Effective Date: September 8, 2026
Last Updated: September 15, 2026

At Consul10C OÜ (“Consul10C”, “we”, “us”, or “our”), we are committed to protecting the privacy, confidentiality, and security of our website visitors, consulting clients, and Microsoft Dynamics 365 Business Central extension subscribers.

This Privacy Policy explains how we collect, process, store, and safeguard your personal data in accordance with the European Union General Data Protection Regulation (EU) 2016/679 (GDPR), the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus), and applicable global data privacy regulations.

1. Data Controller Information

The legal entity responsible for the processing of your personal data is:

• Company Name: Consul10C OÜ
• Registry Code: 17594251 (Estonian Business Register / e-Äriregister)
• EUID: EEARIREG.17594251
• VAT Status: Not currently registered for VAT / Not liable (käibemaksukohustuslane puudub)
• Registered Address: Pärnu mnt 139b, Kesklinna linnaosa, 11317 Tallinn, Republic of Estonia
• Email: privacy@consul10c.com / info@consul10c.com

2. Personal Data We Collect

We adhere strictly to the GDPR principle of data minimization. We only collect personal data necessary to provide our services:

2.1 Website Visitors & Contact Inquiries

• Contact Information: Name, corporate email address, phone number, company name, and message content when submitting contact or consultation forms.
• Security & Anti-Bot Data: IP address, user-agent string, and Cloudflare Turnstile token for threat mitigation and bot detection.

2.2 Client Portal & Extension Subscribers (10c Central Banks FX)

• Account Credentials: Corporate email address and securely hashed passwords (managed via Supabase Auth).
• Licensing & Telemetry Metadata: Microsoft Entra Tenant ID (Azure AD GUID), Business Central company name, active subscription tier, license key, and timestamp of validation checks.
• Billing Information: Payment receipts, billing country, VAT number (for reverse-charge validation), and subscription status. (Note: Complete credit card numbers and banking details are processed directly by our PCI-DSS Level 1 payment processor, Airwallex, and are never stored on our servers).

3. Legal Bases for Processing (GDPR Article 6)

We process your personal data under the following lawful bases:

1. Performance of a Contract (Art. 6(1)(b)): To provision your 10c Central Banks FX subscription, authenticate your Client Portal login, validate extension licenses, and deliver agreed Business Central services.
2. Legitimate Interests (Art. 6(1)(f)): To prevent software piracy, protect our web infrastructure against DDoS attacks, and provide customer support.
3. Compliance with Legal Obligations (Art. 6(1)(c)): To fulfill statutory accounting, corporate taxation, and invoice retention mandates under Estonian and European commercial law.
4. Consent (Art. 6(1)(a)): For optional communications, where explicit consent has been granted.

4. Subprocessors and Third-Party Service Providers

We engage a selected group of trusted third-party service providers (“Subprocessors”) to assist in delivering our cloud platform. All subprocessors are bound by stringent Data Processing Agreements (DPAs) and appropriate cross-border safeguards:

5. International Data Transfers

Whenever personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through:

• Adequacy Decisions granted by the European Commission; or
• Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to GDPR Article 46.

6. Data Retention Schedule

We retain personal data only for as long as necessary to satisfy the purposes for which it was collected:

• Account & Subscription Data: Retained for the active duration of your subscription plus 7 years following contract termination to comply with Estonian statutory accounting and commercial record-keeping requirements.
• Free Trial Records: Retained for 12 months following trial expiration.
• General Inquiries: Retained for 24 months after the last interaction.

7. Your GDPR Data Subject Rights

Under Articles 15 through 22 of the GDPR, you have the right to:

1. Right of Access (Art. 15): Request confirmation and a copy of the personal data we hold about you.
2. Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
3. Right to Erasure / “Right to be Forgotten” (Art. 17): Request deletion of your personal data when no longer legally required.
4. Right to Restriction of Processing (Art. 18): Request that we restrict processing of your data under specific circumstances.
5. Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON).
6. Right to Object (Art. 21): Object to processing based on legitimate interests.
7. Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of your rights, please submit a written request to privacy@consul10c.com. We respond to all verified requests within thirty (30) days.

8. Supervisory Authority

If you believe our processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with the lead supervisory authority:

• Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
• Address: Tatari 39, 10134 Tallinn, Estonia
• Website: https://www.aki.ee/en
• Email: info@aki.ee

9. Contact Us

For any privacy-related questions or data protection requests:

Consul10C OÜ
Attn: Data Protection
Pärnu mnt 139b, Kesklinna linnaosa, 11317 Tallinn, Estonia
Email: privacy@consul10c.com