GDPR Compliance & Data Subject Rights

Effective date: April 29, 2026

1. Introduction

This page sets out how Quantago complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the UK GDPR as retained in UK law. It supplements our Privacy Policy and is intended for users located in the European Economic Area (EEA), the United Kingdom, and Switzerland.

Quantago is operated by Universal Reason LLC, a Wyoming (USA) limited liability company. As a US-based company offering services to individuals in the EEA and UK, Quantago is subject to GDPR obligations as a data controller.

If you have questions about your GDPR rights or how we handle your data, contact us at: privacy@quantago.co

2. Data Controller Identity

Quantago does not currently have an EU/UK establishment or a formally appointed EU Representative under Article 27 GDPR. Given our current pre-launch stage and zero active EEA customers, this obligation is being monitored and will be fulfilled prior to active marketing to EEA users at scale. We will appoint an EU Representative and, if required, a Data Protection Officer before reaching the applicable thresholds.

• Legal entity: Universal Reason LLC
• Trading name: Quantago
• Jurisdiction of incorporation: Wyoming, United States
• GDPR role: Data Controller
• Contact for data protection matters: privacy@quantago.co

3. Legal Bases for Processing

Under Article 6 GDPR, we rely on the following legal bases for processing personal data:

Special categories

We do not process special categories of personal data (Article 9 GDPR) and do not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals (Article 22 GDPR).

4. Your Data Subject Rights

Under GDPR Chapter III, EEA and UK users have the following rights. We will respond to all verified requests within 30 days (extendable by a further 60 days for complex requests, with notice).

4.1 Right of Access (Article 15)

You may request a copy of all personal data we hold about you, along with information about how we use it, who we share it with, and how long we retain it.

4.2 Right to Rectification (Article 16)

You may request correction of any inaccurate or incomplete personal data we hold about you.

4.3 Right to Erasure / “Right to be Forgotten” (Article 17)

You may request deletion of your personal data where: (a) it is no longer necessary for the purpose it was collected; (b) you withdraw consent and there is no other legal basis; (c) you object and there are no overriding legitimate grounds; (d) the data has been unlawfully processed; or (e) deletion is required by EU or Member State law.

Erasure may be limited where retention is required for legal compliance, dispute resolution, or enforcement of our Terms. Broker OAuth tokens are deleted within 30 days of account deletion or disconnection.

4.4 Right to Restriction of Processing (Article 18)

You may request that we restrict processing of your data in certain circumstances, including while a rectification request is under review or while an objection is being assessed.

4.5 Right to Data Portability (Article 20)

Where processing is based on contract or consent and carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format (JSON or CSV), and have it transmitted to another controller where technically feasible.

4.6 Right to Object (Article 21)

You may object at any time to processing based on legitimate interests (Article 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims.

You have an unconditional right to object to processing of your personal data for direct marketing purposes at any time.

4.7 Rights Related to Automated Decision-Making (Article 22)

Quantago does not make decisions that produce legal or similarly significant effects on you through solely automated means. This right is therefore not currently applicable, but we will notify you if this changes.

4.8 Right to Withdraw Consent (Article 7(3))

Where processing is based on your consent (e.g., marketing emails), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. You can withdraw consent by clicking the unsubscribe link in any marketing email or by contacting privacy@quantago.co.

5. How to Exercise Your Rights

To submit a data subject request:

• Email: privacy@quantago.co
• Subject line: “GDPR Data Request — [Type of Request]”
• Include: your full name, the email address associated with your account, and a description of your request.

Verification and fees

We will verify your identity before processing any request. Verification is typically done by confirming access to the registered email address. For sensitive requests (erasure, portability), we may require additional verification.

Requests are free of charge. If requests are manifestly unfounded or excessive (including repetitive requests), we may charge a reasonable fee or refuse to act, with written explanation.

6. International Data Transfers

As a US-based company, personal data of EEA/UK users is transferred to and processed in the United States. We rely on the following safeguards for these transfers:

• Standard Contractual Clauses (SCCs): we use the EU Commission’s approved Standard Contractual Clauses (2021/914) with our data processors, including Cloudflare, Inc. and Neon, Inc., where required.
• Cloudflare, Inc.: participates in the EU-US Data Privacy Framework (DPF) and processes EEA data under SCCs. Cloudflare’s Data Processing Addendum is incorporated into our agreement.
• Neon, Inc.: processes data under SCCs. Database region can be configured to remain within the EEA upon request.
• UK Transfers: we rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs for transfers from the UK.

Adequacy

We do not transfer personal data to countries that have not received an adequacy decision from the European Commission without appropriate safeguards in place.

7. Data Retention Schedule

8. Security Measures (Article 32 GDPR)

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit using TLS 1.3 (enforced at Cloudflare edge).
• Encryption of sensitive data at rest using AES-256, including all broker OAuth tokens.
• Access controls and least-privilege principles for all systems processing personal data.
• Cloudflare WAF providing OWASP Top 10 protection and DDoS mitigation.
• Automated vulnerability monitoring via GitHub Dependabot.
• Regular review of security controls and third-party processor compliance.

Breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (Article 33 GDPR), and notify affected individuals without undue delay where the breach is likely to result in a high risk (Article 34 GDPR).

9. Sub-Processors and Third-Party Data Processors

We use the following sub-processors that may process EEA/UK personal data on our behalf:

Data Processing Agreements

We maintain Data Processing Agreements (DPAs) with all sub-processors. We will update this list when sub-processors are added or removed.

9b. Third-Party Controllers (Broker Integrations)

When you connect a broker account to Quantago, certain personal data (such as your account identifier and OAuth token) is transmitted to and processed by that broker. These brokers are independent data controllers — they determine the purposes and means of their own data processing and operate under their own privacy policies and regulatory frameworks. Quantago is not responsible for the data practices of these third parties.

Unlike sub-processors, these parties are not acting on Quantago’s behalf. They receive data because you have chosen to connect your account and authorised the connection. You should review each broker’s privacy policy before connecting.

Conduit role

Quantago acts solely as a conduit, transmitting trade instructions to these brokers at your direction using the OAuth access token you have authorised. We do not share personal data with these brokers beyond what is technically required to execute this connection.

10. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority. You may do so without prejudice to any other administrative or judicial remedy.

• EEA users: contact the supervisory authority in your EU member state of residence, place of work, or the place of the alleged infringement. A list of EEA supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
• UK users: contact the Information Commissioner’s Office (ICO) at https://ico.org.uk or by phone at +44 303 123 1113.
• Swiss users: contact the Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch

Resolution first

We encourage you to contact us first at privacy@quantago.co so we can attempt to resolve your concern directly.

11. Changes to This Page

We may update this GDPR Compliance page from time to time to reflect changes in our data processing activities, legal obligations, or supervisory guidance. The effective date at the top of this page will be updated accordingly. Material changes will be communicated via email or in-product notice.

---

Contact

For GDPR enquiries, contact privacy@quantago.co.

• Subject: GDPR Enquiry
• Legal entity: Universal Reason LLC, Wyoming, United States
• We aim to respond to all GDPR-related enquiries within 5 business days and to all formal data subject requests within 30 days.

Quantago GDPR Compliance Page | Effective April 29, 2026 | Operated by Universal Reason LLC