1. Data Controller & Scope
This Privacy Policy applies to personal data processed by Rosenwald Technologies OÜ (trading as Wispo / Wispo Technologies) as the Data Controller under Regulation (EU) 2016/679 (GDPR), the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus), the Turkish KVKK (No. 6698), and the Serbian ZZPL.
2. Categories of Personal Data We Process
Depending on your relationship with Wispo (Customer or Vendor), we process the following data:
- Contact Details: Full name, email address, optional phone number.
- Billing & Tax Evidence: Billing address, postal code, country, IP address, and VAT/tax identification number (for B2B verification).
- Payment Tokens: Masked card details (last 4 digits, expiry, brand) and gateway transaction references. Wispo never stores full raw card numbers or CVV/CVC codes.
- Order History: Products purchased, license keys issued, downloads accessed, invoices generated.
- Identity & KYC: Full legal name, verified email, residential or registered corporate address, government ID documentation.
- Corporate & Tax: Tax Identification Number (PIB, OIB, VKN, TCKN), commercial register excerpt (Matični broj), UBO details.
- Settlement Banking: Verified IBAN, SWIFT/BIC code, bank name, beneficiary name.
3. Lawful Bases & Purposes of Processing
We process personal data strictly in accordance with statutory legal grounds:
- Performance of Contract (GDPR Art. 6(1)(b)): Executing purchases, delivering digital licenses, provisioning SaaS access, and disbursing vendor royalties under the Master Reseller Agreement.
- Legal & Statutory Tax Compliance (GDPR Art. 6(1)(c)): Issuing mandatory fiscal invoices (e-Faktura, e-Arşiv), verifying VAT reverse-charge validity, calculating regional indirect taxes, and maintaining statutory accounting records for required statutory periods (typically 5 to 10 years).
- Legitimate Interests & Security (GDPR Art. 6(1)(f)): Real-time fraud detection (3D Secure, card velocity), network security, mitigating chargebacks, and enforcing our Acceptable Use Policy.
4. Trusted Sub-Processors & International Transfers
We partner with industry-leading infrastructure providers under strict Data Processing Agreements (DPAs) incorporating EU Standard Contractual Clauses (SCCs):
| Partner / Provider | Role & Activity | Data Location |
|---|---|---|
| Adyen / Stripe Inc. | Payment acquiring gateway & PCI-DSS tokenization | EU / Global (PCI Level 1) |
| Supabase Inc. | Authenticated encrypted database & storage | EU Central (Frankfurt) |
| Resend Inc. | Transactional billing receipts & license delivery emails | EU / US (DPA + SCCs) |
Wispo never sells, rents, or monetizes personal data to third-party ad networks or brokers.
5. Your Statutory Rights (GDPR & KVKK)
As a data subject, you hold statutory rights regarding your personal information:
- Right of Access & Portability: Request a complete export of your personal data held by Rosenwald Technologies.
- Right of Rectification: Correct inaccurate or incomplete personal or corporate tax details.
- Right of Erasure (“Right to be Forgotten”): Request deletion of your personal account, subject to mandatory statutory tax retention obligations which we are legally required to maintain.
- Right to Object & Restrict Processing: Opt-out of non-essential communications or challenge automated decisions.
To exercise any of these rights, email privacy@wispo.eu. We respond to all verified requests within thirty (30) days without charge.
6. Security Measures & Retention Periods
We employ AES-256 field encryption for sensitive tax identifiers (PIB, OIB, IBANs), TLS 1.3 in-transit encryption, role-based access control, and continuous vulnerability monitoring. Transactional tax records are retained for the statutory legal accounting period mandated by commercial law (typically 10 years). Non-transactional session tokens are purged within 30 days of session termination.