---
title: "Qualy's Privacy Policy"
description: "What personal data Qualy collects, why, how long it is kept, and the rights you have over it."
updated: "Version 2026.2 · Effective 14 October 2026"
lastModified: "2026-10-31"
lang: "en"
wordCount: 2899
url: https://qualyhq.com/privacy-policy
---
## Site navigation

- [For schools](/international-education/for-schools.md) — For international education schools
- [For agents](/international-education/for-education-agents.md) — For international education agents
- [Product](/training.md) — Qualy features for international education payments
- [Resources](/training.md) — Guides, articles and company information
- [Pricing](/pricing)
- [5-min demo](/demo.md)
- [Login](https://dashboard.qualyhq.com)

# Qualy's Privacy Policy

> What personal data Qualy collects, why, how long it is kept, and the rights you have over it.

This policy explains what we do with personal data we are responsible for.

There are two different situations, and it matters which one you are in.

- **You have a Qualy account, or you visit our website.** We decide what happens to your data, so we are responsible for it. **This policy covers that.**
- **You paid a school or an agent who uses Qualy.** They decide what happens to your data and we handle it on their instructions. **Their privacy policy applies, not this one** — though the section on [paying through Qualy](#if-you-paid-someone-through-qualy) tells you what we do and who to contact.

## Who we are

**Qualy Services OÜ** is responsible for your personal data, wherever you are:

> Qualy Services OÜ · registration 16558543
> Sepapaja tn 6, 15551 Tallinn, Estonia

We also have companies in Australia and Brazil. They exist to connect to local payment providers, and they handle payment data in those markets. They are not who you contract with, and this policy covers all of them. **They are also our local points of contact**, so you do not have to write to Estonia to reach us:

| | |
| --- | --- |
| **Brazil** | Qualy Services Brazil LTDA · CNPJ 58.720.637/0001-32 — our representative for the LGPD, alongside the *Encarregado* named below |
| **Australia** | ELBOW 48 PTY LTD · ABN 76 648 713 302 — our contact for the Australian Privacy Principles and the Notifiable Data Breaches scheme |

**Qualy is part of the NexPay group.** NexPay is a separate, licensed payment company under common ownership with Qualy. If you have a Qualy account, NexPay receives some of your data — see [below](#nexpay). Its licences and registrations are published at [nexpay.com.au/trust](https://nexpay.com.au/trust/).

Whichever you write to, the address is [privacy@qualyhq.com](mailto:privacy@qualyhq.com) and it reaches the same team.

Which privacy law protects you does not depend on which company you deal with — it depends on where you are. If you are in Brazil the LGPD applies, if you are in Australia the Privacy Act applies, and if you are in the EU the GDPR applies, whichever Qualy company is handling your data.

Reach us at [privacy@qualyhq.com](mailto:privacy@qualyhq.com) for anything about personal data — that address also reaches our *Encarregado* under the LGPD — or [support@qualyhq.com](mailto:support@qualyhq.com) for everything else.

## What we collect, and why

### If you have a Qualy account

| What | Why | Our legal basis |
| --- | --- | --- |
| Name, email, phone, job title, profile picture | Running your account and letting your team sign in | Performing our contract with you |
| Password credentials and login history | Keeping the account secure | Performing our contract, and our legitimate interest in security |
| Your company's business details, and identity documents for the people who own or control it | Verifying who we are dealing with, as financial regulation requires — and sharing that verification with NexPay so it can run its own checks ([below](#nexpay)) | Complying with a legal obligation, and performing our contract |
| Bank account details for receiving payouts | Paying you the money you collect | Performing our contract |
| Billing contact and payment method | Charging you for your subscription | Performing our contract |
| How you use the product — pages, features, actions | Understanding what works and fixing what does not | Our legitimate interest in improving the product |
| Support conversations, including chat and email | Helping you when you ask | Performing our contract |
| Contact details of the people on your account, and your company's details | Collecting money your company owes us, including through credit bureaus, notaries, collection agencies or a debt purchaser, if it is not paid | Our legitimate interest in recovering debts, and establishing or defending legal claims |
| Your work email, scrambled before it leaves us, and your company's name and website | Showing you Qualy's own ads on LinkedIn ([below](#advertising-on-linkedin)) | Our legitimate interest in marketing to the people we work with — you can opt out |

### If you visit qualyhq.com

| What | Why | Our legal basis |
| --- | --- | --- |
| Pages viewed, referring site, approximate location from IP | Understanding what people look for | Your consent, where required, through the cookie banner |
| Anything you type into a contact or demo form | Replying to you | Taking steps at your request before a contract |

We do not sell personal data, and no advertiser gets to use it for its own purposes.

### NexPay

Every Qualy account comes with a NexPay account, set up automatically, because NexPay is one of the providers Qualy needs to convert currency and pay out across borders. You do not have to use it.

- **What NexPay receives:** your company's business details; the name, email and job title of your account owner; the details of the people who own or control the company — name, date of birth, nationality, address, ID number, and whether they hold a public position — with their identity documents; and your payout bank account.
- **When:** once you complete verification in Qualy, and again whenever that information changes, until NexPay has completed its review.
- **Why:** NexPay is legally required to verify its customers, just like every other payment provider we use.
- **Who is responsible:** NexPay decides for itself how it handles this data and is a controller in its own right. Its [privacy policy](https://nexpay.com.au/privacy-policy/) applies, and you can make requests to it directly.

### Advertising on LinkedIn

We show Qualy's own ads on LinkedIn to people we already know. To do that we send LinkedIn lists of:

- **people:** users of Qualy accounts and subscribers or listeners of our podcast, The Brief. We send only their email address, and we scramble it (a one-way hash) before it leaves us. LinkedIn uses it to find matching members.
- **companies:** our customers and companies we are talking to — the company's name, website and LinkedIn page.

This runs automatically. We never include students, parents or anyone who paid through Qualy.

**To opt out**, unsubscribe from any of our marketing emails or write to [privacy@qualyhq.com](mailto:privacy@qualyhq.com). You are then left out of future lists, and taken off the lists already sent when they are next updated. You can also control ads on LinkedIn in your [LinkedIn advertising settings](https://www.linkedin.com/psettings/advertising).

## If you paid someone through Qualy

If you are a student, a parent, or anyone paying a school or agent, then **that school or agent decides what happens to your data**. Ask them for their privacy policy, and send requests about your data to them.

What we do with it on their behalf:

- We hold your name, contact details, the payment records, and any document that was uploaded about your enrolment.
- We pass what is needed to the payment provider handling your payment — including your **billing address and IP address**, which providers use to check the payment is genuine, and which cross-border payments are legally required to carry. Those providers are listed at [payment processors](/payment-processors.md).
- We may use automated processing to read a document about you — see [below](#how-we-use-artificial-intelligence).
- **If a payment is disputed**, for example through a chargeback, we send the payment provider and your card issuer or bank what they need to see what happened: the contract or enrolment documents, proof of the service, the refund policy you accepted, and messages about the payment. We, or the school or agent, may also contact you about the dispute. We do this on the school's or agent's behalf, as their terms with us instruct. If you owe money for a payment that was missed or reversed, it may be passed to credit bureaus, notaries, collection agencies, lawyers or a company that buys the debt. **When a payment provider takes money from our own account**, for a chargeback, a refund or a payment made by mistake, we also do this for ourselves. We are then responsible for that use of your data, and our legal basis is our legitimate interest in recovering money and in establishing or defending legal claims. The same applies when we check names against sanctions lists and report to the authorities as the law requires.

If you contact us directly we will acknowledge you, tell you who the controller is, and pass the request to them. Where Australian law applies we also have our own obligations to you directly, so we will respond within 30 days and give written reasons if we cannot help — and where the request concerns data we are responsible for ourselves, we answer it.

## How we use artificial intelligence

We use automated processing, including machine learning models, in a few places:

- **Reading documents.** When a letter of offer or similar document is uploaded, a model reads it and pulls out the payment schedule — the amounts, the dates, and what they are for. To do that it processes whatever the document contains, which typically includes a student's name, date of birth, contact details and course, and sometimes an identity document number printed on the page.
- **Matching names** against records already held, so the same person is not created twice.
- **Helping our support team** draft and summarise.

What we commit to:

- **A person reviews the result before it is acted on.** No decision with a legal or similarly significant effect on anyone is made by a model alone. Nothing is used to assess creditworthiness, eligibility or admission.
- **Your data is not used to train models.** For each provider we rely on either a data processing agreement prohibiting it, or a technical setting that excludes providers who train on inputs. The [sub-processor list](/subprocessors.md) records which applies to each, and where neither is yet in place it says so.
- **We are reducing what is sent.** Where a task does not need to know who a person is, identity fields are removed before the request leaves our systems. This runs today on part of the extraction pipeline and is being extended to the rest; the [sub-processor list](/subprocessors.md) states what each provider currently receives.
- **The providers are named.** They are on our [sub-processors](/subprocessors.md) page, with what each receives and where it processes.

Customers who would rather their documents were not processed by a provider outside our own first-party infrastructure can ask us. We will confirm within 10 business days whether we can configure their account that way, and where we cannot we will say what the alternative is.

## Who else sees your data

Everyone we share personal data with is listed, with what they receive and where they process it:

- **[Sub-processors](/subprocessors.md)** — the companies that help us run the platform.
- **[Payment processors](/payment-processors.md)** — the licensed providers that actually move the money.
- **[NexPay](#nexpay)** — our sister company, which receives account verification data as described above.
- **[LinkedIn](#advertising-on-linkedin)** — for our own ads, as described above.

We also share data where the law requires it — with regulators, or in response to a valid legal request — and with professional advisers under confidentiality. When a payment is disputed, we share what is needed to answer it with the payment provider, the card network and the payer's card issuer or bank. When a payment is unpaid, we may share what is needed to collect it with credit bureaus, notaries, collection agencies, lawyers and debt purchasers. To meet anti-money-laundering and sanctions rules, we and payment providers screen names against sanctions lists and may report to the authorities. If Qualy is ever sold or reorganised, data may transfer as part of that, and this policy continues to apply until you are told otherwise.

## Sending data to other countries

Running an international payments platform means data crosses borders.

Where data goes to a country without an adequacy decision, we put an approved safeguard in place — European Commission Standard Contractual Clauses, the ANPD's standard clauses for Brazil, or another mechanism the law allows. The safeguard that applies to each company is shown on the [sub-processors](/subprocessors.md) page.

**For Australia:** we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles, and we remain accountable under section 16C of the Privacy Act 1988 for what they do with it.

## How long we keep it

| What | How long | Why |
| --- | --- | --- |
| Financial and transaction records | **10 years** | Tax and anti-money-laundering law requires seven; we keep ten because that is how long a claim about a payment can be brought. |
| Identity verification records | **10 years** after we stop working with you | The same reason, and financial regulators contemplate this length for these records specifically. |
| Documents uploaded about an enrolment | **10 years** | They are the evidence behind the payment schedule taken from them. |
| The contract record for a closed account | **10 years** after it closes | It is the document a dispute would be argued from. |
| Profile and settings — your picture, preferences, anything not part of the contract | **While the account is open, then 90 days** | Nothing here would be evidence of anything, so it does not earn the longer period. |
| Sign-in history | **24 months** | So we can answer "who accessed this, and when". |
| Support conversations | **10 years** | What we told you is often the whole question in a dispute. |
| Website and product analytics | **14 months** | You consented to this one, and there is no reason to hold it longer. |
| Records of what our AI read | **Until we delete them** | Kept so we can find and fix inaccurate readings. No automatic limit is set yet, and names and other details are not yet removed from them, so we delete them on request: ask us and we will. |
| Backups | **Up to 12 months** | A deleted record survives in a backup until that backup expires, which for our monthly snapshots can be up to a year. We do not read deleted data back, and if we ever restore a backup we re-apply any deletion that was pending. |

**Ten years is not us keeping things indefinitely.** Seven is what tax and
anti-money-laundering law obliges us to keep. The extra three is so that if
someone brings a claim about a payment years later — or a bank asks us to
evidence one — the records still exist. Both European and Brazilian law allow
data to be kept for defending legal claims, and that is the basis we rely on.

**How deletion happens today.** These are the periods we apply. Automatic
deletion is being built; until it is finished we delete on request rather than
on a timer, so if you want something removed, ask us and we will do it and tell
you what we had to keep and why.

Where you are a customer's payer rather than our own customer, **that customer sets how long their data is kept**, and we act on their instruction.

## Your rights

Wherever you are, you can ask us to:

- **See** the personal data we hold about you, and get a copy.
- **Correct** anything wrong.
- **Delete** it, where we are not required to keep it.
- **Limit or object** to how we use it.
- **Take it elsewhere**, in a machine-readable format.
- **Withdraw consent** at any time, where consent is what we relied on.

Ask at [privacy@qualyhq.com](mailto:privacy@qualyhq.com). We reply within 30 days; if a request is complicated we will tell you and may take up to two months more. It is free unless a request is excessive.

**If you are in Brazil**, the LGPD also gives you the right to confirm processing exists, to know who we share data with, to be told what happens if you refuse consent, and to ask for anonymisation or blocking of data that is not being handled lawfully.

### Complaints

If you think we have mishandled your personal data, write to our privacy contact at **[privacy@qualyhq.com](mailto:privacy@qualyhq.com)**. We acknowledge within 5 business days and respond within 30 days.

If you are not satisfied with our response, or we do not respond in time, you can complain to your data protection authority:

- **European Union** — the Estonian Data Protection Inspectorate (*Andmekaitse Inspektsioon*), or the authority in your own country.
- **Australia** — the Office of the Australian Information Commissioner, [oaic.gov.au](https://www.oaic.gov.au), 1300 363 992.
- **Brazil** — the *Autoridade Nacional de Proteção de Dados* (ANPD). Our *encarregado* under Article 41 of the LGPD is Raphael Arias, reachable at the same privacy address, and Qualy Services Brazil LTDA is our representative in Brazil.

## Keeping data safe

Personal data is encrypted in transit and at rest. Bank account details get a second layer of encryption, field by field, with a separate key for every customer, so even direct database access does not reveal them. Every customer's data lives in its own database. Access is limited, requires two-factor authentication, and is logged.

Our [trust centre](/trust.md) describes this in more detail. No system is perfect, and if a breach affects you we will tell you as the law requires.

## Cookies

We use cookies that are necessary for the site to work, and — only with your consent — cookies that help us understand how the site is used. You can change your mind at any time from the cookie settings link in the footer.

## Changes to this policy

We will post any change here and update the date at the top. If a change materially affects your rights, we will give notice before it takes effect. Customers with a contract also get the notice period set out in our [Terms](/terms-and-conditions.md).

## Contact

[support@qualyhq.com](mailto:support@qualyhq.com), or write to Qualy Services OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia.

Everything else — our terms, the data processing agreement and the disclosure lists — is at [qualyhq.com/trust](/trust.md).

## More on Qualy

**Industries**

- [For schools](/international-education/for-schools.md) — For international education schools
- [For agents](/international-education/for-education-agents.md) — For international education agents

**Support**

- [Training](/training.md)
- [System status](https://qualyhq.statuspage.io/) — Qualy system status
- [Product updates](https://changelog.qualyhq.com) — As we work on Qualy, here we spotlight what we’ve learned and updated across our products
- [Contact](/contact-us.md)

**Product**

- [Demo](/demo.md)
- [Enterprise](/enterprise.md)
- [Testimonials](/testimonials.md) — Learn what some customers have to say about Qualy
- [About](/about.md) — Learn about Qualy's mission and values
- [Blog](/blog) — International education payments blog by Qualy
- [Trust center](/trust.md)
- [API](/api.md) — Qualy API for international education payments
- [Zapier](/integrations/zapier.md) — Connect Qualy to 7,000+ apps with Zapier
- [NexPay](/nexpay.md) — Qualy + NexPay — automate everything around the payment

**Legal**

- [General terms](/terms-and-conditions.md)
- [Payer terms](/terms-for-payers.md)
- [Privacy policy](/privacy-policy.md)
- [Service levels](/sla.md)
- [Accessibility](/accessibility.md)
- [Legal & compliance](/trust.md)