Paysera Q-GO Paysera Q-GO

Privacy Policy

Version 0.1-draft

This is a draft. It has not been approved yet and is not binding.

⚠ DRAFT v0.1 — NOT IN FORCE, REVIEW REQUIRED. First draft of 2026-10-09, prepared against GDPR Articles 13–14 and the platform's data-processing inventory. It is not yet approved by Paysera and binds no one; review by a lawyer is required. Items in square brackets [●] are facts not yet confirmed; [verify] marks legal references not yet checked. Do not rely on this text before a version without the "draft" mark is published.

PAYSERA Q-GO PRIVACY POLICY

This English version is a translation; in case of discrepancy the Lithuanian version prevails.

Information on the processing of personal data (Articles 13 and 14 GDPR)

Version0.1-draft (draft, not in force)
Published[● – date of publication of the first version in force]
In force from[● – date]
ControllerPaysera LT, UAB, legal entity code 300060819, VAT payer code LT100001261114, registered office Pilaitės pr. 16, LT-04352 Vilnius, Lithuania; data are collected and stored in the Register of Legal Entities of the Republic of Lithuania
Data Protection Officerdpo@paysera.com
Questions about Paysera Q-GOqms@paysera.com
LanguagesThe original text is in Lithuanian; in case of discrepancy the Lithuanian text prevails. In other languages (except Lithuanian and English) the page shows the English text.

IN SHORT

CONTENTS

1. ABOUT THIS POLICY

1.1. This policy explains how Paysera LT, UAB (hereinafter – Paysera, we) processes your personal data when you use the Paysera Q-GO website and platform. We process them in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter – GDPR) and the legal acts of the Republic of Lithuania.

1.2. Paysera Q-GO is a queue management service provided to organisations (businesses, institutions), not to individual consumers. We therefore process most data in a business-relationship context – as data of organisations' representatives; the GDPR applies to them in full.

1.3. This policy applies where Paysera itself decides for what purposes and how data are processed, that is, where it acts as a controller. It is intended for you if you are:

1.4. Capitalised terms not defined here have the meaning given in the Paysera Q-GO Terms of Service (hereinafter – the Terms) and the Data Processing Agreement (hereinafter – DPA).

2. WHEN PAYSERA IS NOT THE CONTROLLER

2.1. Most data on the platform are processed by our clients – organisations that use Paysera Q-GO to manage queues of their visitors. The organisation is the controller of these data, and Paysera processes them only on the organisation's instructions as a processor under the DPA. This includes:

2.2. Where to turn. For these data – to access, rectify or erase them – contact the organisation directly: if you are a visitor, the institution or company where you took a ticket or booked a visit; if you are an employee of the organisation, your employer. If you send such a request to us, we will not answer it on the merits ourselves: no later than within 3 working days we will forward it to the organisation and, where your request allows, we will inform you of this (DPA clause 9.4).

2.3. Payment card data that you provide in the Paysera Checkout environment are processed by Paysera as a payment service provider under the Paysera Privacy Policy published at www.paysera.com/v2/en/legal/privacy-policy, not under this policy. [● – applies once paid plans are offered]

3. WHAT DATA WE PROCESS, WHY AND FOR HOW LONG

The tables below set out what data we process, for what purpose, on what legal basis and for how long we retain them. Where we rely on a legitimate interest (Article 6(1)(f) GDPR), we state next to the basis what that interest is. When the retention period ends we erase or anonymise the data; erased data may remain in backups for up to 7 days from erasure. Once we can no longer recover them, including from backups, Google Cloud finally removes them from its systems within 180 days at the latest (section 6.1 of the Google Cloud Data Processing Addendum).

3.1. Website visitors

PurposeDataLegal basisRetention period
Website operation and protectionLoad-balancer request logs: IP address, request address (URL), referring page address, request time, response code and duration, browser type. Platform technical logs, in which e-mail addresses are masked [● – in the entries of some e-mail sending errors the address may still remain unmasked; to be fixed before the version in force]. Rate limiting by IP address to protect against abuse (for example of signup or password reset requests).Article 6(1)(f) GDPR – legitimate interest in keeping the website running and protecting it and its users from attacks and abuse.30 days from the creation of the entry (the default period of the Google Cloud Logging infrastructure service).
Remembering language and appearanceCookie qms-language – only the code of the chosen language; set only when you choose a language in the language menu. Browser-stored entries: closing of the cookie notice, light or dark theme – not sent to the server.Article 6(1)(f) GDPR – legitimate interest in showing the website in the language and appearance you chose. No consent is needed, because the cookie and the entries are necessary for the function you requested (Article 73(4) of the Law on Electronic Communications of the Republic of Lithuania).Cookie – 12 months from the language choice. Browser entries – until you delete them.
Security of the signup, sign-in and workspace pagesCookie SESSION – sign-in session. Cookie XSRF-TOKEN – protection against request forgery.Article 6(1)(f) GDPR – legitimate interest in protecting accounts and forms from unauthorised access and request forgery.Both cookies – until the browser is closed. On the server the session ends 30 minutes after the last action or 12 hours after sign-in.

We use no analytics, tag managers, pixels or heat maps on the website. Fonts, program code (scripts), images and the video are served from the platform's own server, so your visit is not shared with third parties. The demo version runs in your browser, uses no cookies, keeps its settings only in the browser and holds no personal data; the requests that load it are logged like the website's (see the first row of the table), and it sends no other data to the server, except through the bug report button (see subsection 3.3).

3.2. Registration, contract and client representatives

PurposeDataLegal basisRetention period
Registration and creation of the workspaceE-mail address, organisation name, country of registration, company code, desired subdomain, password (stored only as an irreversible hash value), registration language, the versions of the Terms and the DPA shown to you. When registering via Google – we store the e-mail address and the Google account identifier; the e-mail verification flag we only check and do not store. Google also provides the first name, surname, profile picture address and language – we receive them but do not store them: they are held only during the registration session, until it ends. For limiting repeat verification e-mails – a hash of the e-mail address, kept for 60 seconds from the request to resend the e-mail. The verification link is valid for 24 hours from sending.Article 6(1)(f) GDPR – legitimate interest in concluding a contract with the organisation you represent. Where the client is a natural person (for example, carrying out individual activity) – Article 6(1)(b) GDPR (conclusion and performance of the contract).Until the account is archived; after that – 12 months from archiving, then erased within 30 days (clause 9.11 of the Terms). These 12 months are the archive retention period set in the Terms (clause 9.5.2 of the Terms), during which a former client may request an export of its data (clause 9.10.3 of the Terms; Article 25(2)(g) of the EU Data Act (Regulation (EU) 2023/2854) requires a data retrieval period of at least 30 calendar days, and point (h) erasure once it ends), and during which a legal requirement to preserve data can be met (clause 9.9 of the Terms). The administrator's e-mail address remains in the Document acceptance records (see the next row). Unverified registrations (together with the Document acceptance records saved for them) are erased within 30 days from the expiry of the last verification link; expired verification records – within 7 days.
Conclusion of the contract and evidenceAdministrator's e-mail address. Document (Terms and DPA) acceptance records: document, version, language shown, date and time of acceptance, IP address. Platform registration audit entry with the e-mail address.Article 6(1)(f) GDPR – legitimate interest in proving who accepted which terms on behalf of the organisation and when, and in establishing, exercising or defending legal claims related to the contract. We cannot erase these records before the period ends (Article 17(3)(e) GDPR; see clause 9.5).10 years from the archiving of the account (Article 1.125(1) of the Civil Code of the Republic of Lithuania – the general limitation period). Platform registration audit entries with the e-mail address are anonymised 365 days after the entry is created.
Service notices to administratorsE-mail address. Notices about registration confirmation, account security, the trial period, changes to the Terms and prices.Article 6(1)(f) GDPR – legitimate interest in performing the contract and informing the organisation about its account. Notices we must send by law (for example, about a personal data breach likely to result in a high risk to your rights and freedoms, Article 34 GDPR) – Article 6(1)(c) GDPR.Until the end of the contract (archiving of the account).
Orders, payments and invoicesOrganisation details, invoice recipient's first name, surname and e-mail, order and order confirmation records. [● – applies once paid plans are offered; the list of data is being refined]Article 6(1)(c) GDPR – legal obligation to keep accounts and retain invoices (Article 10(1) of the Law on Financial Accounting of the Republic of Lithuania; items 3.15 and 3.19 of the Index of Retention Periods for Internal Administration Documents; Article 78(7) of the Law on Value Added Tax of the Republic of Lithuania).10 years from the issue of the document.

When you register, and when you change or reset a password, we check whether the password you chose has appeared in known data breaches. For this, only the first 5 characters of the password's SHA-1 hash are sent to the Have I Been Pwned service; neither the password itself nor any personal data are transferred.

3.3. Bug reports, error monitoring and enquiries

PurposeDataLegal basisRetention period
Bug and feedback reports from public pages and visitor pagesReport type (bug, suggestion, feedback), text, page path (without query parameters and identifiers), browser type, time, screenshot (you may leave it out; it may show everything that was on the screen at the time, so check before sending that it contains no other persons' data), your e-mail address if you send the report while signed in, otherwise – the mark "anonymous". The IP address is used only for rate limiting (up to 20 reports per hour).Article 6(1)(f) GDPR – legitimate interest in fixing bugs and improving the product.On the platform – until the report is automatically moved to Paysera's internal task-tracking system (usually within minutes, and no later than 7 days after submission); once moved, it is erased from the platform. In the internal task-tracking system – 12 months from the closing of the task, but no longer than 24 months from submission; the e-mail address and the screenshot are then erased. IP address – 1 hour from the report.
Bug report from the demo versionWhen you press the bug button in the demo version, Paysera's internal task-tracking system (GitLab) opens in a new tab with the page address (including query parameters), browser type and time already filled in. These data, and – as when opening any web page – your IP address, reach the Paysera GitLab server as soon as you press the button; the report itself is created only when you submit it (a GitLab account is required).Article 6(1)(f) GDPR – legitimate interest in fixing bugs and improving the product.Button requests in the Paysera GitLab server logs – up to 30 days. A submitted report in the internal task-tracking system – as set out in the previous row.
Error monitoring (Sentry system operated by Paysera)Technical error entries, the organisation identifier and, if the error occurred while you were signed in, an internal user identifier. IP addresses, cookies and request headers are not sent, but other personal data may accidentally appear in an error description or request address. This row covers errors on public pages and in the platform infrastructure; errors in clients' workspaces we process as a processor (section 2).Article 6(1)(f) GDPR – legitimate interest in detecting and fixing platform errors.Up to 90 days from the creation of the entry.
Enquiries by e-mail (qms@paysera.com, dpo@paysera.com)E-mail address, name; telephone number and position, if you provide them; content of the correspondence.Article 6(1)(f) GDPR – legitimate interest in answering enquiries and managing client relationships.Correspondence on the conclusion and performance of the contract – 10 years from the end of the contract (archiving of the account; clause 9.11 of the Terms). Other enquiries – 12 months from the last correspondence. Requests concerning data subject rights and our replies to them – 3 years from our reply (Article 27(1)(8) of the Law on the Legal Protection of Personal Data of the Republic of Lithuania – a complaint filed more than 2 years after the infringement is not examined; Article 1.125(9) of the Civil Code of the Republic of Lithuania – 3-year limitation period for claims for damages).

3.4. Legal claims and requests from authorities

PurposeDataLegal basisRetention period
Defence of legal claims and requests from public authoritiesThe data needed for the specific claim or request.Article 6(1)(c) GDPR – where legal acts oblige us to provide data; Article 6(1)(f) GDPR – legitimate interest in establishing, exercising or defending legal claims.Until the dispute, proceedings or fulfilment of the authority's request ends; the data are then erased (clause 9.9 of the Terms).

4. WHETHER YOU MUST PROVIDE DATA

4.1. The registration fields are necessary to create an account – without them we cannot create the organisation's workspace. All other data are provided voluntarily: you may choose not to send a bug report and, when sending one, not to attach a screenshot. Invoice recipient data will be necessary for issuing invoices once paid plans are offered.

5. WHERE WE OBTAIN DATA FROM

5.1. We obtain most data directly from you – when you register, fill in forms, send reports or write to us – and from your browser when you browse the website.

5.2. If you choose "Sign in with Google", we obtain data from Google: the e-mail address, the e-mail verification flag and the Google account identifier, as well as the first name, surname, profile picture address and language setting. We store only the e-mail address and the account identifier; the other data we receive but do not store – they are held only during the registration session, until it ends.

5.3. Invoice recipient data may be provided by your organisation, for example by an administrator specifying to whom invoices should be sent. [● – applies once there are paid plans]

6. WHO WE SHARE DATA WITH

6.1. We do not sell data and do not use them for advertising. We share them only with the following recipients and only to the extent needed for the stated purposes:

6.2. The list of sub-processors we engage when processing organisations' data as a processor is published in Annex 3 to the DPA at [● – domain]/legal/dpa. The recipients we engage as a controller are listed in clause 6.1.

7. TRANSFERS OF DATA OUTSIDE THE EEA

7.1. The platform's applications, database and cache run in the Google Cloud region europe-west1 (Belgium); database backups are stored in a Google Cloud EU multi-region location. Request logs are stored in Google Cloud Logging [● – an EU location for the log storage has not been set yet].

7.2. Google Cloud technical support staff may access the data from countries outside the European Economic Area (EEA). Such access is possible only under the Google Cloud data processing addendum: to the USA – under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), in which Google LLC participates; to other countries – under the European Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914). You can request a copy of the standard contractual clauses by e-mail at dpo@paysera.com.

7.3. The only other transfers of data outside the EEA are to Cloudflare, Inc. (USA), on the basis stated in clause 6.1, the Google Cloud technical support described in clause 7.2 and the Google Workspace e-mail service [● – transfer basis to be confirmed by Paysera IT; for the location of request logs see clause 7.1]. You can request a copy of the standard contractual clauses by e-mail at dpo@paysera.com. The password breach check service Have I Been Pwned (Australia) receives no personal data (see subsection 3.2).

8. AUTOMATED DECISIONS

8.1. We do not take decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR), and we do not carry out profiling.

8.2. The password breach check and the rate limits by IP address are technical protection measures, not decisions about you as a person.

9. YOUR RIGHTS

9.1. You have the right:

9.2. Right to object. You may at any time object to our processing of your data on the basis of a legitimate interest (Article 21 GDPR). We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data are needed for the establishment, exercise or defence of legal claims.

9.3. We currently do not process your data on the basis of consent. If we ask for consent in the future, you will be able to withdraw it at any time – this will not affect the lawfulness of processing carried out before the withdrawal.

9.4. To exercise your rights, write to dpo@paysera.com. We reply no later than within one month of receiving the request (Article 12(3) GDPR); in complex cases or where we receive many requests we may extend this period by a further two months – we will inform you of the extension and its reasons within the first month. We handle requests free of charge. We will ask you to confirm your identity only where we have reasonable doubts about who is making the request (Article 12(6) GDPR); we do not require a qualified electronic signature.

9.5. We cannot erase Document acceptance records before the end of their retention period, because they are needed for the establishment, exercise or defence of legal claims (Article 17(3)(e) GDPR).

9.6. If you believe that we process your data unlawfully, you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR): the State Data Protection Inspectorate (VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, e-mail ada@ada.lt, tel. +370 5 271 2804, vdai.lrv.lt, or the supervisory authority of the EU Member State in which you live, work or where, in your view, the infringement took place. We suggest contacting us first – in most cases we will resolve the matter faster.

10. HOW WE PROTECT DATA

10.1. We apply the following organisational and technical measures:

11. CHILDREN

11.1. Paysera Q-GO is intended for organisations. Only persons authorised to conclude the contract on behalf of an organisation may register (clause 2.2 of the Terms). We provide no services aimed at children and do not knowingly collect their data.

12. COOKIES AND BROWSER-STORED ENTRIES

12.1. We use only those cookies and browser entries that are necessary for the website to work and to remember your choices:

NameTypeSet byPurposeDuration
qms-languageCookiePaysera (first party)Chosen website language; set only when you choose a language in the language menu12 months from the language choice
SESSIONCookie (on the signup, sign-in and workspace pages)Paysera (first party)Sign-in sessionUntil the browser is closed; on the server – 30 minutes from the last action or 12 hours from sign-in
XSRF-TOKENCookie (on the same pages)Paysera (first party)Protection against request forgeryUntil the browser is closed
qms-homepage-cookie-choiceBrowser entry, not sent to the serverPaysera (first party)Remembers that you closed the cookie noticeUntil you delete it
paysera-qms-themeBrowser entry, not sent to the serverPaysera (first party)Light, dark or system themeUntil you delete it
vitepress:local-search-filterBrowser session entry (sessionStorage) on the documentation site, not sent to the serverPaysera (first party)Remembers the text typed in the search boxUntil the browser tab is closed
vitepress:local-search-detailed-listBrowser entry (localStorage) on the documentation site, not sent to the serverPaysera (first party)Remembers the chosen search results viewUntil you delete it
paysera-qms-demo-lang, paysera-qms-demo-tenant-langs, paysera-qms-demo-service-name-overrides, paysera-qms-demo-soft-identity, paysera-qms-demo-walk-in-display-id, paysera-qms-demo-walk-in-name-collection-mode, paysera-qms-demo-customer-auth-policyBrowser entries (localStorage) in the demo version, not sent to the serverPaysera (first party)Demo settings: language, service names, display and registration modesUntil you delete it

12.2. We use no third-party, analytics or marketing cookies. If they are ever introduced, they will work only with your consent (Article 73(4) of the Law on Electronic Communications of the Republic of Lithuania), and this policy will be updated.

12.3. You can delete cookies and browser entries at any time in your browser settings. For more detail see the Cookie Policy, which you will find in the footer of the home page.

13. CHANGES TO THE POLICY

13.1. This policy is an information notice – it does not need to be accepted. The policy is versioned: each version remains available at its own address, so you can always see which wording was in force at a given time.

13.2. We may change the policy when the data processing, legal acts or our suppliers change. We notify organisations' administrators of material changes by e-mail. The new version is published on the Paysera Q-GO website with the date from which it takes effect.

14. CONTACTS

Data Protection Officerdpo@paysera.com – questions about personal data and your rights
Questions about Paysera Q-GOqms@paysera.com – questions about the service, registration and your account
By postPaysera LT, UAB, Pilaitės pr. 16, LT-04352 Vilnius, Lithuania
Supervisory authorityState Data Protection Inspectorate, L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, +370 5 271 2804, vdai.lrv.lt

VERSION HISTORY

VersionDateChanges
0.1-draft2026-10-09First draft
Back to the homepage

Report a problem

Type

Your report includes the page address, your browser type, the screenshot (unless you leave it out) and, if you are signed in to a staff account, your email address. Paysera keeps it here only until it is moved to its internal task tracker, at most 7 days. There, the screenshot and your email address are erased 12 months after the report is closed, and no later than 24 months after you send it.