Terms, Data Processing and Privacy
Privacy Policy
This policy
This privacy policy applies to the WeTransact website, the WeTransact SaaS application and any related products or services (“Solution”).
Hosting
WeTransact runs on leading cloud services.
The application is deployed on Microsoft Azure, Amazon Web Services or Google Cloud Platform when needed. Data is stored in the public cloud region that is automatically chosen for lowest latency; regions can be in the EEA, United Kingdom, United States, Canada, Asia-Pacific, Latin America, the Middle East or Africa.
All providers offer high availability, built-in disaster recovery and ISO/IEC 27001-certified data-centres.
Encryption
Every byte is encrypted in transit and at rest with service-managed keys.
Back-ups are held in a separate availability zone in the same geography.
Authentication
Sign-in uses Microsoft Entra ID (Azure AD) Single Sign-On when the customer has an Entra tenant.
Where SSO is not available, WeTransact issues its own credentials. Passwords are stored using industry‑standard salted hashing algorithms.
Protection of personal data
WeTransact is controller for account, billing and security data, and processor for any “Publisher Data” you upload.
The rules for processor work are set out in the Data Processing Agreement.
Data (we handle are low-sensitivity):
Publisher account data: company name, authorised-user work email, authorized-user name and surname.
Marketplace order data: end-customer email (mandatory), name (optional), role (optional), phone (optional). Defined by the Publisher.
Publishers must not upload special-category or criminal-history data.
Sub-processors
All sub-processors are vetted, bound by GDPR-level contracts.
International transfers
When data leaves the EEA or UK, WeTransact relies on:
EU Standard Contractual Clauses and the UK Addendum; and the EU-US Data Privacy Framework, where the recipient is self-certified.
Retention
Active accounts – data kept while the contract is active.
Customer-closed – data deleted 30 days after closure.
Suspended – data deleted 120 days from suspension.
Back-ups – 30-day rolling window.
Billing/tax – contract term + 6 years.
Security logs – 12 months.
Support tickets – contract term + 24 months.
After these periods data is deleted or fully anonymised.
Security & certifications
WeTransact maintains an ISO/IEC 27001-certified ISMS.
Since 31 August 2025 we also hold a SOC 2 Type 2 attestation covering Security, Confidentiality and Availability.
Key controls include SSO, least-privilege access, encryption, network segmentation, 24 × 7 monitoring and tested incident-response plans.
Our most recent SOC 2 Type 2 report and ISO 27001 certificate are available to customers under NDA.
Your rights
You may, under applicable law, ask to access, correct, delete, restrict or port your Personal Data, or object to our processing.
Send requests to legal@wetransact.io. We may verify identity before action.
Incident notification
If a breach affects Publisher Data while we act as processor, we will inform the Publisher without undue delay as required by the DPA.
If we act as controller, we will notify the CNIL and, where required, affected persons.
Children
The Solution targets business users only. We do not knowingly collect data from minors.
Changes
Material changes will be announced in-app or by email 30 days before they take effect. Continued use after that date means acceptance.
Contact
Email: legal@wetransact.io
Post: WeTransact, Praça Dom Pedro IV 74, Room 4.03 (Unicorn Factory), 1100-203 Lisboa, Portugal.