Privacy Policy Website

Thank you for your interest in this Privacy Policy, and welcome to Quantiota and our website located at www.quantiota.ai (our “website”). This Privacy Policy sets out the basis on which we will process any Personal Data that we may collect about you as a visitor to our website. This policy further sets out how we protect your privacy and your rights in respect of our use of your Personal Data.

WHO IS THE DATA CONTROLLER?

A “data controller” is a person or organization who alone or jointly determines the purposes for which and the manner in which any Personal Data is, or is likely to be, processed. In this sense, Quantiota SAS, 23 Avenue du Granier, 38240 Meylan (“Quantiota”, “we”, “us”, “our”) is the data controller. If you have any questions about this policy or about data protection at Quantiota in general, you can contact us by email using info@quantiota.ai with “Data Protection” in the subject line.

WHAT IS PERSONAL DATA?

Personal Data is information that makes it possible to identify a natural person. This includes, in particular, your name, date of birth, address, telephone number, e-mail address, but also your IP address. Anonymous data exists if no personal reference to the user can be made.

WHAT IS PROCESSING?

"Processing" means and covers virtually any handling of data.

WHAT LAW APPLIES?

We will only use your Personal Data in accordance with France’s Data Protection Act (Law n° 78-17 and Ordinance n° 2018-1125) (“DPA”), the EU's General Data Protection Regulation (“GDPR”), and of course only as described in this Privacy Policy.

WHAT ARE THE LEGAL BASES FOR PROCESSING PERSONAL DATA

We have to have at least one of the following legal bases to process your Personal Data: a) you have given your consent; b) the data is necessary for the fulfilment of a contract/pre-contractual measures; c) the data is necessary for the fulfilment of a legal obligation; or d) the data is necessary to protect our legitimate interests, provided that your interests are not overridden.

WHAT PERSONAL DATA DO WE COLLECT FROM YOU?

We may collect and process the following Personal Data about you:

a) Personal Data that you give us:

This is information about you that you give to us by filling in forms on our website, requesting information, or corresponding with us by telephone, post, email, or requesting a demo or otherwise. It may also include, for example, your name, address, email address, and telephone number; information about your business relationship with us; and information about your requirements.

The protection of your Personal Data is particularly important to us in the performance of our contract with you and allowing you access to our services (“Services”). We therefore only want to process as much Personal Data (for example, your name, address, e-mail address, or telephone number) as is absolutely necessary. Nevertheless, we rely on the processing of certain Personal Data, to fulfil our contractual obligations to you or to carry out pre-contractual measures and in the context of administrative tasks as well as the organization of our business and compliance with legal obligations, such as archiving.

As mentioned above, we process the Personal Data involved in your use of our services and in particular our SaaS solutions (“Service Data”) in order to be able to provide our services. We recognise that you own your Service Data and provide you with complete control of your Service Data by providing you the ability to (i) access your Service Data, (ii) share your Service Data through supported third-party integrations, and (iii) request export or deletion of your Service Data.

We ensure that access by our employees to your data is only available on a need-to-know basis, restricted to specific individuals, and is logged and audited. We communicate our privacy and security guidelines to our employees and enforce privacy and protection safeguards strictly.

We process your Service Data as Data Processor or in other words on behalf of you, and will only do so in accordance with your instructions and use it only for the purposes agreed between you and us. We also take appropriate legal precautions and corresponding technical and organizational measures to ensure the protection of your Service Data. For further information, please also refer to our Privacy Policy SaaS.

If you create a support ticket, we will request Personal Data and, where applicable, non-Personal Data in accordance with your request, this may include your name, email address, and other order-related data you voluntarily provide. If you submit a support ticket, we process the data for the purpose of processing and handling your ticket. Our employees will also have access to data that you knowingly share with us for technical support or to import data into our services. We communicate our privacy and security guidelines to our employees and enforce privacy safeguards strictly. The legal basis of the data processing is our obligation to fulfil the contract and/or our legitimate interest in processing your support ticket.

If you take out a subscription, your payment data will be processed via our payment service provider Stripe. Payment data will solely be processed through Stripe, and we have no access to any payment data you may submit. The legal basis for the provision of a payment system is the establishment and implementation of the contract.

Finally, we process data in the context of administrative tasks as well as organization of our business and compliance with legal obligations, such as archiving. In this regard, we process the same data that we process in the course of providing our contractual services. The processing bases are our legal obligations and our legitimate interest.

b) Personal Data that our website and other systems collect about you:

If you visit our website, it will automatically collect some information about you and your visit, including the Internet protocol (IP) address used to connect your device to the Internet and some other information, such as the pages on our site that you visit. This is used to monitor the performance of the website and improve the experience of visitors to the website.

We host our website using the services of Amazon (AWS). In this sense, AWS processes all data and communication data including IP addresses, that are provided to us through our website. This means that all data submitted to our website is transferred to AWS. The legal basis for processing is our legitimate interest.

We also use Google`s reCAPTCHA from Google to check whether data input is made by a human being or by an automated program. For this purpose, reCAPTCHA analyses the behavior of the visitor on the basis of various characteristics. This analysis begins automatically as soon as the visitor accesses the website. The legal basis for using reCAPTCHA is our legitimate interest.

We use so-called cookies on our website. Cookies are pieces of information that are transmitted from our web server or third-party web servers to your web browser and stored there for later retrieval. Cookies may be small files or other types of information storage. As set out in the UK`s Privacy and Electronic Communications Regulations (“PECR”) and the EU`s Privacy and Electronic Communications Directive (“PECD”), we need to obtain consent for the use of non-essential cookies. For further information on the cookies we use, please refer to our Cookie Policy.

c) Other information:

For business reasons, we analyze the data we have on web and server traffic patterns, website interactions, browsing behavior, etc. The analyses serve us alone and are not disclosed externally and processed using anonymous analyses with summarized and/or anonymized values (“Aggregated Data”). Aggregated Data could be derived from your Personal Data but is not considered Personal Data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Privacy Policy. For this purpose we use Google Analytics from Google. The legal basis is our legitimate interest and your consent. For further information on our use of Google Analytics, please refer to our Cookie Policy.

OTHER USES OF YOUR PERSONAL DATA

We may also collect, store, and use your Personal Data for the following purposes:

• to operate, manage, develop, and promote our business and, in particular, our relationship with you and related transactions, including, for example:
  • marketing purposes (when we have either gathered prior opt-in consent and/or have a legitimate interest to send you communications which we believe to be relevant and of use to you);
  • to operate, administer, and improve our website and other aspects of the way in which we conduct our business;
  • to offer you our products and services;
  • to provide you with services or information that you may have requested; and
  • to keep you informed and updated on relevant topics or services you may be interested in.
• to protect our business from fraud, money laundering, breach of confidence, theft of proprietary materials, and other financial or business crimes;
• to comply with our legal and regulatory obligations, bring and defend legal claims and assert legal rights; and
• if the purpose is directly connected with an assigned purpose previously made known to you.

We will only process your Personal Data as necessary so that we can pursue the purposes described above and where we have a legal basis for such processing. Where our lawful basis for processing is that such processing is necessary to pursue our legitimate interests, we will only process your Personal Data where we have concluded that our processing does not prejudice you or your privacy in a way that would override our legitimate interest. In exceptional circumstances, we may also be required by law to disclose or otherwise process your Personal Data.

CHANGE OF PURPOSE

We will only use your Personal Data for the purposes for which we collected it as detailed above, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you, and we will explain the legal basis which allows us to do so.

DATA SHARING

In certain cases, it is necessary to transmit the processed Personal Data in the course of data processing. In this respect, there are different recipient bodies and categories of recipients.

Internal

If necessary, we transfer your Personal Data within Quantiota. Access to your Personal Data is only granted to authorised employees who need access to the data due to their job, e.g., to provide our products or services or to contact you in case of queries.

External bodies

Personal Data is transferred to our service providers in the following instances:

• in the context of fulfilling our contract with you,
• to use marketing services and to advertise our products and services online,
• to communicate with you,
• to provide our website, and
• to state authorities and institutions as far as this is required or necessary.

International transfers

We may transfer your Personal Data to other companies as necessary for the purposes described in this Privacy Policy. In order to provide adequate protection for your Personal Data when it is transferred, we have contractual arrangements including non-disclosure agreements, data processing agreements, and standard contractual clauses regarding such transfers. We take all reasonable technical and organizational measures to protect the Personal Data we transfer.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We will delete your Personal Data when we no longer need such Personal Data, for instance, where:

• it is no longer necessary for us to retain your Personal Data to fulfil the purposes for which we had collected it;
• we believe that your Personal Data that we hold is inaccurate; or
• in certain cases where you have informed us that you no longer consent to our processing of your Personal Data.

Sometimes, however, there are legal or regulatory requirements which may require us to retain your Personal Data for a specified period, and in such cases we will retain your Personal Data for such specified period; and we may need to retain your Personal Data for certain longer periods in relation to legal disputes, and in such cases we will retain it for such longer periods to the extent required.

DATA SECURITY

Our website uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as contact requests that you send to us. We have also implemented numerous security measures (“technical and organizational measures”) for example encryption or need-to-know access, to ensure the most complete protection of Personal Data processed through our website.

SOCIAL MEDIA

We are present on social media based on our legitimate interest. If you contact or connect with us via social media, we and the relevant social media platform are jointly responsible for the processing of your data and enter into a so-called joint responsibility agreement. The Personal Data collected when you contact us is used to process your request, and the basis for this is both your consent and our legitimate interest.

MARKETING

Insofar as you have given us your consent to process your Personal Data for marketing and advertising purposes, we are entitled to contact you for these purposes via the communication channels you have given your consent to. Our marketing generally takes the form of email but may also include other less traditional or emerging channels. These forms of contact will be managed by us or by our contracted service providers. Every directly addressed marketing sent by us or on our behalf will include a means by which you may unsubscribe or opt out.

LINKED SITES

For your convenience, there may be hyperlinks on our website that link to other websites. We are not responsible for, and this Privacy Policy does not apply to the privacy practices of any linked websites or of any companies that we do not own or control. The website links may collect information in addition to the information we collect.

We do not endorse any of these linked websites, their products, services, or any of the content on their websites. We encourage you to seek and read the Privacy Policy of each linked website that you visit to understand how the information that is collected about you is used and protected.

YOUR RIGHTS AND PRIVILEGES

Privacy rights

You can exercise the following rights under the DPA and GDPR:

• The right to access;
• The right to rectification;
• The right to erasure;
• The right to restrict processing;
• The right to object to processing;
• The right to data portability;

Update your information and withdraw your consent

If you believe that the information we hold about you is inaccurate or request its rectification, deletion, or object to legitimate interest processing, please do so by contacting us.

Access Request

In the event you want to make a Data Subject Access Request, please contact us. We will respond to requests regarding access and correction as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days, we will tell you why and when we will be able to respond to your request. If we are unable to provide you with any Personal Data or to make a correction requested by you, we will tell you why.

What we do not do

• We do not request Personal Data from minors and children;
• We do not process special category data without obtaining prior specific consent;
• We do not use automated decision-making, including profiling; and
• We do not sell your Personal Data.

Who is the competent data protection authority?

The Commission nationale de l'informatique et des libertés (CNIL) (www.cnil.fr) is the relevant authority in France. If you believe that the processing of your Personal Data is not lawful, you can lodge a complaint with a data protection supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach the CNIL or any other supervisory authority.

Data Breaches and Notification

Databases or records containing Personal Data may be breached accidentally or through unlawful intrusion. As soon as we become aware of a data breach, we will notify all affected individuals whose Personal Data may have been compromised, and the notification will be accompanied by a description of the measures that will be taken to repair the damage caused by the data breach. Notifications will be sent as soon as possible after the violation is discovered.

USA SPECIFIC PROVISIONS

The following applies to users located in the United States. While we understand and appreciate that privacy and consumer data protection laws differ as they are subject to each state's legislature and that no data protection framework similar to the DPA or GDPR exists on a federal level, we are committed to follow and apply the for your state relevant privacy rules and regulations.

As of the day of drafting, the following states had enacted privacy and consumer data protection laws: California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia. Under consideration of the similarities of the above provisions, no conflict should arise pursuing a uniform approach in granting all users in the USA the same rights and privileges as set out above. However, should ambiguity occur, the most stringent provision is chosen to ensure the most comprehensive approach when it comes to protecting your Personal Data.

Further, the following also apply

1. “Shine the Light”

   “Shine the Light” law (Civil Code Section 1798.83) requires us to respond to requests from California asking about the business’s practices related to disclosing Personal Data to third parties for the third parties’ direct marketing purposes. You may make a request about our collection and disclosure of your Personal Data using the contact details provided.

2. COPPA (Children Online Privacy Protection Act)

   When it comes to the collection of Personal Data from children under the age of 13 years old, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, United States’ consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online. We do not specifically market to children under the age of 13 years old.

3. CAN SPAM Act

   The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations. To be in accordance with CAN SPAM, we agree to the following: If at any time you would like to unsubscribe from receiving future emails, you can email us, and we will promptly remove you from ALL correspondence.

4. Telephone Consumer Protection Act (TCPA)

   If we process your Personal Data for the purpose of sending you SMS marketing communications, you may manage your receipt of marketing and non-transactional communications from us by replying or texting ‘STOP’ if you receive our SMS communications. In this respect, the data processing is carried out solely on the basis of our consent in personalized direct advertising per SMS.

5. Controls For Do-Not-Track Features

   Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, our website does not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this policy.

6. Right to complain

   Finally, and in regard to the right to complain to a supervisory authority. You have the right to lodge a complaint about our processing of Personal Data with a supervisory authority responsible for data protection. Users based in the above-mentioned States may lodge a complaint with the relevant district attorney or attorney general office. However, we would appreciate the opportunity to address your concerns before you contact any supervisory authority.

CANADA AND MEXICO SPECIFIC PROVISIONS

Both Canada and Mexico have introduced data protection laws that are similar to the GDPR, namely Federal Law for the Protection of Personal Data in the Possession of Private Parties (“LFPDPPP”) supplemented by the Rules of the Federal Law for the Protection of Personal Data in the Possession of Private Parties in Mexico and the Personal Information Protection and Electronic Documents Act (“PIPEDA”) in Canada. Under consideration that the GDPR has played a pivotal role, no conflict should arise pursuing a uniform approach in granting all users in Mexico or Canada the same rights and privileges as set out above. However, should ambiguity occur, the most stringent provision is chosen to ensure the most comprehensive approach when it comes to protecting your Personal Data.

In terms of your right to complain, Canada’s national supervisory authority is the Office of the Privacy Commissioner (www.priv.gc.ca) and the National Institute of Transparency, Access to Information and Personal Data Protection (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales) (“INAI”) is the national supervisory authority in Mexico (www.ifai.org.mx).

HELP AND COMPLAINTS

If you have any questions about cookies or about data protection at Quantiota, you can contact us by email using info@quantiota.ai with “Data Protection” in the subject line.

CHANGES

The first version of this policy was issued on Tuesday, 26th of November, 2024, and is the current version. Any prior versions are invalid, and if we make changes to this policy, we will revise the effective date.

Cookie Policy Website

This Cookie Policy applies to our use of cookies and other similar technologies on our website at www.quantiota.ai. The purpose of this policy is to provide you with information about what cookies are and how they work. It also explains what cookies we use, what they do, and how you can control what cookies we use when you visit our website.

WHO IS THE DATA CONTROLLER?

A “data controller” is a person or organisation who alone or jointly determines the purposes for which and the manner in which any personal data is, or is likely to be, processed. In this sense, Quantiota SAS, 23 Avenue du Granier, 38240 Meylan (“Quantiota”, “we”, “us”, “our”) is the data controller. If you have any questions about cookies or about data protection at Quantiota in general, you can reach us using info@quantiota.ai with “Data Protection” in the subject line.

WHY DO WE HAVE A COOKIE POLICY?

In accordance with France’s Postal and Electronic Communications Code (Article L. 34-5) (“PECC”) and the EU`s Privacy and Electronic Communications Directive (“PECD”), we need to inform you about the cookies we use and obtain your consent when using certain types of cookies, namely functional, performance, analytics, and advertising cookies.

WHAT IS A COOKIE?

Cookies are text files containing small amounts of information which are downloaded to your device (e.g., computer, smartphone, electronic device which accesses the internet) when you visit a website. Cookies can be useful because they allow a website to recognise a user’s device, preferences and generally help to improve your online experience.

WHAT TYPES OF COOKIES DO WE USE?

There are three types of cookies that we use: necessary cookies, analytics cookies, and marketing cookies. These cookies perform different functions, as explained below.

• Necessary Cookies

  Necessary cookies are essential in order to provide you with the services you request on our website and in order that we can comply with legal obligations. We do not need to ask for your consent in order to use these cookies, as without them we would not be able to provide the services requested by you. These are always active on the website.

• Analytics Cookies

  Analytics cookies collect information about things like how many people visit our website, what parts of the website people look at, and how many new visitors we have to the website. These cookies help us to monitor how effective our website is and to improve it, tailoring it to our visitors. Analytics cookies are only used if you consent to them in our Cookie Consent Tool.

• Marketing/Advertising Cookies

  Marketing cookies help us provide you with personalized and relevant services or advertising and track the effectiveness of our digital marketing activities. They are capable of tracking your browser across other websites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. Advertising cookies are only used if you consent to it in the Cookie Consent Tool.

CONSENT

Necessary cookies will always be active on your device, but we ask for your consent to place analytics cookies, marketing cookies and other similar technologies on your device. If at any time you want to change your cookie settings, including withdrawing your consent to this processing, we would encourage you to do this via the links below. You may need to refresh the page before the changes to the settings take effect.

THE COOKIES WE USE

Google Analytics

We use Google Analytics, a web analysis service of Google. Google Analytics uses a specific form of cookie, which is stored on your device and enables an analysis of your use of our website. The cookies set by Google Analytics for measurement are different for each visitor (i.e. there is not a single Google Analytics cookie ID that is used on all sites using Google Analytics). The information about your use of our website generated by the cookie is generally transmitted to a Google server in the USA and stored there. The legal basis for the processing is your consent.

Google uses this information on our behalf to analyze your use of this website in order to compile reports on website activities and provide additional services related to website and internet use. The IP address transmitted by your browser in the context of Google Analytics is not merged with other data. In the configuration of Google Analytics, we ensured that Google receives this data as a processor and is therefore not allowed to use this data for its own purposes.

In relation to the data transfer into the USA Google’s processing agreement for Google Analytics, can be read here. You can disable tracking by Google Analytics with future effect by downloading and installing the Google Analytics Opt-out Browser Add-on for your current web browser following this link.

Pixel Cookies and Tags

We use so-called Pixel Cookies and Tags (“Pixel Cookies”). A Pixel Cookie is an advertising tool and typically consists of a JavaScript code snippet that allows us to understand and track visitors' activity on our website. For this purpose, Pixel Cookies collect and process information about visitors of our website and the device used (so-called event data).

Event data collected through Pixel Cookies is used for targeting our advertisements and improving ad delivery and personalized advertising. For this purpose, the event data collected on our website by means of Pixel Cookies is transmitted to the relevant operator of the Pixel Cookie and in part, also stored on your device. However, this only happens with your consent, and we and the relevant operator of the Pixel Cookie are considered joint controllers. Nonetheless, for the subsequent processing of the transmitted event data, the relevant operator of the Pixel Cookie is the sole controller.

For more information about how the relevant operator of the Pixel Cookie processes personal data, including the legal basis on which they rely on and how you can exercise your rights, please refer to the following privacy policies: X (formerly Twitter).

HOW TO BLOCK COOKIES AND THE CONSEQUENCES OF THIS

If you want to block all cookies, you may be able to do this through the settings in your browser for each browser you use and each device you use to access the internet (Google Chrome,Mozilla Firefox, Microsoft Edge, Opera, Safari).

We also offer a Cookie Consent Tool when you first visit our website. This tool allows you to specify your preference about cookies. You can accept or reject them or access this Cookie Policy before giving your consent to cookies or rejecting them. This permits you to make an informed decision about the cookies we use. You are free to accept or reject cookies, but note that after rejecting them, browsing our website might be less user-friendly and the relevant content might be affected.

In addition, if you do not wish to participate in advertising personalization or retargeting/tracking you can object to behavioral advertising at the following websites: Your Online Choices, Digital Advertising Alliance of Canada, Network Advertising Initiative, AdChoices the European Interactive Digital Advertising Alliance (Europe only), Google Ad Settings and X Ad Settings.

HELP AND COMPLAINTS

If you have any questions about this policy or the information we hold about you, you can reach us using info@quantiota.ai with “Data Protection” in the subject line.

CHANGES

The first version of this policy was issued on Tuesday, 26th of November, 2024, and is the current version. Any prior versions are invalid, and if we make changes to this policy, we will revise the effective date.

Privacy Policy SaaS

We want you to feel comfortable when you are using AI Agent our software as a service solutions and their underlying functions through our online Portal (“AI Agent”) and not have to worry about the security of your data. That is why data protection is an important part of our corporate philosophy.

In this Privacy Policy, you will find all the information about which Personal Data we collect and process and for what purpose. Equally, we will also inform you of your data protection rights and how you can assert them.

Please note that this SaaS Privacy Policy is supplemental to our Website Privacy Policy and applies to your use of AI Agent only. You should read this policy in line with our Website Privacy and Cookie Policy.

GENERAL PRINCIPLES

a) What is Personal Data?

Personal Data is any includes information relating to an individual who can be identified or who is identifiable, directly from the information in question; or who can be indirectly identified from that information in combination with other information.

b) What is processing?

Processing means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means. The term is broad and covers virtually any handling of data.

c) Who is responsible for data processing?>

A “data controller” is a person or organization who alone or jointly determines the purposes for which and the manner in which any Personal Data is, or is likely to be, processed. In this sense, Quantiota SAS, 23 Avenue du Granier, 38240 Meylan (“Quantiota”, “we”, “us”, “our”) is the data controller. If you have any questions about this policy or about data protection at Quantiota in general, you can contact us by email using info@quantiota.ai with “Data Protection” in the subject line.

d) What law applies?

Our use of your Personal Data is subject to France’s Data Protection Act (Law n° 78-17 and Ordinance n° 2018-1125) (“DPA”), the EU's General Data Protection Regulation (“GDPR”), and of course we process your Personal Data accordingly.

e) What are the Legal Bases for processing Personal Data

We have to have at least one of the following legal bases to process your Personal Data: a) you have given your consent, b) the data is necessary for the fulfilment of a contract / pre-contractual measures, c) the data is necessary for the fulfilment of a legal obligation, or d) the data is necessary to protect our legitimate interests, provided that your interests are not overridden.

f) How long and where will you keep my data?

We process and store your Personal Data only for the period of time required to achieve the respective processing purpose or for as long as a legal retention period exists (in particular commercial and tax law in accordance with France’s Commercial Law and Fiscal Code). Once the purpose has been achieved or the retention period has expired, the corresponding data is routinely deleted. All data collected is generally transferred to our Amazon Web Services (AWS) server and stored in a dedicated database. The legal basis for the data processing is our legitimate interest in providing AI Agent. We ensure that processing is governed by Processing Agreements that include Standard Contractual Clauses to ensure a high level of data protection. We store the data until you delete your user account. Insofar as legal retention periods are to be observed, storage also takes place beyond the time of deletion of a user account.

WHAT PERSONAL DATA DO WE PROCESS?

a) Contacting and contracting with us

You can contact us in various ways, and data is always collected in the process. You provide us with most of the data that we process when you contact us, such as your name and email address. This data is collected and processed exclusively for the purpose of contacting you and processing your request and then deleted again, provided that there is no legal obligation to retain it.

We process the personal data that arises when you use AI Agent in order to provide our contractual services. In particular, this includes our support, correspondence with you, invoicing, fulfilment of our contractual, accounting, and tax obligations. Accordingly, the data is processed on the basis of the fulfilment of our contractual obligations and our legal obligations.

If you register, we will request mandatory and, where applicable, non-mandatory data in accordance with our registration form (your name, company name, email address and telephone number, and your selected password). The entry of your data is encrypted so that third parties cannot read your data when it is entered. For the purpose of logging in to AI Agent, you will provide your password together with your email address. We will hold your data for further orders as long as you have your account and user contract with us.

If you take out a subscription, your payment data will be processed via our payment service provider, Stripe. Payment data will solely be processed through Stripe, and we have no access to any Payment Data you may submit. The legal basis for the provision of a payment system is the establishment and implementation of the contract.

Lastly, we process data in the context of administrative tasks as well as organization of our operations, financial accounting, and compliance with legal obligations, such as archiving. In this regard, we process the same data that we process in the course of providing our contractual services. The purpose and our interest in the processing lies in the administration, financial accounting, office organization, archiving of data, i.e., tasks that serve the maintenance of our business activities, performance of our tasks, and provision of our services.

The legal basis for processing the above is our legitimate interest, the provision or initiation of a contractual service, and your consent.

b) When using AI Agent

If you wish to use AI Agent and its features, we process the data you provide (depending on how you are using AI Agent) which may include Personal Data, and Special Category Data or non-personal data that you and/or your employees or your service users (as applicable) make available to us (“Service Data”).

We recognise that you own your Service Data and provide you with complete control of your Service Data by providing you the ability to (i) access your Service Data, (ii) share your Service Data through supported third-party integrations, and (iii) request export or deletion of your Service Data.

When we process Service Data, we become your Data Processor or in other words, we will process the Service Data involved in your use of AI Agent in accordance with your instructions and shall use it only for the purposes agreed between you and us.

We ensure that access by our employees to your data is only available on a need-to-know basis, restricted to specific individuals, and is logged and audited. We communicate our privacy and security guidelines to our employees and enforce privacy and protection safeguards strictly.

Some jurisdictions may require you to disclose your use of our SasS as your processor in your privacy policy and/or data processing agreement as applicable. For this purpose, all Service Data processed by us will be processed using AWS and we will take appropriate legal precautions and corresponding technical and organizational measures to ensure the protection of your Service Data.

We and you agree that the 2021 Standard contractual clauses for international transfers will apply to personal data that is transferred via the Services from the UK, European Economic Area or Switzerland, either directly or via onward transfer, to any country or recipient outside the UK, European Economic Area or Switzerland that is not recognised by the European Commission as providing an adequate level of protection for personal data.

Further and if you are providing us with Personal Data relating to a third party, you agree a) that you have in place all necessary appropriate consents and b) that such third party has read this Privacy Policy. You agree to indemnify us in relation to all and any liabilities, penalties, fines, awards, or costs arising from your non-compliance with these requirements.

The legal basis for the processing of your Service Data is our obligation to fulfil the contract we have with you.

c) Support ticket

If you create a support ticket, we will request Personal Data and, where applicable, non-Personal Data in accordance with your request; this may include your name, email address, and other service-related data you voluntarily provide. The data provided is not shared with third parties, and cannot read your data when it is entered. If you submit a support ticket, we process the data for the purpose of processing and handling your ticket.

Our employees will also have access to data that you knowingly share with us for technical support or to import data into our services. We communicate our privacy and security guidelines to our employees and enforce privacy safeguards strictly. The legal basis of the data processing is our obligation to fulfil the contract and/or our legitimate interest in processing your support ticket.

DATA SHARING

In certain cases, it is necessary to transmit the processed Personal Data in the course of data processing. In this respect, there are different recipient bodies and categories of recipients.

Internal

If necessary, we transfer your Personal Data within Quantiota. Of course, we comply with the associated legal framework and ensure that your data is processed properly. Access to your Personal Data is only granted to authorised employees who need access to the data due to their job, e.g., to provide our services or to contact you in case of queries.

We may also share your Personal Data with our Business Partners for the purposes described in this Privacy Policy, including (but not limited to) conducting the services you request or customizing our business to better meet your needs.

External bodies

Personal Data is transferred to our service providers in the following instances:

• in the context of fulfilling our contract with you,
• to use marketing services and to advertise our services online,
• to communicate with you,
• to provide AI Agent, and
• to state authorities and institutions as far as this is required or necessary.

International transfers

We may transfer your Personal Data to other companies as necessary for the purposes described in this Privacy Policy. In order to provide adequate protection for your Personal Data when it is transferred, we have contractual arrangements regarding such transfers. We take all reasonable technical and organizational measures to protect the Personal Data we transfer.

SECURITY OF YOUR DATA

In order to protect the data stored with us in the best possible way against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons, we use appropriate technical and organizational security measures. The security levels are continuously reviewed in cooperation with security experts and adapted to new security standards.

Nevertheless, internet-based data transmissions can always have security gaps, so that absolute protection cannot be guaranteed. And databases or data sets that include Personal Data may be breached inadvertently or through wrongful intrusion. Upon becoming aware of a data breach, we will notify all affected individuals whose Personal Data may have been compromised as expeditiously as possible after which the breach was discovered.

YOUR RIGHTS AND PRIVILEGES

a) Privacy rights

You can exercise the following rights:

• The right to access;
• The right to rectification;
• The right to erasure;
• The right to restrict processing;
• The right to object to processing;
• The right to data portability;

b) Update your information and withdraw your consent

If you believe that the information we hold about you is inaccurate or request its rectification, deletion, or object to legitimate interest processing, please do so by contacting us.

c) Access Request

In the event you want to make a Data Subject Access Request, please contact us. We will respond to requests regarding access and correction as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days, we will tell you why and when we will be able to respond to your request. If we are unable to provide you with any Personal Data or to make a correction requested by you, we will tell you why.

d) Complaint to a supervisory authority

The Commission nationale de l'informatique et des libertés (CNIL) (www.cnil.fr) is the relevant authority in France. If you believe that the processing of your Personal Data is not lawful, you can lodge a complaint with a data protection supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach the CNIL or any other supervisory authority.

e) Data Breaches and Notification

Databases or records containing Personal Data may be breached accidentally or through unlawful intrusion. As soon as we become aware of a data breach, we will notify all affected individuals whose Personal Data may have been compromised, and the notification will be accompanied by a description of the measures that will be taken to repair the damage caused by the data breach. Notifications will be sent as soon as possible after the violation is discovered.

f) What we do not do

• We do not request Personal Data from minors and children;
• We do not process special category data without obtaining prior specific consent;
• We do not use automated decision-making, including profiling; and
• We do not sell your Personal Data.

HELP AND COMPLAINTS

If you have any questions about this policy or the information we hold about you, please contact us by email using info@quantiota.ai with “Data Protection” in the subject line.

CHANGES

The first version of this policy was issued on Tuesday, 26th of November, 2024, and is the current version. Any prior versions are invalid, and if we make changes to this policy, we will revise the effective date.

AI Act Statement

As a business utilizing artificial intelligence (“AI”) technologies, we are committed to adhering to all relevant regulations and ethical guidelines governing the use of AI. Our practices are aligned with industry standards and legal requirements to ensure transparency, fairness, and accountability in the deployment of AI systems. We recognise the importance of safeguarding privacy, data protection, and mitigating biases in AI algorithms to uphold the rights and dignity of individuals.

While AI presents numerous opportunities, it also entails certain risks that warrant careful consideration. These risks include potential biases in data collection and algorithmic outputs, privacy infringements, security vulnerabilities, and unintended consequences of automated decision-making. Additionally, the reliance on AI systems may pose challenges related to accountability, transparency, and interpretability, leading to ethical dilemmas and societal concerns.

We recognize the importance of responsibly using AI technologies to unlock their full potential while mitigating associated risks. We are committed to transparency, accountability, and ethical practices in our AI initiatives, striving to uphold the highest standards of integrity and fairness. By embracing AI responsibly, we aim to foster trust, drive positive outcomes, and contribute to the advancement of society in alignment with regulatory requirements and ethical principles.

In accordance with current best practices, the White House Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, and the upcoming Artificial Intelligence Act ("EU AI Act"), we have taken the following steps: (i) assessed the risks associated with your use of our AI (Limited risk); (ii) raise awareness (our policies, this statement, and the use of AI are clearly described); (iii) designed our AI on ethical principles; (iv) assigned responsibility over our AI to our CTO; (v) continue to develop our AI and keep it up-to-date; and (vi) established formal governance.

This AI Act Statement was last updated on Tuesday, 26th of November, 2024, and is the current and valid version. However, we want to point out that from time to time, due to actual or legal changes, a revision to this AI Disclosure Statement may be necessary. If you have any questions, please contact us using info@quantiota.ai with “AI” in the subject line.