Cookie policy

This Cookie Policy explains how NAQ Systems Limited (Q•NAQ, we, us, or our) uses cookies, software development kits (SDKs), pixels, tags, local storage, session storage, device identifiers, and similar technologies (collectively, Technologies) on qnaq.com and related applications that link to this Policy (the Platform).

This Policy applies worldwide to the Technologies used for Q•NAQ services operated by NAQ Systems Limited from Ireland. English (United Kingdom), marked UK, is the official version; the other language and regional versions are faithful translations for users’ convenience, subject to Section 1.5 of the Terms of Service and mandatory language rights. GDPR applies to related processing in the context of the Irish establishment regardless of residence. Separate device-storage and access rules remain applicable. Read this Policy with the Privacy Policy.

1. What these technologies do

A cookie is a small file stored by a browser. SDKs, pixels, tags, and local storage can perform similar functions in websites or applications. A Technology may be set by Q•NAQ (first party) or by a provider whose service Q•NAQ uses (third party).

Technologies may recognise a browser or device, maintain a secure session, remember preferences, prevent fraud, process payment, diagnose errors, measure performance, understand use, or support advertising where deployed and lawfully enabled.

2. Categories

Classifying a Technology as necessary depends on its actual purpose and configuration, not its provider or label. Q•NAQ does not treat optional analytics or advertising as necessary merely because it benefits the business.

3. Current technology register

The Platform’s Cookie Settings serve as the current user-facing, item-level register of Technologies deployed for the relevant configuration. Before Q•NAQ activates a non-essential Technology where consent is required, the register provides the information described below for each relevant item.

The register identifies the cookie, SDK, tag, pixel, storage key, or comparable identifier.

The register identifies the provider and states whether the Technology is first-party or third-party.

The register identifies the Technology's category and specific purpose.

The register describes the information the Technology reads or writes.

The register states whether the Technology is session-based or persistent.

The register states the Technology's maximum duration or expiry.

The register identifies the available consent or opt-out control.

The register must reflect the live Platform configuration. A generic provider list does not replace an item-level register where law requires one.

4. Providers that may use technologies

Depending on the feature actually deployed and the user’s choices, Q•NAQ may use the Technologies and providers described below.

Q•NAQ may use its own Technologies for authentication, security, preferences, consent records, and Platform functions.

Q•NAQ currently uses Stripe Technologies for secure checkout, payment authentication, fraud prevention and payment continuity where deployed. Q•NAQ may replace or add payment providers or introduce its own lawful payment solution. Before using any new Technology, Q•NAQ applies the same necessity, notice, register and consent requirements set out in this Policy; a change of payment provider is not itself consent to new optional tracking.

Q•NAQ may use Technologies provided by Google Analytics for optional analytics and measurement.

Q•NAQ may use Google Tag Manager to deploy and control tags, but only according to the consent state and configured purpose of each underlying tag.

Q•NAQ may use Technologies provided by Sentry for error, performance, security, and diagnostic monitoring, configured to minimise unnecessary personal data.

Q•NAQ may use Technologies provided by CloudTalk if an optional call or support widget is deployed.

Q•NAQ may use its own AI Technologies or those of OpenAI or Z.ai only if an AI Feature uses browser-side Technologies or an embedded component. Server-to-server AI processing is described in the Privacy Policy and does not itself constitute device storage or access.

Not every listed provider necessarily sets a cookie or uses another Technology for every user. The item-level register in Cookie Settings controls for the actual deployment, purpose, category, provider, and duration.

5. Consent and choice

5.1 Prior consent

In countries that require prior consent, Q•NAQ will not set or access non-essential Technologies until the user makes an affirmative choice. Continuing to browse, accepting the Terms, or using a necessary feature is not consent to optional Technologies.

5.2 Consent banner

The banner or first-layer control will provide clear, equally accessible choices to accept or reject non-essential Technologies and a route to granular settings. Optional categories will not be preselected where prohibited.

5.3 Withdrawal

A user can revisit Cookie Settings through the persistent Cookie Settings link or a comparable application control. Withdrawing consent is as easy as giving it and operates prospectively. After withdrawal, Q•NAQ stops future optional storage or access and deletes or expires stored identifiers to the extent required by law.

5.4 Necessary Technologies

Strictly necessary Technologies cannot generally be disabled through the Preference Centre because they support a requested service, security, or consent record. A user can block them in browser settings, but parts of the Platform may not function.

Necessary does not mean anonymous. Authentication, security, payment, fraud-prevention, load-balancing, and consent Technologies may process an Account identifier, IP address, device or session signal, transaction reference, or another item that is personal data under applicable law.

5.5 Legitimate interests and equivalent bases

Q•NAQ uses a non-consent basis for personal-data processing only where the applicable data-protection law permits it for the actual purpose. That basis does not replace consent separately required for storing information on, or accessing information from, a user’s device. EU/EEA consent exceptions are assessed under the applicable national ePrivacy law. UK statutory exceptions are assessed separately, including each transparency, purpose and objection condition; an analytics or security label alone is insufficient.

6. Global Privacy Control and U.S. state opt-outs

Where an applicable U.S. state law requires it, Q•NAQ treats a valid Global Privacy Control or other recognised opt-out preference signal as a request to opt out of sale, sharing, targeted advertising, or comparable covered processing for the browser or device and, where Q•NAQ can reasonably associate it, the Account.

Q•NAQ does not offer personal data as an unrestricted standalone data product. Statutory sale, sharing, targeted-advertising and data-broker definitions nevertheless depend on actual technology and disclosure configurations. Controlled contact disclosures are explained in the Privacy Policy. For covered configurations Q•NAQ must provide the required opt-out or consent mechanism, honour legally recognised preference signals and complete required assessments unless a specific exception applies. It does not require unnecessary identity verification for a browser-level opt-out. A statutory registration obligation is not excluded by this description.

7. Duration

Session Technologies expire when the browser or application session ends. Persistent Technologies remain until their stated expiry, deletion by the user, withdrawal-driven deletion where applicable, or replacement by a newer record.

Q•NAQ configures each Technology’s duration according to its purpose and necessity. Cookie Settings state the current item-level expiry. Account closure or a three-year fraud-evidence period does not give every cookie or identifier a three-year lifetime.

Consent and refusal records may outlast optional analytics identifiers to remember users’ choices and demonstrate compliance; retaining a record does not extend consent validity. The Privacy Policy gives further retention information.

8. Browser, device, and provider controls

A user can delete or block cookies through browser or device settings. Blocking all cookies may prevent login, checkout, security, and preference functions. Browser “Do Not Track” signals are handled only where a law or published Q•NAQ setting gives them legal or operational effect; Global Privacy Control is treated as described in Section 6.

Third-party providers may offer their own controls. Using a provider opt-out does not necessarily remove existing cookies from the device, and deleting cookies may also delete the recorded Q•NAQ preference, requiring the user to choose again.

9. Mobile applications and SDKs

If Q•NAQ offers a mobile application, it may use SDKs or device permissions for authentication, security, notifications, diagnostics, analytics, camera or file upload, or other requested functionality. The application will request operating-system permission where required. Optional analytics, advertising, precise location, microphone, camera, contacts, or similar access will follow applicable consent and platform rules.

10. Security and fraud technologies

Q•NAQ uses security and fraud-detection Technologies, including AI-assisted checks, to identify bots, fake Accounts, payment abuse, prohibited Content and suspicious activity on the Platform. Relevant signals may include IP address, device and session characteristics, login and authentication events, posting or messaging patterns, prior confirmed abuse and payment-risk indicators. Signals are assessed for the stated purpose; an unusual pattern or an automated score is not conclusive proof of wrongdoing.

These checks are limited to what is necessary and lawful for security, fraud prevention, moderation and service integrity. Calling a Technology security-related does not exempt every use from consent or transparency requirements. Q•NAQ does not use this clause to authorise unrestricted surveillance, unrelated advertising profiles or access to private device content. The Privacy Policy explains legal bases, retention and rights; significant automated decisions and challenges receive the safeguards required by applicable law.

11. Changes to technologies or this policy

Q•NAQ may change providers, Technologies, categories, purposes, or durations. Q•NAQ updates the item-level register before or when a change is deployed. If a change materially expands an optional purpose or makes prior consent insufficient, Q•NAQ requests a new choice before the changed use where required.

The effective date of this Policy will be updated for material revisions. A change to this Policy does not by itself authorise a new optional Technology.

12. Regional cookie, tracking, and marketing rules

The rules below are non-exhaustive and apply only where their territorial and material scope is met. References include amendments, implementing measures, official decisions, and replacement rules in force from time to time. A country not named is governed by its own mandatory law.

12.1 European Union and EEA

For the Irish establishment, Regulation 5(3) of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011), implementing Article 5(3) of Directive 2002/58/EC, governs relevant device storage and access. Prior informed consent is required unless the operation meets an exemption in Regulation 5(5), including strict necessity for a service expressly requested by the user. Other applicable EEA implementing laws also remain effective. Regulation (EU) 2016/679 governs related personal-data processing. Consent must meet its applicable conditions, including an equally accessible way to withdraw it; the interface must not manipulate the choice.

12.2 United Kingdom and Switzerland

Where UK law applies, the Privacy and Electronic Communications Regulations 2003 (PECR), UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025 govern the relevant activity. Prior consent is obtained for storage or access unless a specific current exception and all its conditions apply. The expanded exceptions for qualifying statistical purposes or user preferences do not give general permission for advertising, unrelated profiling or third-party reuse. Where an exception requires clear information and a simple means to object, both must be provided. Swiss telecommunications, data-protection and unfair-competition rules remain relevant only where their territorial and substantive conditions are met; an EU configuration does not automatically satisfy UK or Swiss law.

12.3 United States

Where a U.S. state defines a Technology-enabled disclosure as sale, sharing, targeted advertising, profiling, or processing of sensitive data, Q•NAQ will provide the applicable notice, opt-out or opt-in, appeal, and signal recognition. A valid Global Privacy Control will be honoured where legally required. Q•NAQ will assess children’s and teen data separately and will not use this Policy to claim parental or age-specific consent that was not actually obtained.

State wiretap, session-replay, biometric, precise-location, health-data, and employment-monitoring rules may impose consent or notice beyond a general cookie banner. Q•NAQ will not deploy such a Technology based solely on generic analytics consent.

12.4 Canada and Latin America

Canadian consent, privacy, anti-spam, and provincial requirements apply to the actual identifier and purpose. In Mexico, Brazil, Argentina, Chile, Colombia, Peru, Uruguay, Ecuador, Costa Rica, Panama, and other Latin American markets, the Privacy Policy and any required Spanish or Portuguese notice will identify cookies and comparable identifiers, purposes, recipients, choices, and international transfers. Consent will be obtained where the applicable data or communications law requires it.

12.5 Australia and New Zealand

For an Australian activity within scope, the Privacy Act 1988, Australian Privacy Principles and Spam Act 2003 govern collection, use, disclosure and relevant marketing. Australia does not impose a general EU-style consent rule for every nonessential cookie solely because it is a cookie; consent or other requirements may nevertheless follow from the actual information, use, disclosure, applicable law or an overlapping Irish/EEA rule. Separate electronic-marketing requirements are not satisfied merely by accepting a cookie category. The New Zealand Privacy Act and Unsolicited Electronic Messages Act apply only to an activity within their own scope. Q•NAQ will provide the transparency and direct-marketing controls required by the applicable rules.

12.6 India and South Asia

Indian processing through cookies and comparable identifiers is governed by the Information Technology regime and by the Digital Personal Data Protection Act 2023 and Rules 2025 as their provisions commence. Q•NAQ will update notices, consent records, withdrawal, child-data, security, erasure, and grievance controls by each statutory commencement date. Applicable electronic-communications, cybercrime, and privacy rules in Pakistan, Bangladesh, Sri Lanka, Nepal, Bhutan, and Maldives also apply before targeted deployment.

12.7 Japan, South Korea, and Greater China

Japan’s APPI and telecommunications rules, South Korea’s PIPA and communications laws, mainland China’s PIPL and related consent and cross-border rules, Hong Kong’s Personal Data (Privacy) Ordinance, Macao’s Personal Data Protection Act, and Taiwan’s Personal Data Protection Act apply according to scope. Separate consent, local-language notice, domestic transfer records, overseas-transfer information, or local controls will be used where required.

12.8 Singapore and Southeast Asia

Singapore’s PDPA and Spam Control Act, Indonesia’s Personal Data Protection Law and electronic-system rules, Malaysia’s PDPA as amended, the Philippines Data Privacy Act, Thailand’s PDPA, and Vietnam’s Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP apply to covered identifiers and transfers. Q•NAQ will not deploy a non-essential tag in a market until required consent, notice, registration, localisation, or transfer controls are configured.

12.9 Türkiye, Middle East, and Africa

Türkiye’s KVKK and electronic-commerce rules, UAE and Saudi data-protection laws, Israel’s privacy and communications laws, Qatar and Bahrain data laws, South Africa’s POPIA, Nigeria’s Data Protection Act, Kenya’s Data Protection Act, and other local regimes may regulate device identifiers, direct marketing, cross-border processing, and consent. Q•NAQ will implement any required local-language notice, representative appointment, data protection officer appointment, registration, or opt-out before covered deployment.

13. Contact

Send questions or complaints about Technologies to the contact below.

NAQ Systems Limited

Contact and correspondence address: 18 Mallow Street Upper, Limerick, V94 N12Y, Ireland

Company number: 812051

Email: legal@qnaq.pro

Website: qnaq.com

Telephone: +353 1 912 8188