GDPR Compliance

Last updated: July 6, 2026

1. Data Controller

The data controller for personal data processed through the Licensio platform is Altirratech EU. The holding company is Altirratech Ltd, registered in Cyprus.

Email: dpo@altirratech.com

2. Data Processing Agreement (DPA)

Because Licensio is a self-hosted platform, all customer and end-user data remains on your own infrastructure. Altirratech EU does not process, store, or access your data. A DPA is therefore not required for the self-hosted deployment.

If you use our hosted billing services (Revolut Pay integration), limited billing data is processed by Revolut Pay under their own DPA. Contact dpo@altirratech.com if you require a signed DPA.

3. Data We Collect

Website visitors: Standard web analytics data (pages visited, browser type, referrer) if you opt in. No tracking cookies unless explicitly consented.

Platform users (vendors): Email address, company name, and billing information necessary to provide the service.

End users (your customers): Email address and device fingerprints (SHA-256 hashed). This data stays on your infrastructure.

4. Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Contract performance: To provide the Licensio platform and billing services.
  • Consent: For optional analytics and marketing communications.
  • Legitimate interests: For security monitoring, fraud prevention, and service improvement.

5. Data Subject Rights

Under GDPR, you have the following rights:

  • Right of access — request a copy of your personal data.
  • Right to rectification — correct inaccurate data.
  • Right to erasure — request deletion of your data ("right to be forgotten").
  • Right to restriction — limit how we process your data.
  • Right to data portability — receive your data in a structured format.
  • Right to object — object to processing based on legitimate interests.

To exercise any of these rights, contact: dpo@altirratech.com

6. Data Retention

We retain vendor account data for the duration of the subscription plus 12 months. After that, data is anonymized or deleted. End-user data is retained on your own infrastructure per your own retention policy. You may request deletion of your data at any time.

7. International Data Transfers

The Licensio platform is self-hosted — you choose where to deploy it. Our website is hosted in the EU (Hetzner, Germany). If you deploy outside the EEA, you are responsible for ensuring appropriate safeguards under GDPR Article 44-49.

8. Cookies

The Licensio website uses only essential cookies for session management (if any). We do not use marketing, tracking, or third-party cookies. The self-hosted platform does not set any cookies — session management is handled via JWT tokens.

9. Security Measures

We implement: encryption in transit (TLS 1.3), encryption at rest (AES-256), rate limiting, IP banning, geo-restriction, and audit logging. The self-hosted platform gives you full control over your security posture.

10. Data Breach Notification

In the event of a data breach, we will notify affected parties within 72 hours as required by GDPR Article 33. Notifications will be sent via email and/or NTFY push alerts.

11. Contact

Data Protection Officer:
Email: dpo@altirratech.com

Altirratech EU
Software solutions development

Altirratech Ltd
Holding company — Cyprus

12. Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data protection rights have been violated.