Privacy Policy

Last updated: 24 July 2026
Effective date: 24 July 2026

1. Scope of this Privacy Policy

This Privacy Policy explains how Qantum Themes S.L. collects, uses, stores and shares personal data when you visit or use websites, customer areas, ecommerce services and support systems operated under the Pro Radio and Qantum Themes brands.

This Policy applies, where relevant, to:

• pro.radio and its subdomains;
• shop.pro.radio and the WHMCS customer area;
• academy.pro.radio;
• ai.pro.radio and Pro Radio Sidekick AI;
• Qantum Themes and Pro Radio contact, support, newsletter and commercial communications;
• other websites or services that link directly to this Policy.

Some products and services have additional privacy terms. Pro Radio Sidekick AI is also governed by its dedicated Terms of Service, Privacy Notice, Data Processing Terms and AI Transparency Notice. Where that notice contains more specific provisions for the AI Service, those provisions apply to that processing.

2. Data controller and contact details

The controller responsible for the processing described in this Policy is:

Qantum Themes S.L.
VAT number: ESB02979078
Operational and contact address:
C. Juan Bautista Labaña, 4, loc. 2
50011 Zaragoza
Spain
Email: info@qantumthemes.com
Websites: qantumthemes.com and pro.radio

This is the business address used for operational correspondence and customer documentation. Privacy requests may be sent by email or post to the contact details above.

3. Personal data we collect

The categories of data processed depend on how you interact with us.

3.1 Website and device data

• IP address;
• browser, device and operating-system information;
• date, time and duration of access;
• requested pages and referring URLs;
• cookie and consent preferences;
• security, firewall and anti-abuse events;
• approximate location derived from the IP address;
• analytics and advertising identifiers, where consent has been provided.

3.2 Account, ecommerce and billing data

When you register, purchase a product, subscribe to a service or use the WHMCS customer area, we may process:

• name and surname;
• company or organisation name;
• billing and postal address;
• email address and telephone number, where supplied;
• country and tax jurisdiction;
• VAT or tax identification number;
• account username, password hash and authentication information;
• orders, subscriptions, licences, domains and service information;
• invoices, credit notes and accounting records;
• payment method, payment status, transaction reference and limited payment metadata;
• login history, IP addresses and security events;
• cart, checkout and purchase events.

Full payment-card details are normally collected and processed directly by the selected payment provider. We do not intentionally store complete card numbers or card-security codes in WHMCS.

3.3 Support, contact and communication data

When you contact us, open a support ticket, use live chat or reply to an email, we may process:

• your name, email address and account information;
• the contents of your message, ticket or chat;
• attachments and screenshots you choose to provide;
• technical information about your website, hosting, WordPress installation, licence or service;
• records of our replies and actions;
• IP address, browser and device information associated with the communication.

Please do not send passwords, private keys, full payment-card data or unnecessary sensitive personal data through tickets, email or chat.

3.4 Newsletter and marketing data

When you subscribe to a newsletter or agree to receive marketing communications, we may process:

• name and email address;
• subscription source, date, time and IP address;
• double opt-in confirmation;
• language, interests or customer status;
• email delivery, opening and link-click information, where permitted;
• unsubscribe and suppression-list information.

3.5 Comments, reviews and public submissions

If comments, testimonials, reviews or other public-submission functions are enabled, we may process and publish the name or pseudonym and content supplied by the user. We may also retain the associated IP address and timestamp for moderation, security and legal defence.

3.6 Sidekick AI data

When Pro Radio Sidekick AI is used, the service may process generation input, generated output, technical information and editorial-review records. Detailed categories, purposes, hosting locations and retention periods are described in the dedicated Sidekick AI privacy and transparency notice.

4. How we collect personal data

We collect data:

• directly from you when you register, order, pay, contact us, subscribe or submit information;
• automatically through websites, server logs, cookies, pixels and similar technologies;
• from payment providers when they confirm or reject a transaction;
• from advertising and analytics providers when they report visits, conversions or campaign performance;
• from marketplaces or commercial partners where you purchase or register a product through them;
• from publicly available sources when required to verify business or tax information.

5. Purposes and legal bases

5.1 Providing products and services

We process account, order, licence, subscription, support and payment-status data to provide purchased products and services, deliver downloads, manage licences, supply hosting, provide support and administer customer accounts.

Legal basis: performance of a contract or steps requested before entering into a contract, Article 6(1)(b) GDPR.

5.2 Billing, tax and accounting

We process invoices, company information, VAT data, transaction records and related documentation to comply with accounting, tax and commercial-law obligations.

Legal basis: compliance with legal obligations, Article 6(1)(c) GDPR.

5.3 Security, fraud prevention and service protection

We process IP addresses, login records, server logs, device information, transaction signals and other technical data to prevent fraud, spam, abuse, unauthorised access, attacks and licence misuse.

Legal basis: our legitimate interests in protecting customers, services, networks, software and legal rights, Article 6(1)(f) GDPR.

5.4 Support and communications

We process contact details and communication history to answer enquiries, provide technical support, resolve disputes and maintain records of customer instructions.

Legal basis: performance of a contract, pre-contractual steps and our legitimate interest in managing customer relationships, Articles 6(1)(b) and 6(1)(f) GDPR.

5.5 Analytics and service improvement

We use analytics to understand website use, measure performance, improve navigation, diagnose problems and evaluate commercial campaigns.

Legal basis: consent for non-essential cookies and tracking technologies where required, Article 6(1)(a) GDPR; limited strictly necessary security and aggregate operational analytics may rely on legitimate interests, Article 6(1)(f) GDPR.

5.6 Advertising and conversion measurement

With consent where required, we use advertising and conversion technologies to measure ad performance, attribute purchases, create remarketing audiences and avoid irrelevant advertising.

Legal basis: consent, Article 6(1)(a) GDPR.

5.7 Newsletters and direct marketing

We send newsletters and promotional communications where you have provided consent. Where Spanish law permits, we may also contact an existing customer using contact details obtained lawfully during a previous contractual relationship, but only about our own products or services that are similar to those previously purchased.

Existing customers are given a simple and free opportunity to object when their contact details are collected and in every subsequent promotional communication. Every promotional email includes a valid unsubscribe method.

Legal basis: consent, Article 6(1)(a) GDPR; or legitimate interests, Article 6(1)(f) GDPR, together with the conditions established by Article 21(2) of the Spanish Law 34/2002 on Information Society Services and Electronic Commerce.

5.8 Legal claims and compliance

We may process and preserve information to comply with authorities, enforce contracts, investigate misuse or establish, exercise and defend legal claims.

Legal basis: legal obligation and legitimate interests, Articles 6(1)(c) and 6(1)(f) GDPR.

5.9 Whether providing personal data is required

Information marked as required during registration, checkout, payment, tax validation or service activation is necessary to enter into or perform the relevant contract, comply with legal obligations or protect the service. If required information is not provided, we may be unable to create the account, issue a valid invoice, process the order, deliver the service, verify the licence or provide support.

Information that is not marked as required is voluntary. Refusing optional marketing, analytics or advertising consent does not prevent the purchase or use of the core service, although optional personalised features may be unavailable.

6. Cookies and consent management

Our websites use cookies, local storage, pixels and similar technologies.

These technologies may be categorised as:

• Strictly necessary: login, shopping cart, checkout, security, load balancing, language and consent settings;
• Preferences: interface and user choices;
• Statistics: website measurement and analytics;
• Marketing: advertising measurement, conversion tracking and remarketing.

We use Complianz to manage cookie consent. Non-essential Google and Meta browser scripts, cookies, pixels and advertising or conversion-tracking technologies are blocked and do not operate before the user provides the corresponding consent. If the user rejects the relevant category, those browser-based tracking technologies remain disabled. You can accept, reject or change your preferences through the cookie-consent interface displayed on the website.

The cookie-consent interface provides the current detailed list of cookies and similar technologies, including their name, provider, category, purpose and duration. Cookie preferences remain accessible so they can be changed or withdrawn at any time.

Withdrawal of consent does not affect processing that occurred before withdrawal. Rejecting optional cookies may reduce personalisation or prevent some third-party media and features from loading.

7. Ecommerce, WHMCS and payment providers

7.1 WHMCS customer area

Our ecommerce, invoicing, licence, subscription and support functions are managed through WHMCS at shop.pro.radio.

WHMCS data may include customer identity, company, address, tax information, orders, invoices, services, licences, support tickets, transaction references, account logins, IP addresses and security logs.

7.2 Stripe

When Stripe is selected or used to process a payment, transaction and payment information is transmitted to the applicable Stripe entities. For customers and businesses in the EEA, Stripe services may involve Irish Stripe entities, including Stripe Payments Europe, Limited, Stripe Technology Company, Limited and regulated Stripe entities, depending on the service.

Stripe may act as a processor, independent controller or joint controller depending on the processing activity. Stripe’s current privacy information is available at Stripe Privacy Center.

7.3 PayPal

When PayPal is selected, the information required to initiate and reconcile the payment is transmitted to PayPal. PayPal processes payment and account information under its own privacy statement and regulatory obligations.

For European services, the relevant provider is generally PayPal (Europe) S.à r.l. et Cie, S.C.A. PayPal’s current privacy information is available through the PayPal Privacy Statement.

Payment providers may carry out their own fraud prevention, authentication, legal compliance and transaction-risk analysis. We normally receive the transaction result, reference, amount, currency, payment method and limited customer or payer information rather than complete payment credentials.

8. Hosting, infrastructure and backups

8.1 Contabo hosting in the United States

Customer-account, ecommerce, WHMCS and Pro Radio AI service data are hosted using infrastructure supplied by:

Contabo GmbH
Welfenstraße 22
81541 Munich
Germany

The relevant Virtual Dedicated Server is physically located in Contabo’s US Central data centre in St. Louis, Missouri, United States.

Contabo GmbH acts as our processor. The physical data-centre operation is performed by its authorised subprocessor:

Contabo Inc.
710 N Tucker Blvd., Suite 420
St. Louis, Missouri 63101
United States

We have concluded a Data Processing Agreement with Contabo GmbH. The transfer from Contabo GmbH to Contabo Inc. is covered by the European Commission Standard Contractual Clauses, Module 3, together with the technical and organisational measures described in the agreement.

Because the service is a self-managed virtual server, Qantum Themes S.L. is responsible for the configuration, updating, access control, application security and backup policies of the software installed on the server.

8.2 Time4VPS backups

Hosting backups and replicas are stored on infrastructure supplied by:

UAB Interneto vizija (Time4VPS)
J. Kubiliaus Str. 6
LT-08234 Vilnius
Lithuania

UAB Interneto vizija acts as a processor for customer-controlled backup data under the data-processing terms incorporated into its service agreement.

Lithuania is a member of the European Union and the European Economic Area. Storage of these backups in Lithuania does not constitute a transfer to a third country outside the EEA.

Backups are used for disaster recovery, service continuity and restoration following technical failure, corruption or security incidents. Backup copies are subject to access restrictions and documented rotation schedules and are not used for ordinary commercial analysis.

8.3 Cloudflare

We use Cloudflare for services that may include DNS, content delivery, traffic filtering, DDoS protection, security, caching, tag delivery and related network functions.

Cloudflare may process IP addresses, request metadata, security events, cookies and limited website traffic information. Cloudflare’s current privacy and data-processing information is available at:

• Cloudflare Privacy Policy
• Cloudflare Data Processing Addendum

9. Analytics and advertising services

9.1 Google Analytics and Google Ads

Only after the relevant consent has been provided through Complianz, we use Google Analytics and Google Ads to measure visits, campaign performance, conversions and website usage. If consent is rejected, the corresponding Google browser tags and cookies remain blocked.

Information may include cookie identifiers, device and browser information, approximate location, pages viewed, interactions, referral source, campaign information, cart and purchase events and IP-derived technical data.

Google may process this information as an independent controller or processor depending on the service and configuration. Google’s current privacy information is available at Google Privacy Policy.

9.2 Meta Pixel and Conversions API

Only after the relevant consent has been provided through Complianz, we use Meta advertising technologies, which may include the Meta Pixel and conversion-measurement events, to measure advertising performance and create or refine advertising audiences. If consent is rejected, Meta browser-based tags, pixels and cookies remain blocked.

Depending on the event and configuration, information sent to Meta may include page and conversion events, browser and device data, IP address, transaction value, currency, product references and pseudonymised or hashed identifiers.

Meta may combine this information with data associated with Facebook or Instagram accounts under its own terms. The relevant European entity is generally Meta Platforms Ireland Limited. Current information is available through the Meta Privacy Policy.

9.3 Tag delivery through Cloudflare

Selected Google or marketing tags may be delivered or proxied through Cloudflare infrastructure. This does not change the identity of the analytics or advertising recipient, but Cloudflare may process related network request data as part of providing the delivery and security service.

10. Newsletter service

We may use Mailchimp, operated by The Rocket Science Group LLC and the Intuit group, to manage mailing lists and send newsletters.

Mailchimp may process email address, name, subscription status, consent records, campaign delivery information and interaction information such as opens and link clicks, where permitted.

Mailchimp acts mainly as a processor for mailing-list data while also processing some information for its own administration, billing, security and service-improvement purposes under its terms.

Mailchimp’s current information is available at:

• Mailchimp Global Privacy Statement
• Mailchimp Data Processing Addendum

You may unsubscribe from marketing emails at any time through the link included in each message. We may retain a minimal suppression record to ensure that the address is not subscribed again against your wishes.

11. Live chat

Live chat may be provided on selected pages, particularly cart and checkout pages, through Chaport.

When you use the chat, Chaport and Qantum Themes S.L. may process:

• name and email address;
• the content and history of the chat;
• date and time;
• IP address and approximate location;
• browser, device, operating system and referring page;
• online/offline status and technical identifiers.

The purpose is to answer presale, checkout and support questions and, where you provide an email address, to continue the conversation if the chat is interrupted.

Chaport’s information is available at:

• Chaport Privacy Policy
• Chaport GDPR information

12. Embedded media and external services

Some pages may contain embedded or linked content from third-party services such as YouTube, Vimeo, SoundCloud, Facebook, Instagram or other media platforms.

When an embedded item is loaded, the provider may receive your IP address, browser information, the page visited and cookie or account information. Where required, non-essential embeds are blocked until consent is provided.

External websites and services operate under their own privacy policies. We are not responsible for processing performed independently by websites that you access through external links.

13. Anti-spam and security tools

Forms, registration, login and checkout pages may use automated security and anti-spam tools, including Cloudflare security services, Cloudflare Turnstile, Google reCAPTCHA or equivalent protections where displayed.

These tools may process IP address, browser and device signals, interaction information and security-risk indicators to distinguish legitimate users from automated or abusive traffic.

14. Pro Radio Sidekick AI

Sidekick AI assists authorised WordPress users in generating draft music articles and recording editorial review.

The service uses OpenAI API models and stores limited technical and review records. Technical generation logs are normally retained for 60 days, usage records for up to 24 months and limited editorial-review audit records for approximately five years.

The detailed rules covering input, output, human review, audit information, hosting in St. Louis, OpenAI processing, machine-readable AI marking and data retention are available in the dedicated Sidekick AI terms and privacy notice.

15. Recipients and processors

Depending on the service used, personal data may be disclosed to or processed by:

• authorised Qantum Themes S.L. personnel and contractors subject to confidentiality;
• Contabo GmbH and Contabo Inc. for server hosting and data-centre operation;
• Time4VPS / UAB Interneto vizija for backup infrastructure in Lithuania;
• Cloudflare for DNS, network, security, caching and tag delivery;
• WHMCS-related service providers used to operate the customer area;
• Stripe and PayPal for payment processing;
• Mailchimp for newsletters;
• Chaport for live chat;
• Google and Meta for analytics, advertising and conversion measurement where consent is provided;
• OpenAI Ireland Ltd. and its subprocessors for Sidekick AI generation;
• accountants, tax advisers, legal advisers and technical professionals where necessary;
• public authorities, courts or law-enforcement bodies where disclosure is legally required.

We do not sell personal data.

16. International data transfers

Some personal data is processed outside the European Economic Area.

In particular:

• WHMCS, ecommerce and Sidekick AI server data is stored in St. Louis, Missouri, United States, using Contabo infrastructure;
• the Contabo transfer is governed by a Data Processing Agreement and European Commission Standard Contractual Clauses, Module 3, covering the transfer from Contabo GmbH to Contabo Inc.;
• Time4VPS backups are stored in Lithuania and therefore remain within the EEA;
• Cloudflare, Google, Meta, Mailchimp, Chaport, Stripe, PayPal and OpenAI may use affiliates or subprocessors in countries outside the EEA.

For other restricted transfers, we rely on the transfer mechanisms provided in the relevant contractual terms, which may include:

• European Commission Standard Contractual Clauses;
• an applicable adequacy decision;
• the EU–US Data Privacy Framework where the relevant recipient is validly certified and the framework applies;
• supplementary technical, contractual and organisational safeguards.

You may request information about the safeguards applicable to a specific transfer by contacting info@qantumthemes.com. Confidential and security-sensitive provisions may be redacted.

17. Retention periods

We retain personal data only for as long as reasonably necessary for the relevant purpose, contractual relationship, legal requirement, security need or legal claim.

Typical criteria and periods include:

• Customer accounts, orders, licences and commercial relationship data: retained for at least six years where necessary to document the commercial relationship and comply with Spanish commercial and accounting obligations. Data may be retained for longer while an account or service remains active, where necessary to provide perpetual licence rights, or where another legal obligation, dispute or legal claim requires a longer period;
• Invoices, accounting records and commercial documentation: generally six years from the relevant accounting entry, as required by Spanish commercial law, unless a longer period applies because of tax proceedings, disputes, legal claims or another specific obligation;
• Payment records: for the period required to reconcile payments, handle refunds, chargebacks or disputes and meet accounting and fraud-prevention obligations; records forming part of commercial documentation may be retained for six years;
• Support tickets and related support communications: retained while the ticket is active and for no longer than five years after closure. After that period, the ticket and its attachments are deleted or anonymised, unless their preservation is temporarily required by a binding legal order or an active legal proceeding;
• Unsuccessful presale enquiries: normally for no more than 12 months after the last meaningful contact, unless the information must be retained for security, dispute resolution or legal claims;
• Newsletter subscriptions: until unsubscribe or withdrawal of consent; a minimal suppression record may be retained afterwards for as long as necessary to honour the opt-out;
• Cookie-consent records: normally for up to 24 months from the relevant choice, or longer where necessary to demonstrate consent or withdrawal in relation to an active dispute;
• Cookie and advertising data: according to the duration stated in the cookie-consent interface and the retention configured for the relevant provider;
• Security and server logs: normally for up to 90 days, and for longer only where necessary to investigate abuse, fraud, a security incident or a legal claim;
• Live chat: chat conversations are deleted within 24 hours. Information separately submitted through email, checkout or a support ticket is governed by the retention period applicable to that separate channel;
• Sidekick AI: according to the specific 60-day, 24-month and five-year periods described in the Sidekick AI notice;
• Backups: until overwritten through the applicable backup-rotation cycle.

Deletion from an active system may not immediately remove information from protected backups. Backup data is isolated from normal use and is deleted when the corresponding backup copy is rotated or overwritten.

18. Security

We use technical and organisational measures appropriate to the risks of the processing, including where relevant:

• TLS encryption in transit;
• restricted administrator access;
• role-based permissions;
• two-factor authentication where supported;
• firewalls, traffic filtering and anti-DDoS protection;
• logging and security monitoring;
• software and operating-system updates;
• segregation of systems and accounts;
• password hashing and secure credential management;
• backups and disaster-recovery procedures;
• data minimisation and retention limits;
• processor agreements and confidentiality obligations.

No internet-based system is completely secure. Customers are also responsible for securing their own devices, email accounts, WordPress installations, hosting environments and passwords.

19. Data-subject rights

Subject to the requirements and limitations of applicable law, you may request:

• confirmation of whether we process your personal data;
• access to your personal data;
• correction of inaccurate or incomplete data;
• deletion of data;
• restriction of processing;
• data portability where applicable;
• objection to processing based on legitimate interests;
• objection to direct marketing at any time;
• withdrawal of consent at any time;
• information concerning international-transfer safeguards.

Send requests to:

Email: info@qantumthemes.com
Postal address: Qantum Themes S.L., C. Juan Bautista Labaña, 4, loc. 2, 50011 Zaragoza, Spain

We may request information necessary to verify identity before responding. Rights are not absolute, and some data may need to be retained for accounting, legal, fraud-prevention, security or legal-claim purposes.

Requests concerning data controlled independently by Stripe, PayPal, Google, Meta, Mailchimp, marketplaces or other third parties should also be directed to the relevant provider.

20. Complaints

You have the right to lodge a complaint with the Spanish Data Protection Agency or another competent supervisory authority.

Agencia Española de Protección de Datos (AEPD)
https://www.aepd.es/

21. Automated decision-making

We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning customers.

Payment, fraud, security and advertising providers may use automated systems under their own legal responsibilities. Where an automated security control blocks an action, you may contact us to request human review where appropriate.

22. Children

Our products and services are intended for businesses, radio stations, professionals and adult users. We do not knowingly offer accounts or paid services directly to children.

If you believe that a child has provided personal data without appropriate authorisation, contact us so that we can assess and remove the information where required.

23. Third-party marketplaces and websites

Products may also be sold or distributed through independent marketplaces or platforms. Those providers process account, payment and marketplace data under their own privacy policies.

Qantum Themes S.L. can respond only to requests concerning data under its control. Requests concerning data held exclusively by a marketplace, payment provider, social network or other independent platform must be submitted to that provider.

24. Changes to this Policy

We may update this Privacy Policy to reflect changes in law, providers, hosting, security, products or processing activities.

The updated version will be published on this page with a revised “Last updated” date. Material changes will be communicated through an appropriate channel where required.

25. Contact

Questions about privacy or this Policy may be sent to:

Qantum Themes S.L.
C. Juan Bautista Labaña, 4, loc. 2
50011 Zaragoza
Spain
Email: info@qantumthemes.com