Legal
Data processing agreement
This agreement governs how Quantummycos processes, on behalf of each customer company, the personal data of its staff and of the other people whose data the company manages in the application. The company, as controller, decides why and how that data is processed; Quantummycos, as processor, processes it on the company’s instructions.
Updated:
01Subject matter, parties and term
This agreement governs the processing of personal data that Quantummycos S.L. (“Quantummycos”), as processor, carries out on behalf of the customer company (the “company”), as controller, when providing it with the Quantummycos service. Quantummycos S.L. has tax ID (NIF) B05830500 and its registered office at Taras Bulba 6, Oficina 2A, Málaga, España, and is registered in the Registro Mercantil de Málaga, folio electrónico, hoja MA-202203, inscripción 1.ª, IRUS 1000481417452. The agreement complies with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR) and Article 33 of Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
It forms part of the service’s Terms and conditions. If the two conflict on a data protection matter, this agreement prevails.
It lasts as long as the service contract. The duty of confidentiality survives the termination of this agreement without limit of time; the obligations of blocking, return and erasure of the data continue until they have been fulfilled.
02Description of the processing
The processing the company entrusts to Quantummycos is as follows.
| Item | Detail |
|---|---|
| Purpose | Providing the company with the Quantummycos service in the modules its plan includes: time recording, with location at clock-in, if the company uses it, and its map; absences, annual leave and public holidays; shifts and shift swaps; performance reviews; surveys; company news; document compliance and the file repository, payslips included; onboarding and offboarding; pay, cost analysis and the pay register; reports and exports; the whistleblowing channel, with a public entry point for people outside the company; email notices, with a record of their delivery and opening, and phone notifications, clock-in reminders included; the AI assistant, which answers with the permissions and scope of the asker’s role and reads the figures on payslips uploaded to it; and technical support. |
| Nature | Collection, recording, organisation, structuring, storage, alteration, consultation, aggregation and compilation of statistics, automated extraction of payslip figures, communication by email and by phone notification, transmission to sub-processors, blocking and erasure. |
| Duration | That of the service contract. When it ends, the section “Retention and end of the processing” applies. |
| Data subjects | The company’s employees and anyone else it gives access to the application, administrators included; people who no longer work there and whose history the account keeps; in the whistleblowing channel, anyone who submits a report (including people outside the company, through the public entry point), the people it concerns and witnesses; and third parties who appear in the data, such as an employee’s relatives (in family-related absences, the Modelo 145 tax form or the emergency contact) and people named in documents, notes or messages. |
03Categories of data
Depending on the modules it uses and what it enters in them, the company may process the following categories of data in Quantummycos.
| Area | Data |
|---|---|
| Identity and contact | First name and surnames, email address, phone number, photo, language, job title, department and role in the application. |
| Identifiers and personal characteristics | Where the company enters them: Spanish identity number or foreigner identity number (DNI or NIE), social security number, sex, date of birth, and country and region, to apply public holidays. |
| Employment | Contract type, start date, working hours and schedule, status (active, archived or deleted), annual leave days for each year, public holidays that apply to the person, shifts and shift swaps, and the tasks and notes of their onboarding and offboarding. |
| Time records | Clock-ins, clock-outs and breaks, with their notes; correction requests and their outcome; the history of every change; and the mood, from 1 to 5, that the person may choose to give at clock-out, which is stored under their name. |
| Location | On plans that include geolocation, the “Use location when clocking in” option is switched on by default, and the company can switch it off in Settings. While it is on, the device’s coordinates are recorded at clock-in, with their accuracy radius, or the reason they could not be obtained; in the mobile app they may be the coordinates the phone obtained in the previous 30 seconds. If the company also switches on “Require location to clock in”, clocking in is possible only with a position. |
| Absences | Dates, type, full or half day, status, notes from the person and from the reviewer, the reason when an approved absence is withdrawn, and attached supporting documents. |
| Documents and files | The documents the company requests and those the person submits, with their notes, review, dates and expiry; policies that are read and acknowledged; and files in the repository, payslip folders included. |
| Pay | Annual base salary, supplements, variable pay and pay in kind, number of payments a year and, from the latest payslip, gross pay, net pay and employer cost; and the payslips themselves. |
| Reviews | The reviewer’s agenda and notes, public and private; goals; notes from the person reviewed; and attachments. The person reviewed sees neither the private agenda nor the private notes. |
| Surveys | Questions and answers. In named surveys each answer is stored with the person. In anonymous ones it is stored without them, and all that is recorded about each person is that they have answered and when; the application does not let anyone see who gave each answer, although the order in which answers are stored in the database would allow them to be linked to the people who gave them. |
| News | What the company publishes for its staff, which may mention people (for instance, to mark a birthday), and who publishes it. |
| Whistleblowing channel | Category, title and description of each report, date of the events, people involved and witnesses; the reporter’s name and contact details, only if the report is not anonymous; and follow-up messages, status and outcome. |
| Communications | A copy of every email and notification sent (subject, text and recipients), with its status and, for emails, their delivery and opening; and the push notification token and operating system (iOS or Android) of each phone with an open session. |
| AI assistant | Questions and the conversation; the data it looks up to answer, with the permissions and scope of the asker’s role; and payslips uploaded for it to read their figures. |
| Support | Support cases the company opens in the application, with their description, comments and attachments, and the messages it sends to Quantummycos support. |
| Technical data | Sessions (type, app and dates); the activity log (what was changed, on which record, by whom and when, with the IP address and the request’s technical data and, for entries made before 28 September 2026, the content of the request as well); and saved views and filters. |
04Special categories and other sensitive data
The service allows special categories of data (Article 9 GDPR) and data relating to possible criminal offences (Article 10) to be recorded. The company decides whether to enter them, and to do so it needs one of the exceptions in Article 9(2) GDPR: ordinarily point (b), on obligations in the field of employment and social security and social protection law; in the whistleblowing channel, point (g), for reasons of substantial public interest, as provided in Article 30 of Spanish Law 2/2023 of 20 February on the protection of persons who report regulatory breaches and on the fight against corruption.
The type of each absence is visible to anyone whose role gives them access to that person’s absences. The AI assistant includes it in its answers to anyone with that access and, when it describes attendance on a given day, also to anyone who only has access to that person’s clock-ins. Absence types are also used in dashboards, in reports (for instance, in the count of sick leave days) and in cost analysis. They do not appear in phone notifications or in notice emails.
In particular, the service may contain the following data.
- Health: the absence types “Sick leave”, “Work accident”, “Medical appointment”, “Birth and childcare”, “Breastfeeding” and “Serious illness or hospitalisation of a relative”, with their supporting documents, such as a sick note; the fitness certificate from the occupational health check and the Modelo 145 tax form, which records the degree of disability of the person and of their relatives, both in the document catalogue each account starts with, which the company can change; the mood each person may give at clock-out, which, being stored under their name, may reveal information about their health; and health-related survey answers, such as the question on allergies and intolerances in the “Company dinner” survey template.
- Data that may reveal trade union membership: the absence types “Union or works council duty” and “Strike”.
- Whistleblowing channel: any special category data a report contains (for instance, on sexual harassment or discrimination) and data relating to possible criminal offences.
- Other data that calls for particular care, although it is not a special category: pay and payslips, the DNI or NIE, the social security number, the bank account ownership certificate, the work permit, location at clock-in and private review notes.
05The company’s instructions
Quantummycos processes the data only on the company’s documented instructions. The documented instructions are this agreement, the Terms and conditions, the way the company configures the service (the modules it uses, the roles and permissions it assigns and its account settings, including those it keeps at their initial value, such as location at clock-in or two-step sign-in) and any instructions it gives in writing.
If Quantummycos considers that an instruction infringes the GDPR or other data protection law, it will inform the company immediately (Article 28(3), second subparagraph, GDPR) and may suspend carrying it out until the company changes it or shows that it complies with the law.
If Union or Member State law requires Quantummycos to process the data otherwise, it will inform the company of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Article 28(3)(a) GDPR).
If an authority or a court asks Quantummycos for access to the company’s data, it will inform the company, unless the law prevents it, and will disclose only the data it is required to provide.
06Quantummycos’s obligations
In addition to the other sections of this agreement, Quantummycos undertakes to:
- Process the data only to provide the service, without prejudice to the section “Data Quantummycos processes as controller”.
- Not disclose it to third parties, except to the sub-processors authorised in this agreement or where the law requires it, and not use it to train artificial intelligence models.
- Ensure that the people authorised to process it have committed to confidentiality or are subject to the duty of confidentiality in Article 5 LOPDGDD, which continues after their relationship with Quantummycos ends.
- Apply the measures in the section “Security measures” (Article 32 GDPR).
- Assist the company, with the information available to it, in meeting its obligations on security, personal data breach notification, impact assessments and prior consultation (Articles 32 to 36 GDPR). In particular, it will provide the information the company needs to assess the impact of location at clock-in, the whistleblowing channel, health-related absence types and the AI assistant.
- Keep a record of the processing activities it carries out on the company’s behalf (Article 30(2) GDPR and Article 31 LOPDGDD).
- Make available to the company the information needed to demonstrate compliance with this agreement, and allow the audits in the section “Audits and inspections”.
- Return or erase the data when the processing ends, at the company’s choice, in accordance with the section “Retention and end of the processing”.
07Security measures
Quantummycos applies at least the following technical and organisational measures, appropriate to the risk of the processing (Article 32 GDPR). It may replace them with equivalent measures provided the level of security is not reduced.
- Hosting: the service’s servers, database and files are in the European Union.
- Encryption in transit: communications with the web application, the mobile app and the API are encrypted with TLS.
- File storage: files are kept in private storage, encrypted at rest, and can be opened only through signed, time-limited links, which are issued to someone with a signed-in session and, for downloads, after checking that they have access to the file.
- Passwords: stored with bcrypt, a hashing function that does not allow them to be recovered, and never stored in plain text.
- Two-step sign-in: with a code sent by email; each company can require it for all its accounts, and it is mandatory for Quantummycos staff.
- Sessions and usage limits: sessions expire, and there are limits on the number of requests per account and of attempts with each verification code.
- Role-based access control: every user has a role, with permissions to view, create, edit, approve, archive and delete in each module, and a scope (the whole company, their departments or only their own data).
- Restricted pay data: within the company, amounts can be seen only by the person concerned and by roles whose scope is the whole company, and payslip folders only by the person and those same roles. Authorised Quantummycos staff also see them, read-only, when they use “Login as”.
- Activity log: changes made to the company’s data with a signed-in session are recorded with what was changed, on which record, by whom and when, except changes in the whistleblowing channel, survey answers, questions to the AI assistant and account links, which are excluded to protect their confidentiality. The company can consult it if its plan includes that module.
- Minimisation in notices: phone notifications say only what has happened and its date or time, without the absence type or the reason; notice emails do not include the content of records; and in the stored copies of emails, access codes are hidden.
- Geolocation: it is recorded only when clocking in, never obtained in the background, and stored only if the plan includes geolocation and the “Use location when clocking in” option is switched on.
- Whistleblowing channel: the follow-up code is stored hashed, anonymous reports are not linked to any account, and the dates of each report, its handling and its messages are stored as days, without a time. The channel is outside the activity log, the AI assistant and “Login as” access.
- AI assistant: it looks up data with the permissions and scope of the asker’s role, and pay data only if that role’s scope is the whole company; it does not consult the whistleblowing channel; and its provider does not use the data to train its models.
- Backups: database backups are made.
- Staff access: access by Quantummycos staff is limited to those who need it, subject to confidentiality and, through “Login as”, read-only and recorded.
08Access by Quantummycos staff
Only the Quantummycos staff who need it to provide the service have access to the company’s data, and always under a duty of confidentiality.
To provide support or resolve an incident, authorised Quantummycos staff can view the company’s account read-only, using the “Login as” feature: they see what its administrator would see, except the whistleblowing channel, and cannot change anything. Each access lasts 60 minutes at most and is recorded: who accessed which company, and when.
To manage accounts and provide support, those staff can also see the list of each company’s users (name, email, photo and role), the support cases the company opens, with their attachments, and the service’s error records.
09Sub-processors
The company gives Quantummycos general authorisation to use, in providing the service, the sub-processors listed in the table in this section (Article 28(2) GDPR).
Quantummycos undertakes to bind each sub-processor by contract to the data protection obligations in this agreement that are relevant to the service it provides, with sufficient guarantees that it applies appropriate technical and organisational measures, and remains liable to the company for their performance (Article 28(4) GDPR).
Before adding or replacing a sub-processor it contracts directly, Quantummycos will notify the company by email at least fifteen days in advance. The company may object in writing, giving reasons, within that period; if Quantummycos cannot offer it a reasonable alternative, the company may terminate the contract without penalty before the change takes effect.
Each provider in the table in turn uses its own sub-processors, which appear in the list or information each provider publishes. When a provider announces a change to them, Quantummycos passes the notice on to the company as soon as it receives it, and the company may object to that change in writing, giving reasons, within the following fifteen days; if Quantummycos cannot offer it a reasonable alternative, the company may terminate the contract without penalty.
The providers with which Quantummycos, as controller, processes the data of its own business (the website, sales follow-up, payments and analytics), described in the Privacy policy, are not sub-processors under this agreement. Nor are Apple and Google as app stores: the App Store and Google Play process, as independent controllers, the data of anyone who downloads the mobile app.
The authorised sub-processors are the following.
| Provider | Service | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Hostinger International Ltd. | Application and database servers | The database contents and the data handled by the web application and the API | European Union | No international transfer |
| Amazon Web Services EMEA SARL | File storage | Documents, payslips, photos, logos and attachments | European Union | No international transfer |
| Mailgun Technologies, Inc. | Sending the platform’s emails | Address, subject and content of each email, and its delivery and opening | European Union; technical support and service operations from the United States | EU-US Data Privacy Framework and standard contractual clauses |
| 650 Industries, Inc. (Expo) | Sending the mobile app’s notifications | Each phone’s push notification token (and, when the phone is registered, its Apple or Google identifier), and the title, text and target screen of each notice | United States | Standard contractual clauses |
| Apple Inc. | Delivering notifications to iPhones (Apple Push Notification service) | The iPhone’s Apple identifier and the title, text and target screen of each notice, to deliver it | United States | Standard contractual clauses |
| Google LLC | Delivering notifications to Android phones (Firebase Cloud Messaging) | The phone’s Google identifier and the title, text and target screen of each notice, to deliver it | United States and other countries where Google delivers the service | EU-US Data Privacy Framework and standard contractual clauses |
| Anthropic Ireland, Limited | Language model for the AI assistant | The question, the recent conversation and the data the assistant looks up to answer, with the permissions and scope of the asker’s role; and payslips uploaded for it to read their figures | United States and other countries where the provider delivers the service | Standard contractual clauses |
| Mapbox, Inc. | Maps of clock-in locations | Coordinates and accuracy of the clock-in being viewed, and the viewer’s IP address and browser, without the person’s name | United States and other countries where the provider delivers the service | EU-US Data Privacy Framework and standard contractual clauses |
| Google Cloud EMEA Limited (Google Workspace) | Quantummycos’s corporate email | Support cases and the messages the company sends to Quantummycos | United States and other countries where Google delivers the service | EU-US Data Privacy Framework and standard contractual clauses |
10International transfers
The service’s servers, database and files are in the European Union. The AI assistant, mobile app notifications, clock-in location maps, Quantummycos’s corporate email and the technical support and service operations of the email delivery provider involve transfers outside the European Economic Area, as shown in the sub-processor table.
Each transfer relies on one of the mechanisms in Chapter V GDPR: the adequacy decision on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023; Article 45 GDPR), for certified providers, or the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Article 46(2)(c) GDPR). Where a provider has both, the standard contractual clauses also apply.
The AI assistant’s provider receives the question, the recent conversation and the data the assistant looks up to answer, with the permissions and scope of the asker’s role, as well as payslips uploaded for it to read their figures. It does not use them to train its models and deletes them within thirty days at most, unless its systems flag them for possible misuse, in which case it may keep them for up to two years.
The “Open in Google Maps” link next to a clock-in map sends its coordinates to Google only if the person viewing the clock-in clicks it. In that case Google does not act as a Quantummycos sub-processor but as an independent controller, and handles the coordinates under its own terms.
The company can ask for a copy of the applicable standard contractual clauses by writing to info@quantummycos.com.
11Data subjects’ rights
Quantummycos will assist the company in responding to requests from data subjects exercising their rights of access, rectification, erasure, restriction of processing, portability and objection, and the right not to be subject to automated individual decision-making (Articles 15 to 22 GDPR). It will do so through the application’s features, which let the company view and correct the data, remove it from the application and, on plans that include reports, export the time record, absences, the pay register and staff data as PDF or Excel. It will also provide the company, on request, with any data the application does not let it obtain itself, in a structured, commonly used format and in good time for the company to reply within the one-month period in Article 12(3) GDPR.
Deleting an item in the application removes it from the application: it is no longer shown or usable, but it is not erased from the database. Where the company needs it erased permanently, for instance, to comply with a request for erasure or to erase a whistleblowing report that is not investigated (Article 32 of Law 2/2023), it will ask in writing and Quantummycos will erase it from the database and the files.
If a data subject contacts Quantummycos directly to exercise their rights over data processed on the company’s behalf, Quantummycos will pass the request on to the company without delay, will not resolve it itself and will inform the person that it has done so.
12Personal data breaches
When Quantummycos becomes aware of a personal data breach affecting data it processes on the company’s behalf, it will notify the company without undue delay and in any event within the following 48 hours, by email to its contact address and to whoever administers its account (Article 33(2) GDPR).
Where it is not possible to provide all the information at once, it will provide it in phases without further delay. It will assist the company in notifying the breach to the Spanish Data Protection Agency within the 72 hours in Article 33 GDPR and, where required, in communicating it to the data subjects (Article 34), and it will document the facts, their effects and the measures taken.
The notification will include, as far as is known:
- The nature of the breach and, where possible, the categories and approximate number of data subjects and of records concerned.
- The name and contact details of the person at Quantummycos who can provide more information.
- The likely consequences of the breach.
- The measures taken or proposed to address it and, where appropriate, to mitigate its possible adverse effects.
13Data Quantummycos processes as controller
Quantummycos processes the data in the following table as controller, not on the company’s behalf, and only for the purposes stated in it. It is the controller of the processing whose purposes it decides: that of the data of the company’s contact persons, including those who administer its account, to manage the contractual and business relationship with the company and send them service communications, and that of the links between the accounts one person holds in two companies, which are made at that person’s request. It is also the controller of the use it makes, for its own purposes, of the technical and usage data generated by providing the service, which it uses solely to protect its security, prevent and detect abuse, handle incidents and claims, apply each plan’s limits and bill for the service (Article 28(10) GDPR and Article 33(2) LOPDGDD). The company acknowledges and accepts this processing by entering into this agreement.
The legal bases are Quantummycos’s legitimate interest in the security and proper operation of the service, in managing its relationship with the company, including the plan’s limits and billing, and in acting on the request of anyone who links their accounts (Article 6(1)(f) GDPR and, for the company’s contact persons, Article 19 LOPDGDD); performance of the contract, as regards the data of a professional who enters into it as the company (Article 6(1)(b) GDPR); and compliance with its accounting and tax obligations (Article 6(1)(c) GDPR). The Privacy policy informs users of this processing.
Beyond what the table states, Quantummycos does not put the data it processes on the company’s behalf to any purpose of its own; in particular, it does not use it for advertising or to train artificial intelligence models.
In addition, opening any email from the service downloads its logo from the Quantummycos website, and the website’s server records, as with any visit, the IP address and browser of the person opening it. The Privacy policy provides information about this processing.
| Data | Purpose | Period |
|---|---|---|
| Name, email and language of the company’s contact persons, including those who administer its account | Managing the contractual and business relationship with the company and sending service communications, such as announcements of new versions or of changes to this agreement | While the company’s account exists and, after that, the periods stated in the Privacy policy |
| Sessions (type, app, person and dates), including access through “Login as” | Security of the service and a record of who accessed it and when | Four years from closure |
| Activity log, which for entries made before 28 September 2026 also includes the content of the request | Security of the service and handling of incidents and claims; the company can also consult it if its plan includes that module | Four years; the content of requests, until the processing ends |
| Error records (what failed, in which request and whom it affected, with the technical detail needed to fix it, which may include data from that request) | Detecting and fixing faults and attacks | While the company’s account exists |
| Text of questions to the AI assistant | Detecting misuse and handling incidents | Ninety days |
| Date and usage of each question to the assistant | Applying each plan’s usage limits | While the company’s account exists |
| One-time codes (two-step sign-in, password change and account linking) | Account security | Twelve months |
| Links between the accounts one person holds in two companies | Letting that person, at their request, switch from one account to the other | While the accounts of both companies exist |
| Plan, seats, number of people added and payments | Billing the service and meeting accounting and tax obligations | Six years for invoices and accounts (Article 30 of the Spanish Commercial Code) and four years for tax-relevant information (Article 66 of the Spanish General Tax Act, Law 58/2003) |
| Delivery and opening of the emails the service sends on behalf of Quantummycos, such as new version announcements | Knowing whether they have been delivered and opened | While the company’s account exists |
14The company’s obligations
The company, as controller, undertakes to:
- Have a legal basis for each processing operation and, where applicable, an exception under Article 9(2) GDPR for special categories, and inform its staff and other data subjects (Articles 13 and 14 GDPR), in particular that Quantummycos processes their data on the company’s behalf, and of the sub-processors and transfers in this agreement, the use of the AI assistant and the processing Quantummycos carries out as controller, with a reference to the Quantummycos Privacy policy.
- Use location at clock-in only within its powers of supervision (Article 20(3) of the Spanish Workers’ Statute) and, before using it, inform its staff and, where applicable, their representatives, expressly, clearly and unambiguously, of the existence and features of the system and of their rights (Article 90 LOPDGDD), and give the workers’ legal representatives the involvement they are entitled to (Article 64(5)(f) of the Statute). As the “Use location when clocking in” option is switched on by default on plans that include geolocation, the company must switch it off in Settings if it will not use location, or until it has met those requirements.
- Inform its staff that the application records the delivery and opening of each email the service sends them on the company’s behalf, and that the company can consult this.
- Explain to its staff that the mood question at clock-out is voluntary, and that each answer is stored under the name of the person who gives it and is visible to those with access to that person’s clock-ins.
- Give each person the role that matches their duties and check what each role can see and do. For instance, the “Department manager” role every account starts with can see, for people in its departments, their profile and identification data, their clock-ins and location, their absences with their type, the documents they submit and their reviews, including the reviewer’s private notes, as well as the file repository except payslip folders, and it can approve, create, edit and archive in those modules; it does not, however, see their pay or payslips.
- Restrict the permission over the whistleblowing channel, in roles whose scope is the whole company, to the people authorised by Article 32(1) of Law 2/2023, since that permission gives access to every report; appoint the person in charge of the internal reporting system (Responsable del Sistema, Article 8); and inform users of the channel in accordance with Article 31 of that law.
- Ensure the erasure required by Article 32 of Law 2/2023 (unnecessary data and special categories in a report, and reports not investigated within three months), and ask Quantummycos in writing for any erasure the application does not let it carry out itself.
- Enter only the data needed for its purposes (Article 5(1)(c) GDPR), particularly in free text, attachments and surveys, and review the document catalogue the account starts with so that it requests only the documents it needs.
- Decide how long it keeps each item of data, and keep the time record for four years (Article 34(9) of the Workers’ Statute).
- Safeguard the credentials of the people to whom it gives access to the application, and remove access from anyone who no longer needs it.
- Keep up to date the contact email in its account Settings, to which Quantummycos sends the notices under this agreement.
- Assess whether it needs an impact assessment (Article 35 GDPR), give its instructions in writing and oversee the processing.
15Audits and inspections
Quantummycos will make available to the company the information needed to demonstrate that it complies with this agreement. The company will first ask for it in writing, at info@quantummycos.com, and Quantummycos will answer its reasonable questions and questionnaires and provide the documentation available to it, including the terms and certifications its sub-processors publish.
If that information is not enough to demonstrate compliance, or a supervisory authority requires it, the company may carry out an audit, itself or through an independent auditor bound by confidentiality. It will give Quantummycos reasonable notice, of no less than thirty days unless the authority requires a shorter period or there has been a personal data breach affecting the company’s data, and will agree the scope and date of the audit with Quantummycos. The audit will be carried out without disrupting the service or compromising its security, at the company’s expense, and not more than once a year except in those two cases.
Quantummycos will cooperate with the Spanish Data Protection Agency and other supervisory authorities when they ask it to (Article 31 GDPR).
16Retention and end of the processing
For as long as the company’s account exists, Quantummycos keeps its data, including data the company removes from the application, unless the company asks for it to be erased permanently. The data in the section “Data Quantummycos processes as controller” follows the periods stated there, including after the processing ends.
Moving to the Free plan does not end the processing: the data is kept, and the data in modules the Free plan does not include stops being available to the company until it subscribes to them again.
The processing ends with the service contract; for instance, when the company asks for its account to be closed by writing to info@quantummycos.com. The company then decides, in writing, whether Quantummycos returns its data in a structured, commonly used format, to keep it or move it to another provider, or erases it (Article 28(3)(g) GDPR and Article 33(3) LOPDGDD). Quantummycos will return the data within thirty days of the written request.
Before erasing any data, Quantummycos will give the company its time record, which the company must keep for four years (Article 34(9) of the Workers’ Statute), and any other data the company tells it that it must keep by law: where the law requires data to be kept, it is returned to the controller instead of being destroyed (Article 33(3) LOPDGDD).
If the contract ends without the company having said which it prefers, Quantummycos will ask it and, until it receives an answer, will keep the data blocked.
Once the data has been returned, or erasure has been decided, Quantummycos erases it from the database and the files, including the content of requests held in activity log entries made before 28 September 2026. It keeps, duly blocked, only the data it needs while liabilities may arise from its relationship with the company (Article 33(4) LOPDGDD), available solely to judges and courts, the Public Prosecutor’s Office and the competent public authorities, in particular data protection authorities (Article 32 LOPDGDD), and erases it when those liabilities become time-barred. Erased data disappears from the database backups when those backups are no longer kept.
17Liability
Each party is liable for meeting the obligations that this agreement and data protection law place on it. If Quantummycos were to determine the purposes and essential means of any processing outside this agreement, it would be considered a controller in respect of that processing (Article 28(10) GDPR).
As regards data subjects, each party’s liability is as set out in Article 82 GDPR. If one party pays full compensation for damage for which the other is wholly or partly responsible, it may claim back from the other party the part of the compensation corresponding to that party’s responsibility (Article 82(5) GDPR).
Between the parties, the limitation of liability in the Terms and conditions applies, with the exceptions set out there: it does not apply in cases of wilful misconduct (Article 1102 of the Spanish Civil Code) or gross negligence, or in any other case where the law does not allow liability to be limited, and it does not affect the obligations data protection law places on each party or the rights it gives data subjects.
18Acceptance, notices and governing law
The company accepts this agreement when it signs up in the application, together with the Terms and conditions, and Quantummycos records the date of that acceptance.
Quantummycos sends the notices provided for in this agreement by email to the address shown as “Contact email” in the company’s account Settings, which the company must keep up to date. The company can contact Quantummycos about any data protection matter by writing to info@quantummycos.com.
Quantummycos may amend this agreement to reflect changes in the law or in the service. Each new version applies from its publication on this page to companies that sign up from that day onwards. For companies that already have an account, substantial changes are notified by the same means at least fifteen days before they take effect, and other changes apply from their publication. If the company does not agree with a substantial change, it may terminate the contract without penalty, by writing to info@quantummycos.com, before the change takes effect; otherwise, the change applies to it from the date it takes effect.
This agreement is governed by Spanish law and by the GDPR. Disputes are submitted to the courts indicated in the Terms and conditions. If the language versions of this agreement differ, the Spanish version prevails.