Privacy policy
This website, tranzify.tech, is run under the Tranzify Tech brand by Allybase, Unipessoal Lda, a company registered in Portugal (NIPC 518393151) with its registered office at Rua da Casa Branca 98, 9004-535 Funchal. It is the controller of the personal data described on this page. Questions, requests and complaints: hello@tranzify.tech, subject “personal data”, or by post to the registered office. The company has not appointed a data protection officer; the address above is the single point of contact for data protection.
This policy covers the website and the enquiries made through it. The platform that the company licenses to payment companies processes payers’ and merchants’ data on behalf of each client, as a processor under the data processing agreement signed with that client; that processing is described in the agreement, not here.
What the site records, by situation
When you read a page
For every page served, the site keeps one record in its own analytics: the page and the language, the time, the referring site, the campaign tags in the address (utm and click identifiers), the kind of device, the browser and the operating system, the country, and the status of the answer. Without your consent to analytics the network address in this record is truncated (the last part removed) and hashed with a key that changes every day, and no identifier is stored, so the records count visits and pages without following anyone from one day to the next.
With your consent to analytics the record carries the full network address, the site’s visitor cookie vid and the identifiers of the analytics cookies, so that visits join into a visitor; with your consent to marketing it also carries the identifiers of the advertising cookies. The cookie policy lists every cookie by category.
The web server and the load balancer also keep technical logs of requests: the network address, the time, the page, the status and the browser’s identification string. They are used for security and troubleshooting only.
When a tracker is enabled
Google Analytics 4 loads only after your consent to analytics; the Meta Pixel and the LinkedIn Insight Tag load only after your consent to marketing. Before consent, the site downloads none of their code and sends them nothing. After consent they receive what their cookies and scripts collect: the pages you read, the device and browser type, the referrer and the campaign tags, and the identifiers in their cookies; the advertising services use them to recognise the browser in their own systems. Their own policies are linked from the cookie policy.
When you send a form
The demo request and contact forms ask for your name, work e-mail, company, role, country and your message; only the fields marked as required are needed to answer you, the rest are optional. With the form the site keeps the page and language it was sent from, the time, the campaign tags of the visit and a salted hash of your network address, which protects the forms against abuse and cannot be turned back into the address. Submissions are stored in the company’s database in the European Union, copied to an internal queue that notifies the team, and answered by e-mail. Giving this data is voluntary; without it the company cannot answer.
When you write to us or meet us
E-mails, messages on professional networks, business cards and notes from calls and events are kept as business correspondence: your name, position, company, contact details and the content of the exchange. They are used to answer you, to prepare a proposal and to keep the relationship.
When a page fails
If a page’s script fails in your browser, the browser sends the site a short report: the error message, the script’s position, the page address and the browser’s identification string, never what you typed. The report is stored with a truncated, daily-hashed network address.
Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answering an enquiry, arranging a demo, preparing a proposal | Form fields, correspondence | Steps at your request before a contract, article 6(1)(b); the company’s legitimate interest in answering a business enquiry, article 6(1)(f) |
| Counting visits and pages without identifiers | The site’s own analytics records without consent, technical logs | Legitimate interest in knowing how the site is used and keeping it working, article 6(1)(f) |
| Measuring visitors and campaigns with identifiers | The site’s own analytics with vid, Google Analytics |
Your consent, article 6(1)(a), given by category and withdrawable at any time |
| Measuring advertising and building audiences | Meta Pixel, LinkedIn Insight Tag | Your consent, article 6(1)(a) |
| Finding and fixing errors | Error reports | Legitimate interest in keeping the site working, article 6(1)(f) |
| Security of the site and the forms, abuse prevention | Hashed network addresses, technical logs, rate limits | Legitimate interest in protecting the service, article 6(1)(f) |
| Keeping records the law requires | Correspondence and contracts, where a contract follows | Legal obligation, article 6(1)(c) |
| Checking a prospective client against sanctions lists before a contract | Company and representatives’ names | Legal obligation under the sanctions regulations of the EU, article 6(1)(c) |
Where the basis is legitimate interest, the company has weighed it against your interests: the records without consent carry no identifier that could follow you, and the correspondence is what any business keeps to answer and serve a contact. You may object to processing based on legitimate interest at any time; see your rights below.
The site makes no decisions about you by automated means and builds no profiles of its own. The advertising services, with your consent to marketing, may place your browser into audiences under their own rules; withdrawing consent stops the site from sending them anything further.
Who receives the data, and where
The site runs on Amazon Web Services in the European Union (region Frankfurt, Germany). Amazon Web Services EMEA SARL hosts the servers and storage under a data processing agreement and does not use the data for its own purposes. The e-mail and messaging tools the company uses to answer you process your correspondence on the company’s instructions.
With your consent, the trackers’ providers receive the data described above: Google Ireland Limited (Google Analytics), Meta Platforms Ireland Limited (Meta Pixel), LinkedIn Ireland Unlimited Company (Insight Tag). Google, Meta and LinkedIn may transfer data to the United States; they are certified under the EU-US Data Privacy Framework and use the European Commission’s standard contractual clauses for other transfers. You can refuse or withdraw the consent for each category separately.
The company does not sell personal data and does not pass it to third parties for their own purposes. It may disclose data when the law requires it, to a court or an authority with a valid request, to its professional advisers under confidentiality, or to a successor if the company or the site is transferred, on the same terms as here.
How long the data is kept
| Data | Kept for |
|---|---|
| Form submissions and the correspondence that follows | 2 years from the last contact, then deleted; where a contract is signed, for the term of the contract and the period the law requires afterwards |
| The site’s own analytics records | 13 months, then only aggregated figures without any personal data remain |
| Error reports | 13 months at most, usually deleted sooner |
| Technical logs of the server and the load balancer | A short period, not longer than the analytics records, for security and troubleshooting |
| Cookies | The periods in the cookie policy; your choice is kept for 1 year |
| Data held by the trackers’ providers | Set by their terms within the consent-mode settings of the site; Google Analytics keeps user-level data for no longer than 14 months |
When a period ends, the data is deleted or anonymised; backups are rotated within the following weeks.
Security
The site is served only over TLS, with strict transport security, a content security policy and the other protective headers; the forms are protected against cross-site requests and against abuse by rate limits; the network address of a visitor is truncated and hashed before it is stored without consent; access to the database and the storage is limited to the people who need it, through named accounts, and the servers hold no card data of anyone. The platform licensed to clients is built to the requirements of PCI DSS and keeps its own journals; its security is described in the agreement with each client.
Children
The site is addressed to businesses and is not meant for anyone under 18. The company does not knowingly collect data of children; if you believe it has, write to the address above and the data will be deleted.
Your rights
Under the GDPR you may ask the company, at any time and free of charge, for the following:
- Access: confirmation of whether your data is processed, a copy of it and the information on this page as it applies to you.
- Rectification: correction of data that is inaccurate or incomplete.
- Erasure: deletion of your data when it is no longer needed, when you withdraw consent, when you object and no overriding ground remains, or when the processing is unlawful.
- Restriction: a freeze of the processing while a request is examined or when you need the data for a legal claim.
- Portability: the data you gave the company, in a machine-readable form, for yourself or for another controller.
- Objection: to processing based on legitimate interest, for reasons relating to your situation, and to any direct marketing without reasons.
- Withdrawal of consent: for the analytics and marketing categories, in the cookie settings in the footer; the withdrawal does not affect the processing done before it.
Write to hello@tranzify.tech with “personal data” in the subject, from the address the company knows for you or with enough detail to identify you; the company may ask for confirmation of your identity when the request concerns data it could not otherwise attribute to you. It answers within one month, extended by two further months for complex requests with notice. If you believe your rights have been infringed, you may lodge a complaint with a supervisory authority, in Portugal the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, cnpd.pt, or with the authority of the country where you live or work.
Changes
This policy changes when the site, the services it uses or the law change; the new version is published on this page and the date at the top says when it was last updated. Changes that widen the use of your data are announced in the cookie box or by e-mail where the company has your address.
The data processing agreement for clients of the platform is a separate document provided with the licence agreement.
Updated: 2026-11-08