-in-display-id, paysera-qms-demo-walk-in-name-collection-mode, paysera-qms-demo-customer-auth-policy | Browser entries (localStorage) in the demo version, not sent to the server | Paysera (first party) | Demo settings: language, service names, display and registration modes | Until you delete it |
12.2. We use no third-party, analytics or marketing cookies. If they are ever introduced, they will work only with your consent (Article 73(4) of the Law on Electronic Communications of the Republic of Lithuania), and this policy will be updated.
12.3. You can delete cookies and browser entries at any time in your browser settings. For more detail see the Cookie Policy, which you will find in the footer of the home page.
13. CHANGES TO THE POLICY
13.1. This policy is an information notice – it does not need to be accepted. The policy is versioned: each version remains available at its own address, so you can always see which wording was in force at a given time.
13.2. We may change the policy when the data processing, legal acts or our suppliers change. We notify organisations' administrators of material changes by e-mail. The new version is published on the Paysera Q-GO website with the date from which it takes effect.
14. CONTACTS
| Data Protection Officer | dpo@paysera.com – questions about personal data and your rights |
| Questions about Paysera Q-GO | qms@paysera.com – questions about the service, registration and your account |
| By post | Paysera LT, UAB, Pilaitės pr. 16, LT-04352 Vilnius, Lithuania |
| Supervisory authority | State Data Protection Inspectorate, L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, +370 5 271 2804, vdai.lrv.lt |
VERSION HISTORY
| Version | Date | Changes |
|---|---|---|
| 0.1-draft | 2026-10-09 | First draft |