If we wrote to you first, this is what we hold and why.

The controller is WIL TRADE sp. z o.o., and one address reaches it.

The controller of your personal data is WIL TRADE sp. z o.o., ul. Szosa Ełcka 13, 15-690 Białystok, Poland — the company set out in full above. Quantika Commerce is its trading name, not a separate company.

Write to vitali@quantika.org, or reply to the message we sent you. Our email to you came from quantikahq.com: that is a domain of ours used only for sending first messages, so that the reputation of that sending does not fall on the address our clients and invoices use. Its web address redirects to quantika.org, and a reply to the mailbox reaches the same person who answers vitali@quantika.org. Our Facebook message came from the personal profile of Vitali Marychenka, who runs the company; the business Page it names is Quantika Profit Analytics, and the company behind it is WIL TRADE sp. z o.o.

We have appointed no representative under Article 27. Under the EU text none is needed, because we are established in the Union. Whether one is needed in the United Kingdom is an open question, listed at the end of this page; we assert neither answer.

Source: UK GDPR Article 14(1)(a) — "the identity and the contact details of the controller and, where applicable, of the controller's representative" (legislation.gov.uk/eur/2016/679/article/14); Regulation (EU) 2016/679, Article 14(1)(a) (legislation.gov.uk/eur/2016/679/article/14/adopted). Checked 11.09.2026.

There is no data protection officer, so there is no separate address to give you.

We have not appointed a data protection officer. Article 14(1)(b) asks for the officer's contact details "where applicable", and here they are not, because the post does not exist. Questions about your data go to vitali@quantika.org and are answered by the person who runs the company.

Whether the company is obliged to appoint an officer has not been assessed; the privacy notice lists it among its open points.

Source: UK GDPR and Regulation (EU) 2016/679, Article 14(1)(b) — legislation.gov.uk/eur/2016/679/article/14.

Three purposes, all on one ground: our legitimate interest.

• Deciding whom to write to. We look at online stores from the outside — which platform they run on, whether they advertise, whether the business is a company — and read the store itself for a problem that costs its owner money. Where the store names the person behind it, that name is part of what we look at.
• Writing to you about what we found. By email, one message and at most three short follow-ups a few days apart, then we stop. On Facebook, one message and at most one follow-up. The message offers our free store check; it is direct marketing, and we call it that.
• Keeping our do-not-contact list, so that an objection, once made, holds.

The legal basis for all three is Article 6(1)(f): processing necessary for our legitimate interests, which are set out in words under Article 14(2)(b) below. We do not rely on your consent for any of it.

We write only to companies — limited companies, PLCs and LLPs. The rules on unsolicited electronic marketing in the United Kingdom treat sole traders and ordinary partnerships like private individuals, and we do not write to them without consent. We check the business's form at Companies House before we write. If you trade on your own account and we wrote to you all the same, that was a mistake on our side: tell us, and we delete you.

We use your data for these purposes and no others. We do not sell it, rent it, or add you to any list but our own do-not-contact list. If you reply, what happens to the conversation from then on is the subject of the privacy notice.

Sources: UK GDPR Article 14(1)(c) and Article 6(1)(f) (legislation.gov.uk/eur/2016/679/article/6); the UK text now also names, in Article 6(11)(a), "processing that is necessary for the purposes of direct marketing" as an example of processing that may be necessary for a legitimate interest; recital 47 of Regulation (EU) 2016/679: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." Checked 11.09.2026. On who may be sent electronic marketing without consent: ICO, business-to-business marketing.

A name, a business address, a role, and facts about a business.

• Your name, where the store, its Facebook Page or the company register gives it.
• The business contact we wrote to — an email address published on the store's own site, or the business's Facebook Page — and, for a Facebook message, the name of the profile or Page we wrote to.
• Your role, as the source shows it: owner, director, or the person the store names as its contact.
• Facts about the business that anyone can see: the store's address on the web, other stores that appear to belong to the same owner, how many adverts its Facebook Page has run in the Meta Ad Library, the company's legal form, number and status at Companies House, and what we found when we looked at the store — prices, speed, broken addresses, missing policies.
• What we sent you, and when.

We do not hold your private address, telephone number, date of birth, photographs or anything about your private life, and we do not look for them. Nothing we hold falls in the special categories of Article 9 or concerns criminal offences.

Source: UK GDPR and Regulation (EU) 2016/679, Article 14(1)(d) — legislation.gov.uk/eur/2016/679/article/14.

The services a message to you passes through, named.

• Google, which provides the mailbox we write from. Our email to you is sent from a Google Workspace mailbox on quantikahq.com, and your reply comes to rest there. Google therefore holds the letter, your address and anything you write back.
• Smartlead, the sending service connected to that mailbox. It schedules letters and follow-ups and sends them from the mailbox at a steady pace. We connected it on 8 September 2026 and are on its trial; so far it has only warmed the mailbox up, and no message to anyone we found has gone through it. Smartlead is 521 Products Pty Ltd, an Australian company; it keeps data with Amazon Web Services in Sydney, and its support staff in India may see it.
• Meta, for a Facebook message. A message on Facebook travels and is stored on Meta's service, which Meta runs under its own terms and its own privacy policy. What Meta does with it is Meta's to answer for, not ours.
• Cloudflare, Inc., which serves this page, so it sees your request for it, and which is the registrar and DNS operator for both our domains — that tells other servers where our mail belongs without carrying what a message contains. If you write to vitali@quantika.org rather than replying to our email, the message passes through Cloudflare Email Routing on its way to us, as the privacy notice describes.
• Anthropic, for our first list and our Meta Ad Library research. We do our research with the help of an AI assistant, Claude, made by Anthropic. When our first list was built, on 8 September 2026, some of the store contact addresses on it appeared in that assistant's working session, so Anthropic received them. The same happened when the assistant researched the stores we found on the Meta Ad Library on 9 and 10 September 2026: store contact addresses appeared in those sessions too, so Anthropic received them. Since 11 September 2026 our rule is that contact lists are handled by scripts on our own computer, and no name or email address is put into an AI service.

A contact list with email addresses is kept only as files on the company's own computer, and only when we build one for a send; there is no CRM and no server of ours holding one. At the date of this notice we hold no such list. Our research on the Meta Ad Library keeps shop domains and advert-page numbers only. We pass your details to nobody beyond those named above. Before any other service touches your address it is named here first — the next one planned is an address-checking service, listed at the end of this page.

Source: UK GDPR and Regulation (EU) 2016/679, Article 14(1)(e) — "the recipients or categories of recipients of the personal data, if any" (legislation.gov.uk/eur/2016/679/article/14). Which mailbox we send from and where the domain names are run is our own statement about our own arrangements, as of 11.09.2026.

We run no server abroad. The services named above reach the United States and Australia.

When we build a contact list for a send, it is kept as files on the company's own computer, and we run no server abroad for it; at the date of this notice we hold none. The services named above are another matter, so here is each one's position.

• Google and Cloudflare — United States. For the EU text, Commission Implementing Decision (EU) 2023/1795 finds an adequate level of protection for transfers to organisations on the Data Privacy Framework List; for the UK text, the UK's own regulations of 2023 do the same for organisations on that list that take part in its UK Extension. On 11 September 2026 Google LLC and Cloudflare, Inc. were both recorded as active in the EU-U.S. framework and in the UK Extension. The list records companies, not transfers, so it does not say which entity a particular message runs through.
• Smartlead — Australia, with support in India. Its data processing addendum relies on the EU standard contractual clauses and the UK Addendum to them; a copy is at smartlead.ai/dpa. That addendum takes effect only when a paid subscription is bought, and we are still on the trial. So our rule is that no address of anyone we found goes to Smartlead until we have subscribed and the addendum is in force.
• Anthropic — United States. On what terms, and under what safeguard, it received the addresses from our first list and from our Meta Ad Library research we have not established; it is listed at the end of this page.
• Meta. For a Facebook message, Meta's own policy governs, and we make no statement for it.

Sources: UK GDPR Article 14(1)(f), which refers to "relevant regulations under Article 45A" (legislation.gov.uk/eur/2016/679/article/14); Regulation (EU) 2016/679, Article 14(1)(f); Commission Implementing Decision (EU) 2023/1795 (eur-lex.europa.eu, CELEX 32023D1795); the Data Protection (Adequacy) (United States of America) Regulations 2023, regulation 3, for a transfer "to a person in the United States of America who is indicated on the Data Privacy Framework List as participating in the UK Extension to the EU-US Data Privacy Framework" (legislation.gov.uk/uksi/2023/1028/regulation/3); the Data Privacy Framework List (dataprivacyframework.gov/list), checked 11.09.2026. Smartlead: "We are 521 Products Pty Ltd, an Australian registered business" and "Your personal data is processed in our hosted service provider which is Amazon Web Services located in Sydney, Australia. Your data does not leave Australia except as necessary to provide services to Clients, or to our staff for technical support in India" (smartlead.ai/privacy-policy); its addendum, §6 — "the Approved EU SCCs and the UK Addendum" — and "THIS DPA IS ACCEPTED BY THE USER BY VIRTUE OF THE USER ACCEPTING THE TERMS UPON BUYING A SUBCRIPTION FROM SMARTLEAD" (smartlead.ai/dpa). Both checked 11.09.2026.

Three clocks, all short. They are our rule, not a number from any law.

No law gives a period for this. The Regulation asks us to tell you the period, or the criteria for it, and to keep data no longer than we need it. These are the periods we set ourselves, and why:

• Found, but not written to within one month: deleted. If we gather your details and have not written to you a month later — the store failed one of our checks, or we did not get to it — we delete them rather than keep them for later. One month is the longest the Regulation allows before you must be told, even when the first message is still to come, so we would rather delete than hold details about someone who has not heard from us.
• Written to, no reply: deleted 90 days after our last message. A reply that comes weeks later is common in business, and three months covers it. After that we delete your name, the address and our notes on the store.
• Objected: the address and the date, kept as long as we send messages at all. Only that — no name, no notes — and only to make sure we never write to you again. If you asked us to stop writing to the business, the store's domain as well.

A Facebook conversation follows the same clocks for our copy of it: we delete it from our inbox when the 90 days run out. Your own copy is yours, and Meta keeps the message for as long as its own terms say. If you reply, the conversation becomes an enquiry, and from then on the periods in the privacy notice apply.

Source: UK GDPR and Regulation (EU) 2016/679, Article 14(2)(a) — "the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period" (legislation.gov.uk/eur/2016/679/article/14). The one-month limit is Article 14(3)(a). The periods themselves are our decision of 11.09.2026, recorded in our written legitimate interests assessment.

Our interest is finding businesses we can help and telling them. Yours is not being bothered.

Article 6(1)(f) is our ground, so we have to say what the interest actually is. It is a commercial one and we will not dress it up: we are a small company, we check stores for free and sell the builds that follow, and writing to a store whose problem we have already found is how we find clients. There is a second interest beside ours, the business's own — hearing about a problem in its store that costs it money, which its owner may not have seen.

We weighed that against yours in a written assessment, dated 11 September 2026, following the three tests the UK regulator sets: is the purpose legitimate, is the processing necessary for it, and do your interests override it. What keeps the balance on our side is narrow: we write to a business address about that business, once and briefly, with a way out in the first message; we hold no private data; and we delete early. If you want to read the assessment, ask, and we will send it.

Source: UK GDPR and Regulation (EU) 2016/679, Article 14(2)(b) — "where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party" (legislation.gov.uk/eur/2016/679/article/14). The three-part test — "Purpose test: Are you pursuing a legitimate interest? Necessity test: Is your use of personal information necessary for that purpose? Balancing test: Do the person's interests override the legitimate interest?" — ICO, legitimate interests, checked 11.09.2026.

Access, correction, deletion, restriction, objection. One address, no form, no fee.

You may ask us for a copy of what we hold about you, for it to be corrected, for it to be deleted, and for our use of it to be restricted. You may object, as set out separately near the top of this page. Write to vitali@quantika.org or reply to our message, and say which you want. We charge nothing and ask only for what we need to find your data.

Article 14(2)(c) also lists the right to data portability. It applies only to data you provided to us yourself, and only where we rely on your consent or on a contract with you. Neither is the case here, so it does not arise.

We answer without undue delay and at the latest within one month. If a request is complex, we tell you within that month that we need longer — both texts allow up to two further months — and why.

In practice what we hold about you is one line in a file, a few notes about the store and one or a few messages, so most of these requests come down to reading them back to you or deleting them.

Sources: UK GDPR and Regulation (EU) 2016/679, Article 14(2)(c) — legislation.gov.uk/eur/2016/679/article/14; Article 20(1), portability only for data the person "has provided to a controller" where "the processing is based on consent … or on a contract" (legislation.gov.uk/eur/2016/679/article/20); the time limit — UK GDPR Article 12(3) read with Article 12A, one month and two further months by notice (legislation.gov.uk/eur/2016/679/article/12A.), and Regulation (EU) 2016/679, Article 12(3), "within one month of receipt of the request" (legislation.gov.uk/eur/2016/679/article/12/adopted). Checked 11.09.2026.

We did not ask for your consent, so there is nothing to withdraw.

Article 14(2)(d) applies where processing is based on consent. None of ours is: the ground for everything on this page is our legitimate interest, which is why the right that matters here is the right to object, and why it has a section of its own near the top of this page rather than a line at the bottom.

Source: UK GDPR and Regulation (EU) 2016/679, Article 14(2)(d) — legislation.gov.uk/eur/2016/679/article/14.

Complain to us, to the UK regulator, or to the Polish one. You need not start with us.

To us. Write to vitali@quantika.org with the word "complaint" in the subject, or by post to WIL TRADE sp. z o.o., ul. Szosa Ełcka 13, 15-690 Białystok, Poland. The UK text gives you this right in terms, and requires us to acknowledge a complaint within 30 days of receiving it; we answer mail within one working day.

To the Information Commissioner, in the United Kingdom. If you think we have handled your data wrongly you may complain to the Commissioner, without complaining to us first.

Authority

Information Commissioner's Office

Address

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom

Helpline

0303 123 1113

Online

ico.org.uk/make-a-complaint

The Commissioner's own guidance recommends raising a concern with the organisation first, and we would rather you did. It is a recommendation, not a condition.

To the Polish authority. Our seat is in Poland, so the authority competent for us under the EU text is the President of the Personal Data Protection Office, Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, kancelaria@uodo.gov.pl. The EU text lets you complain in particular where you live, where you work or where the infringement happened.

Sources: UK GDPR Article 14(2)(da) and (e), which refer to sections 164A and 165 of the Data Protection Act 2018; section 164A(3): "the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received" (legislation.gov.uk/ukpga/2018/12/section/164A); section 165(2) (legislation.gov.uk/ukpga/2018/12/section/165). Regulation (EU) 2016/679, Article 14(2)(e) and Article 77(1) (legislation.gov.uk/eur/2016/679/article/77/adopted). Checked 11.09.2026. The Commissioner's address and helpline as the ICO publishes them (ico.org.uk, controller's contact details), and its advice to raise a concern with the organisation first (ico.org.uk, check if you can complain), both checked 11.09.2026. The Polish authority's address as published by it, checked 07.09.2026 and sourced in the privacy notice.

Public sources only, and nothing bought.

All of it came from sources anyone can open, which is what Article 14(2)(f) asks us to confirm:

• Public lists of UK businesses — for your store's name and web address only. The exhibitor catalogues of UK trade shows (Spring Fair, Autumn Fair, Top Drawer, Glee, Home & Gift, Pure London); the Made in Britain members' register; published roundups of certified B Corps; the Small Business Saturday list; the shortlists of the UK eCommerce Awards and the eCommerce Awards London; the client work that e-commerce agencies publish; the episode pages of e-commerce podcasts and the speaker list of a UK e-commerce conference; and articles listing British stores on Shopify. These lists name businesses, not people: we took no name and no email address from them.
• Your store's own website — its contact page, its footer and its legal pages, where a store publishes the address customers and authorities are to write to. The email address we wrote to comes from there.
• The Meta Ad Library, and your business's Facebook Page. The library is Meta's public archive of adverts; it shows which Page runs which adverts and how many. The Page's own transparency section sometimes names the business behind it.
• Companies House, the UK register of companies — to check that the business is a company, and its number and status.

For every contact gathered so far we bought no list and used no data broker. If we ever use a paid database of stores, it will be named here before anything taken from it is used to write to anyone.

Source: UK GDPR and Regulation (EU) 2016/679, Article 14(2)(f) — "from which source the personal data originate, and if applicable, whether it came from publicly accessible sources" (legislation.gov.uk/eur/2016/679/article/14). The public sources: facebook.com/ads/library; Companies House.

None. A person reads your store and decides whether to write.

We use scripts to sort stores by public facts — which platform a store runs on, how many adverts its Page has run — so that a person has fewer to read. The decision to write to you is taken by a person who has looked at your store. Nothing we do produces a legal effect for you or anything similarly significant: the most it produces is a message you can ignore.

If we ever introduce such a decision, this section will set out the logic, what it means for you and where it leads, before it is switched on.

Sources: UK GDPR Article 14(2)(g), read with Articles 22A and 22C, which define a decision based solely on automated processing as one with "no meaningful human involvement" (legislation.gov.uk/eur/2016/679/article/22A); Regulation (EU) 2016/679, Article 14(2)(g) and Article 22(1) (legislation.gov.uk/eur/2016/679/article/22/adopted). Checked 11.09.2026.

In the first message, and never later than a month after we find you.

The Regulation sets two deadlines for this information: at the latest when we first write to you, and in any case within one month of our obtaining your details. Our first message carries the short version — who we are, why we wrote, where your address came from and how to stop us — and the address of this page, printed as plain text rather than as a link.

People whose details we gather but do not write to are not written to just to be told: that would be the unsolicited message we decided not to send. Their details are deleted within the month, as set out under Article 14(2)(a), and this page is where the information stays published in the meantime.

Source: UK GDPR and Regulation (EU) 2016/679, Article 14(3)(a) — "within a reasonable period after obtaining the personal data, but at the latest within one month" — and 14(3)(b) — "if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject" (legislation.gov.uk/eur/2016/679/article/14). That the one-month limit still holds when the first message comes later: ICO, "Bear in mind that the one month time limit still applies in these situations" (ico.org.uk, when should we provide privacy information). Checked 11.09.2026.