PRIVACY POLICY

1. Who we are

QuantumData Strategy, Lda. ("QDS"), tax identification No. 517874571, with registered office at Rua do Lago de Prata, n.º 16, C5, 2605-299 Belas, provides the website www.quantumdatastrategy.com (including quantumdatastrategy.pt) and the QDS Routes business platform, at app.quantumdatastrategy.com.

Contact for privacy matters and the exercise of rights: privacidade@quantumdatastrategy.com.

This Policy explains how we process personal data on our websites and services. QDS Routes is intended exclusively for businesses and professionals, but its users and the recipients of deliveries may be natural persons protected by the GDPR.

2. When we are a controller and when we are a processor

QDS is the controller of data collected for its own purposes, such as website inquiries, commercial communication, recruitment, security, administrative management, invoicing and certain authentication and account management operations.

As regards the data that customer organizations enter or generate in QDS Routes to manage deliveries, routes, vehicles and drivers, QDS acts, as a rule, as a processor: it processes them on behalf of and according to the instructions of the customer organization, which determines the purposes and essential means. This relationship is governed by the Data Processing Agreement (DPA).

The customer company is the main point of contact for requests concerning the operational data it controls. QDS provides it with the assistance required by the GDPR.

3. Personal data processed

On the corporate website: name, email, phone number, company, job title, content of contact or demonstration requests, newsletter preferences and data provided in job applications. While browsing, the IP address, technical information about the browser, security logs and usage data subject to the rules on cookies may be processed.

On the platform: users' names and emails, organization and access profile, authentication records, IP address, settings, technical events and data needed for contract management and security.

On behalf of customer companies: contact details and addresses of delivery recipients, instructions, delivery times and windows, identification of vehicles and drivers, itineraries, assignments and operational statuses.

Where the corresponding functionalities are actually available and activated, the following may also be processed: location data of vehicles or devices, coordinates associated with the completion of deliveries, proof-of-delivery photographs and their metadata. Location permission granted on the phone does not, by itself, amount to valid consent for its use in the employment context.

4. Purposes and legal bases

Contact requests, demonstrations and proposals: legitimate interest in responding to professional contacts, or pre-contractual steps where the data subject will be a party to the future contract (Article 6(1)(f) or (b) of the GDPR).

Newsletter and electronic marketing communications: consent where legally required, without prejudice to the situations permitted by the specific regime on electronic communications (Article 6(1)(a) of the GDPR).

Recruitment: pre-contractual steps with the candidate; retention for future opportunities with specific consent.

Contract management, invoicing and collection: performance of the contract when concluded with the data subject personally, legitimate interests in managing business contracts and compliance with legal tax and accounting obligations, depending on the operation (Article 6(1)(b), (f) or (c)).

Business user accounts, authentication, support and security: legitimate interest in providing, protecting and administering the platform; where the user is personally a contracting party, also contractual performance, as applicable.

Non-essential usage analysis: consent whenever legally required, including the rules on access to information on terminal equipment. Strictly technical security statistics may rely on legitimate interest, subject to the principles of the GDPR.

As regards operational data processed by QDS on behalf of the customer organization, it is for that organization to identify the applicable legal basis and ensure the duties of information.

5. Geolocation and worker data

QDS Routes is intended for the management of logistics operations and does not legitimize prohibited workplace surveillance. Article 20 of the Portuguese Labor Code prevents the use of remote surveillance means for the purpose of monitoring workers' professional performance.

Where location functionalities are made available, the customer company, as employer and controller, must ensure lawfulness, necessity, proportionality, prior information to workers and, where required, an impact assessment.

QDS will provide technical measures and information corresponding to the functionalities actually contracted and will provide assistance under the DPA. Location outside working hours or during private use should not be made available to the employer without a specific legal basis.

6. Technology providers and recipients

We use specialized providers necessary for the operation of the services, subject to the applicable contractual and legal obligations:

• Hetzner Online GmbH: main hosting, geocoding, maps and technical services, with servers identified in Helsinki, Finland.
• Amazon Web Services: authentication (Cognito), transactional email (SES), storage (S3), database replication for disaster recovery (RDS), content delivery (CloudFront: map server, status page and maintenance page, which see the IP address, the browser's user agent and the requested address) and text processing for the artificial intelligence assistant (Bedrock), with an endpoint in the Ireland region.
• HubSpot: management of contacts and forms on the corporate website, with a hosting region identified in the European Union.
• Network security and content delivery services: may process IP addresses and technical data indispensable for the protection and delivery of components of the service.
• Payment and invoicing providers, namely Stripe and InvoiceXpress, only when the corresponding subscription and invoicing functionalities are activated.

Public authorities may receive data where there is a legal obligation. We do not sell lists of users' personal data.

7. Transfers outside the European Economic Area

We favor infrastructure in the European Economic Area. Certain international providers may nevertheless involve access or transfers to third countries, even where the main servers are located in the European Union.

Where transfers of personal data take place, we apply the mechanisms provided for in Chapter V of the GDPR, namely adequacy decisions, standard contractual clauses and supplementary measures appropriate to the specific situation. Information on the mechanisms applicable may be requested through the contact given in this Policy.

8. Retention periods

Data is retained for as long as necessary for its purpose and for the periods required by law.

• Professional contacts and demonstration requests: during the handling of the request and any business relationship established, followed by a period of up to 24 months after the last contact, for follow-up and proof of communications.
• Newsletter: until cancellation or withdrawal of consent, without prejudice to the strictly necessary retention of proof of the choice made.
• Job applications: during the recruitment process; for future vacancies, only with specific consent and for a maximum of 12 months.
• Customer accounts and operational data: during the contract and for the legally applicable retrieval, return or deletion periods, in accordance with the DPA. There is no automatic deletion at the end of the contract; deletion is carried out by manual procedure, within the period provided for in the DPA.
• Invoicing data: during the legal tax and accounting retention periods.
• Technical logs and diagnostic data: for the period strictly necessary for security and error correction, not exceeding 13 months.
• Backups: according to documented technical cycles, with protection and limited access, until they expire (as a rule up to 4 months; the disaster recovery replica, 7 days).
• Location data and proofs of delivery: we do not apply automatic deletion; retention periods will be defined with the customer organization before these functionalities are activated, and anonymization may be requested.

9. Cookies and usage analysis

We use technologies necessary for authentication, security and remembering choices. Other technologies intended to measure audience or analyze behavior are used in accordance with applicable law, including obtaining prior consent where information is stored on or accessed from the device without a legal exemption.

Statistical analysis is hosted on QDS's infrastructure, but the absence of traditional cookies does not, by itself, remove the application of the legislation on access to terminal equipment. See the Cookie Policy for information on the technologies and the management of preferences.

10. Artificial intelligence

When the optional assistant is used, the content of the request may be transcribed and processed to generate the response. According to the technical architecture described, speech-to-text conversion is carried out on QDS's European infrastructure and the text needed for processing is sent to the Amazon Bedrock service, in the Ireland region.

QDS does not use customers' operational data to train its own models for purposes unrelated to the service contracted. Avoid including unnecessary personal information in requests.

11. Data subject rights

Depending on the legal conditions, data subjects have the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, as well as protection against certain decisions based solely on automated processing. Withdrawal of consent does not affect the lawfulness of processing carried out previously.

To exercise rights relating to processing for which QDS is responsible, write to privacidade@quantumdatastrategy.com. A response will be provided within the legal period, as a rule one month, extendable in the cases permitted by the GDPR.

Where the data was provided by a customer company, the request may be addressed to that company, as controller. QDS will forward requests that reach it and provide the assistance due.

Data subjects may file a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), and have recourse to the competent courts.

12. Security and changes to this Policy

We apply security measures proportionate to the risk, including protected communications, access control, logical separation by organization, backups and incident response mechanisms. Absolute security cannot be guaranteed.

This Policy may be updated to reflect legal or technical changes, and the date of the published version is indicated. Whenever a new purpose requires additional information or consent, we will follow the procedures legally required before implementing it.

For questions on data protection: privacidade@quantumdatastrategy.com.

In the event of any discrepancy between language versions, the Portuguese version prevails, without prejudice to applicable mandatory rights.