Privacy policy.

1. Who is responsible

The data controller for personal data collected through this website is QQuantum.ai, based in Barcelona, Spain. Full identification details are on the legal notice. For anything to do with your personal data, write to [email protected]. We have not appointed a data protection officer because the scale and nature of our processing does not require one.

2. What this policy covers

This policy covers personal data we collect as a controller: through this website, through email and calls with prospective and current clients, and in the ordinary running of our business. It does not cover data we process on a client's behalf inside a system we build for them. In that case the client is the controller, we act as a processor under a written data processing agreement, and the client's own privacy notice applies. Section 8 explains how we approach that role.

3. What we collect and why

Contact form

When you use the contact form we ask for your name, work email and a description of what you want to build. Everything else is optional: your company, telephone, job title and LinkedIn profile, and a set of multiple-choice answers about the project — why you are getting in touch, what you are interested in, what the system would connect to, where the data is allowed to live, what stage you are starting from, your timeline, your budget band and whether you are an enterprise or a startup. We ask them because they are the questions a first call opens with; none of them is required, and “not sure yet” is an accepted answer to every one.

• Purpose: to reply to you, assess whether we can help, and prepare for a call.
• Legal basis: taking steps at your request before entering into a contract (GDPR article 6(1)(b)), and our legitimate interest in responding to enquiries about our services (article 6(1)(f)).
• Retention: for as long as we are in conversation about the enquiry, and up to 12 months after our last exchange so we can pick up a conversation that resumes. If the enquiry becomes an engagement, the data moves into our client records (below).

To stop automated abuse of the form we record the IP address a submission came from, keep a short-lived count of submissions per address (one hour), and include a hidden field that only automated tools fill in. Submissions that trip those checks are discarded.

Email, calls and meetings

If you email us or we speak, we keep the correspondence and our notes.

• Purpose: to carry on the conversation and, if it becomes an engagement, to deliver the work.
• Legal basis: pre-contractual steps and performance of a contract (article 6(1)(b)); legitimate interest in managing business relationships (article 6(1)(f)).
• Retention: correspondence with prospects, 12 months after last contact. Client records, including contracts and invoices, for the duration of the relationship and then for the period Spanish commercial and tax law requires (generally six years from the end of the relevant financial year).

Server logs

Our web server records the IP address, requested page, referring page, browser identifier and time of each request. We use these logs to detect abuse, diagnose faults and size capacity. They are not used to identify individual visitors or to build profiles, and they are kept for no more than 90 days unless a specific security incident requires longer.

• Legal basis: our legitimate interest in the security and operation of the site (article 6(1)(f)).

Cookies

The site sets six cookies on every visit: four that are strictly necessary or store a preference you set yourself, and two for Google Analytics. The cookie policy lists each one with its lifetime and purpose.

We have chosen to run analytics on every visit rather than ask first, so the panel shown on a first visit is a notice and not a request — it tells you what is stored and does not offer a choice we would not honour. The site therefore gives you no way to switch analytics off. Your browser does, and so does Google's own opt-out add-on; both are in section 4 of the cookie policy, and neither affects anything else here.

Analytics is configured for measurement only: advertising signals are switched off in the tag and advertising storage is denied, so it builds no advertising audience and sets no advertising cookie.

Job applications

If you send us a CV or apply for a role, we keep what you send for the purpose of considering you for current and future roles for up to 12 months, on the basis of pre-contractual steps at your request and our legitimate interest in recruiting. Tell us at any time if you would rather we deleted it sooner.

What we do not collect

We do not buy data about visitors, enrich enquiries from third-party databases, run advertising audiences, or track you across other sites. We do not knowingly collect data from anyone under 16; this is a business-to-business site.

4. Who receives the data

We do not sell or rent personal data. We share it only with:

• Service providers who host our website, deliver our email, and store our documents, acting on our instructions as processors under contracts that meet GDPR article 28. A current list is available on request, and the ones that run in your browser are named in the sub-processor list.
• Google Ireland Limited, on every visit, for website measurement as our processor under Google's data processing terms. It receives page-view data and the identifiers in the two _ga cookies. It does not receive anything you type into a form.
• Professional advisers (accountants, lawyers, insurers) where necessary to run the business.
• Public authorities where the law requires it.

5. International transfers

We are based in Spain and prefer providers that store data inside the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission or on the Commission's standard contractual clauses, together with our assessment of the destination. You can ask us which mechanism applies to a given provider.

Website analytics is contracted with Google Ireland Limited, in Ireland. Google may transfer some of that data to the United States, where it relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework, backed by standard contractual clauses. Because analytics runs on every visit, the way to prevent that transfer is to block it in your browser — section 4 of the cookie policy explains how.

6. Your rights

Under the GDPR you can ask us to:

• confirm whether we hold data about you, and give you a copy (access);
• correct data that is wrong or incomplete (rectification);
• delete your data (erasure), which we will do unless we have a legal reason to keep it;
• limit what we do with it while a dispute is resolved (restriction);
• give you your data in a machine-readable form (portability), where processing is based on contract;
• stop processing that is based on legitimate interest (objection), which we will do unless we can show compelling grounds.

Email [email protected]. We reply within one month, and we may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or repetitive.

You also have the right to complain to a supervisory authority. In Spain that is the Agencia Española de Protección de Datos, aepd.es. We would be grateful for the chance to resolve a concern directly first, but you are not obliged to give us one.

7. Automated decisions and profiling

We make no decisions about you by automated means that have legal or similarly significant effects, and we do not profile visitors or enquirers. We may use AI tools to help draft replies, summarise notes or organise our own work; a person reads and is responsible for anything we send you. Our statement on how we use AI says more.

8. When we build systems for clients

Systems we build for clients frequently process personal data: customer records, documents, support conversations. In those engagements the client is the controller and we are a processor, or in some cases the client operates the system entirely and we never hold the data at all. Our commitments in that role are:

• We sign a data processing agreement before any personal data reaches us.
• We process only on the client's documented instructions and only what the work requires.
• We help the client identify model providers and other sub-processors so they can be named in the client's own notices and records.
• We design for minimisation, retention limits and deletion that propagates to derived data such as embeddings and logs. The GDPR page describes how.
• We return or delete client data at the end of the engagement, as the client instructs.

9. Security

We protect personal data with measures proportionate to its sensitivity: encrypted connections, access limited to the people who need it, multi-factor authentication on our accounts, and logging. No security measure is absolute. If we discover a breach that is likely to put your rights at risk, we will notify the supervisory authority and, where required, you, within the timescales the GDPR sets.

10. Changes to this policy

When we change this policy we change the date at the top. If a change materially affects how we use data we already hold about you, we will tell you directly where we can.