Privacy Policy
Effective Date: 05 June 2026 · Version 2.0 · Review Date: 05 June 2027
1. Who We Are
This Privacy Policy explains how Mass Quantitative Limited ("we", "us", "our") collects, uses, and protects your personal data when you visit spadamq.com or spadamq.eu (together, the "Website") or register for early access to Spada.
This policy covers the Website in its current form as a pre-launch information and registration site. When the Spada platform launches, this policy will be updated (Version 3.0) to cover additional processing activities including user accounts, subscriptions, and platform features.
| Controller | Mass Quantitative Limited |
| Registered in Ireland | CRO: 813902 |
| Privacy Contact | info@massquantitative.com |
| Supervisory Authority | Data Protection Commission (DPC), Ireland, www.dataprotection.ie |
Mass Quantitative Limited maintains Records of Processing Activities (RoPA) in accordance with GDPR Article 30. These records are held internally and are available to the Data Protection Commission upon request. There is no registration requirement for data controllers in Ireland under the GDPR.
2. What Personal Data We Collect
On this Website, we collect only the following personal data:
| Category | Examples | Source |
|---|---|---|
| Identity & Contact | Email address; name (optional) | Provided by you during registration |
| Registration Questionnaire | Platform preferences; experience with prediction markets; other tools used; willingness to pay | Provided voluntarily, all fields optional |
| Technical Data | IP address (hashed); browser type; operating system; device type; time zone | Collected automatically on site visit |
| Cookie & Consent Data | Cookie preferences; consent timestamp; session identifiers | Collected automatically, see Cookie Policy |
We do not collect special category data (health, financial status, political opinions, biometric data, etc.) through this Website. The questionnaire does not ask about income, financial status, or professional financial role. We do not knowingly collect personal data from persons under 18 years of age.
3. Legal Basis for Processing
| Processing Activity | Legal Basis (GDPR Art. 6) | Details |
|---|---|---|
| Early access registration | Art. 6(1)(b): Contract / pre-contractual steps; or Art. 6(1)(a): Consent | Processing your email to place you on the early access list and send a confirmation |
| Marketing emails (launch news, updates) | Art. 6(1)(a): Consent | Only where you have separately and explicitly opted in. Withdraw at any time via unsubscribe link. |
| Questionnaire responses | Art. 6(1)(a): Consent | Used in aggregate for product research. Withdrawal: email info@massquantitative.com |
| Analytics (with consent) | Art. 6(1)(a): Consent | Only where analytics cookies accepted via Cookie Banner. Withdraw via cookie settings. |
| Security and fraud prevention | Art. 6(1)(f): Legitimate Interest | Protecting the Website. LI assessment: proportionate and not overridden by data subjects' interests. |
| Server logs and technical data | Art. 6(1)(f): Legitimate Interest | Maintaining security and performance. Retained maximum 90 days. |
4. How We Use Your Data
- To place you on the Spada early access list and send a registration confirmation
- To notify you when Spada launches (where you have consented to launch communications)
- To send product updates and news about Spada (marketing, explicit consent only)
- To analyse questionnaire responses in aggregate to inform product development; responses are never shared individually
- To understand how visitors use the Website and improve its content (analytics, consent only)
- To maintain the security and integrity of the Website
- To comply with our legal and regulatory obligations
We do not use automated decision-making or profiling that produces legal or similarly significant effects. We do not sell your personal data. We do not share it with third parties for their own marketing.
5. Data Sharing and Processors
We share personal data with the following processors who act on our instructions under Data Processing Agreements. Additional processors will be disclosed in Version 3.0 when the platform launches.
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase Inc. | Database: stores registration data and consent records | EU: Frankfurt, Germany | EEA data residency. DPA executed. GDPR Art. 28 compliant. |
| Vercel Inc. | Website hosting and CDN: processes IP addresses and request logs | US (global CDN) | Standard Contractual Clauses (EU Commission Decision C(2021)914). DPA executed. |
| Resend Inc. | Transactional email: registration confirmation and launch notifications | US | Standard Contractual Clauses. DPA executed prior to first email. |
We do not transfer personal data outside the EEA except as described above, and only where Standard Contractual Clauses or other GDPR Chapter V safeguards are in place.
6. Data Retention
| Data Type | Retention Period | Basis |
|---|---|---|
| Registration email address | 24 months from registration, or until unsubscribe, whichever sooner | Consent; we will seek re-confirmation or delete at 24 months |
| Questionnaire responses | 24 months from registration, or until deletion requested | Consent |
| Server / technical logs | 90 days maximum | Legitimate interest (security) |
| Analytics data (with consent) | Maximum 26 months | Consent |
| Consent records (cookie + marketing) | 5 years, to demonstrate compliance | Legal obligation (GDPR Art. 7(1)) |
7. Your Rights
Under GDPR you have the following rights. To exercise any right, contact info@massquantitative.com. We respond within 30 days (extendable by 60 days for complex requests, with notice):
- Right of Access (Art. 15): Request a copy of your personal data and how we process it
- Right to Rectification (Art. 16): Request correction of inaccurate data
- Right to Erasure (Art. 17): Request deletion where we no longer have a lawful basis to retain
- Right to Restriction (Art. 18): Request limits on processing in certain circumstances
- Right to Data Portability (Art. 20): Request your data in machine-readable format (consent / contract basis)
- Right to Object (Art. 21): Object to processing based on legitimate interests
- Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time via the unsubscribe link or by contacting us. Withdrawal does not affect the lawfulness of prior processing.
- Right to Lodge a Complaint: Contact the Data Protection Commission at www.dataprotection.ie, 21–25 Canal Road, Dublin 6, D06 W5X2, Ireland.
8. Security
- Encryption of data in transit (TLS 1.2/1.3) and at rest (AES-256) on Supabase
- Multi-factor authentication on all administrative access
- Access to personal data restricted to authorised personnel only
- IP addresses stored as hashed values only (SHA-256)
- Data Processing Agreements in place with all processors
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the DPC within 72 hours and, where required, notify affected individuals without undue delay.
9. Cookies
We use cookies on the Website. See our Cookie Policy for full details. Consent to non-essential cookies is collected via the Cookie Banner before any such cookies are placed.
10. Children
The Website is not directed at persons under 18. We do not knowingly collect data from minors. Contact info@massquantitative.com if you believe we hold data about a minor.
11. Changes to This Policy
We will update this policy when processing activities change materially, in particular at platform launch (Version 3.0). We will notify registered users of material changes by email. The Effective Date at the top of this policy reflects the most recent version.
12. Contact
Privacy enquiries: info@massquantitative.com
Post: Privacy Officer, Mass Quantitative Limited
Data Protection Commission: www.dataprotection.ie