Privacy Policy
Last updated: April 4, 2026
Your privacy matters to us. This Privacy Policy explains what personal data QSL Exchange collects, why, how it is used, and your rights under the General Data Protection Regulation (GDPR) and other applicable privacy laws.
1. Data Controller
The data controller responsible for your personal data is:
OMLabs e.U.
Hofstattweg 14
6170 Nenzing, Austria
Email: privacy@qslexchange.com
2. Personal Data We Collect
2.1 Account Registration
- Callsign(s) (primary and secondary)
- First name and last name
- Email address
- Password (stored as a one-way hash — never in plain text)
- Country and optional address / QTH location
- Grid locator (Maidenhead), CQ zone, ITU zone (optional)
- Amateur radio licence class (optional)
2.2 Profile Information (Optional)
- Biography, equipment details, antenna systems
- Personal or club website URL
- QRZ.com profile link
- Profile photo
2.3 Logbook Data
- QSO records: contacted callsign, date, time, frequency, band, mode, signal reports, power, notes
- Grid locators of both stations
- QSL confirmation status across platforms (QSL Exchange, eQSL, LoTW, paper)
- DXCC entity information derived from callsigns
2.4 QSL / NetQSL Cards
- Card messages and custom content you add to cards
- Template and image selections
- Send and confirmation timestamps
2.5 Payment Data
- Membership tier and subscription status
- Payment method type (card, etc.) — stored at Stripe, not on our servers
- Stripe customer ID and subscription ID (reference tokens only)
- Transaction history (amounts, currency, dates)
2.6 Usage and Technical Data
- IP address (anonymised for analytics)
- Browser type and device type
- Pages visited, interactions, and features used (via Matomo Analytics — see Section 7)
- Session data for authentication (stored server-side)
3. Legal Basis for Processing
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Account creation and login | Performance of a contract (Art. 6(1)(b)) |
| Delivering paid membership features | Performance of a contract (Art. 6(1)(b)) |
| Billing and payment processing | Legal obligation / Contract (Art. 6(1)(b)(c)) |
| Sending NetQSL cards to users and non-users | Legitimate interests (Art. 6(1)(f)) |
| Analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing communications (if opted in) | Consent (Art. 6(1)(a)) |
4. How We Use Your Data
- Provide the Service: Store and display your logbook, send and receive NetQSL cards, show your profile to other users.
- Billing: Process subscriptions and payments via Stripe; issue invoices; comply with tax regulations.
- Communication: Send account-related emails (email verification, password reset, subscription receipts, NetQSL card notifications).
- Analytics: Understand how the Service is used in aggregate to improve features and performance.
- Security: Detect and prevent fraud, abuse, and unauthorised access.
- Legal compliance: Retain records required by law.
5. Public Profile Data
Your callsign, country, and public profile information (biography, equipment, grid locator if provided) are visible to all visitors of the Service, including non-registered users. This reflects the public nature of amateur radio identity and is consistent with the practice of listing callsigns in publicly available national licence registers.
You can limit what appears on your public profile at any time via your profile settings.
6. Data Processors (Third Parties)
We engage the following processors who access your data only on our instructions:
| Processor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing and subscription management | USA (EU Standard Contractual Clauses) |
| Matomo Analytics | Privacy-respecting website analytics | EU (self-hosted / Matomo Cloud — EU region) |
| Email provider (SMTP) | Transactional email delivery | EU |
| Hosting provider | Server infrastructure and storage | EU |
We do not sell your personal data to third parties. We do not share your data with advertising networks.
Stripe may transfer data outside the EU under Standard Contractual Clauses in accordance with GDPR Chapter V. For details, see stripe.com/privacy.
7. Analytics — Matomo
We use Matomo Analytics to collect anonymised statistics about how visitors use our website. Matomo is configured with the following privacy protections:
- IP anonymisation: The last two octets of your IP address are removed before storage.
- No cross-site tracking: Matomo does not share data with any third-party advertising network.
- Cookie consent respected: Analytics cookies are only set after you accept them via our cookie banner.
- Data location: Analytics data is processed and stored within the EU.
You can opt out of Matomo tracking at any time using the opt-out control in our Cookie Policy, or by enabling "Do Not Track" in your browser.
8. Cookies and Tracking Technologies
We use cookies for authentication, security (CSRF protection), and optional analytics. For full details, see our Cookie Policy.
9. Data Retention
| Data category | Retention period |
|---|---|
| Account and profile data | Until account deletion + 30-day grace period |
| Logbook and QSL card data | Until account deletion |
| Payment and billing records | 7 years (legal / tax obligation) |
| Analytics data (anonymised) | 13 months rolling |
| Security logs (IP, access logs) | 90 days |
| Email opt-out records | Indefinitely (to honour opt-out preferences) |
After a deletion request, your account enters a 30-day grace period. On expiry, personal data is permanently deleted except where a longer retention period is legally required.
10. Your Rights Under GDPR
If you are in the European Economic Area (EEA) or the UK, you have the following rights:
- Right of access (Art. 15): Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): Request correction of inaccurate data. Most data can be updated directly in your profile settings.
- Right to erasure (Art. 17): Request deletion of your account and personal data. Available from your profile settings (30-day grace period applies).
- Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances.
- Right to data portability (Art. 20): Request your logbook data in machine-readable format (ADIF/CSV export available on paid tiers).
- Right to object (Art. 21): Object to processing based on legitimate interests, including analytics. You can opt out of analytics via the Cookie Policy.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at privacy@qslexchange.com. We will respond within 30 days.
11. Right to Lodge a Complaint
You have the right to lodge a complaint with your national data protection supervisory authority. In the EU, you can find your supervisory authority at edpb.europa.eu.
12. Children's Privacy
The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected such data, we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or by a prominent notice within the Service at least 14 days before taking effect. The "last updated" date at the top of this page reflects the most recent revision.
14. Contact
For privacy-related questions or data requests:
Email: privacy@qslexchange.com
Postal address: OMLabs e.U., Hofstattweg 14, 6170 Nenzing, Austria