Privacy policy.

1. Who is responsible

The data controller for personal data collected through this website is QQuantum.ai, based in Barcelona, Spain. Full identification details are on the legal notice. For anything to do with your personal data, write to [email protected]. We have not appointed a data protection officer because the scale and nature of our processing does not require one.

2. What this policy covers

This policy covers personal data we collect as a controller: through this website, through email and calls with prospective and current clients, and in the ordinary running of our business. It does not cover data we process on a client's behalf inside a system we build for them. In that case the client is the controller, we act as a processor under a written data processing agreement, and the client's own privacy notice applies. Section 8 explains how we approach that role.

3. What we collect and why

Contact form

When you use the contact form we ask for your name, work email and a description of what you want to build. Everything else is optional: your company, telephone, job title and LinkedIn profile, and a set of multiple-choice answers about the project — why you are getting in touch, what you are interested in, what the system would connect to, where the data is allowed to live, what stage you are starting from, your timeline, your budget band and whether you are an enterprise or a startup. We ask them because they are the questions a first call opens with; none of them is required, and “not sure yet” is an accepted answer to every one.

• Purpose: to reply to you, assess whether we can help, and prepare for a call.
• Legal basis: taking steps at your request before entering into a contract (GDPR article 6(1)(b)), and our legitimate interest in responding to enquiries about our services (article 6(1)(f)).
• Retention: for as long as we are in conversation about the enquiry, and up to 12 months after our last exchange so we can pick up a conversation that resumes. If the enquiry becomes an engagement, the data moves into our client records (below).

To stop automated abuse of the form we record the IP address a submission came from, keep a short-lived count of submissions per address (one hour), and include a hidden field that only automated tools fill in. Submissions that trip those two checks are discarded.

Every other submission is checked automatically for the signs of spam — links, throwaway email domains, how quickly the form was completed, text we have already received, and typical sales-pitch wording. One that looks like spam is held for a person to review rather than passed on; nothing is deleted because of the check, and a held enquiry is kept and deleted on the same 12-month schedule as any other.

If you send an enquiry, we also note which page you first arrived on during that visit and what kind of site sent you there (for example a search engine or an AI assistant), so we know which pages bring enquiries. That note is held in the session cookie you already have, only for the visit, and is attached to your enquiry only if you send one. We also record our own progress on an enquiry — when we replied and where the conversation stands. That is our workflow, not a score of you.

Email, calls and meetings

If you email us or we speak, we keep the correspondence and our notes.

• Purpose: to carry on the conversation and, if it becomes an engagement, to deliver the work.
• Legal basis: pre-contractual steps and performance of a contract (article 6(1)(b)); legitimate interest in managing business relationships (article 6(1)(f)).
• Retention: correspondence with prospects, 12 months after last contact. Client records, including contracts and invoices, for the duration of the relationship and then for the period Spanish commercial and tax law requires (generally six years from the end of the relevant financial year).

Server logs

Our web server records the IP address, requested page, referring page, browser identifier and time of each request. We use these logs to detect abuse, diagnose faults and size capacity. They are not used to identify individual visitors or to build profiles, and they are kept for no more than 90 days unless a specific security incident requires longer.

• Legal basis: our legitimate interest in the security and operation of the site (article 6(1)(f)).

Visit statistics

The site counts its own traffic on our server, as daily totals: which page was requested, on which day, whether the request came from a browser or from a named crawler such as a search engine or an AI service, and what kind of site referred it. No IP address, identifier or cookie is used or stored for this, so the totals cannot be linked back to a visitor. Requests for pages that do not exist are counted the same way, by address, so we can fix broken links. The totals are kept for 13 months.

• Legal basis: our legitimate interest in understanding which parts of the site are used and keeping it working (article 6(1)(f)).

Cookies

Essential and preference cookies support the site. Google Analytics loads only after you allow it in the welcome window. Its two cookies and their purposes are listed in the cookie policy.

Both ways into the site, with sound or without, allow Google Analytics, and each says so. “Don’t agree” is the alternative and takes you to yourOS. The legal basis for analytics is consent under GDPR article 6(1)(a); you can withdraw it anytime through Experience & privacy in the footer by choosing “Don’t agree”, without affecting earlier lawful processing.

Analytics is configured for measurement only: advertising signals are switched off in the tag and advertising storage is denied, so it builds no advertising audience and sets no advertising cookie.

Job applications

If you send us a CV or apply for a role, we keep what you send for the purpose of considering you for current and future roles for up to 12 months, on the basis of pre-contractual steps at your request and our legitimate interest in recruiting. Tell us at any time if you would rather we deleted it sooner.

What we do not collect

We do not buy data about visitors, enrich enquiries from third-party databases, run advertising audiences, or track you across other sites. We do not knowingly collect data from anyone under 16; this is a business-to-business site.

4. Who receives the data

We do not sell or rent personal data. We share it only with:

• Service providers who host our website, deliver our email, and store our documents, acting on our instructions as processors under contracts that meet GDPR article 28. A current list is available on request, and the ones that run in your browser are named in the sub-processor list.
• Google Ireland Limited, once you allow analytics in the welcome window, for website measurement as our processor under Google's data processing terms. It receives page-view data and the identifiers in the two _ga cookies. It does not receive anything you type into a form.
• Professional advisers (accountants, lawyers, insurers) where necessary to run the business.
• Public authorities where the law requires it.

5. International transfers

We are based in Spain and prefer providers that store data inside the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission or on the Commission's standard contractual clauses, together with our assessment of the destination. You can ask us which mechanism applies to a given provider.

Website analytics is contracted with Google Ireland Limited, in Ireland. Google may transfer some of that data to the United States, where it relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework, backed by standard contractual clauses. Because analytics runs on every visit, the way to prevent that transfer is to block it in your browser — section 4 of the cookie policy explains how.

6. Your rights

Under the GDPR you can ask us to:

• confirm whether we hold data about you, and give you a copy (access);
• correct data that is wrong or incomplete (rectification);
• delete your data (erasure), which we will do unless we have a legal reason to keep it;
• limit what we do with it while a dispute is resolved (restriction);
• give you your data in a machine-readable form (portability), where processing is based on contract;
• stop processing that is based on legitimate interest (objection), which we will do unless we can show compelling grounds.

Email [email protected]. We reply within one month, and we may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or repetitive.

You also have the right to complain to a supervisory authority. In Spain that is the Agencia Española de Protección de Datos, aepd.es. We would be grateful for the chance to resolve a concern directly first, but you are not obliged to give us one.

7. Automated decisions and profiling

We make no decisions about you by automated means that have legal or similarly significant effects. Automated rules are used for one thing only: deciding whether a contact-form enquiry looks like spam. An enquiry that does is held for a person to review — it is never deleted automatically and never rejected without that review. We do not otherwise profile visitors or enquirers. We may use AI tools to help draft replies, summarise notes or organise our own work; a person reads and is responsible for anything we send you. Our statement on how we use AI says more.

8. When we build systems for clients

Systems we build for clients frequently process personal data: customer records, documents, support conversations. In those engagements the client is the controller and we are a processor, or in some cases the client operates the system entirely and we never hold the data at all. Our commitments in that role are:

• We sign a data processing agreement before any personal data reaches us.
• We process only on the client's documented instructions and only what the work requires.
• We help the client identify model providers and other sub-processors so they can be named in the client's own notices and records.
• We design for minimisation, retention limits and deletion that propagates to derived data such as embeddings and logs. The GDPR page describes how.
• We return or delete client data at the end of the engagement, as the client instructs.

9. Security

We protect personal data with measures proportionate to its sensitivity: encrypted connections, access limited to the people who need it, multi-factor authentication on our accounts, and logging. No security measure is absolute. If we discover a breach that is likely to put your rights at risk, we will notify the supervisory authority and, where required, you, within the timescales the GDPR sets.

10. Changes to this policy

When we change this policy we change the date at the top. If a change materially affects how we use data we already hold about you, we will tell you directly where we can.