Privacy policy

01Data controller

02Data Protection Officer

03Our dual role: controller and processor

04Data we process as controller

• We do run commercial email prospecting aimed at companies and professionals, managed through HubSpot. It is the only purpose for which we use contact data obtained from third parties.
• Where you did not give us the data yourself, our first message tells you that we are writing to you, why, and where your data came from, as required by article 14 GDPR. You can ask us at any time to tell you exactly which source it was.
• Every commercial message includes a simple, free way to opt out, and you can also object by writing to info@quantummycos.com. Once you object we stop writing to you, and we keep only the minimum needed to avoid contacting you again by mistake.
• We do not send commercial messages to private individuals’ personal addresses, we neither share nor resell these contacts, and we do not use them for any purpose other than the one stated.

05Data we process on our customers’ behalf

• Special categories (article 9 GDPR): we neither ask for nor need special category data to provide the service. Certain uses a customer may configure, such as attaching sick notes or reading the mood indicator per person, can involve health data. It is for the customer to judge whether that is lawful and proportionate and, where required, to carry out an impact assessment.
• Biometric data: Quantummycos processes no biometric data of any kind. Clock-ins use no fingerprint, no face recognition and no other biometric identification.
• We do not use our customers’ employee data for our own purposes, do not disclose it except to the processors listed below, do not use it to train artificial intelligence models and do not sell it under any circumstances.

06Purposes and legal bases

• For processing based on legitimate interest we have carried out the balancing test between our interest and the rights of the people affected. You can ask us about it by writing to info@quantummycos.com.
• As processor, the purpose is solely to provide the service the customer company bought. The legal basis for processing its employees’ data is for that company to determine, usually the performance of the employment contract (art. 6.1.b), compliance with legal obligations (art. 6.1.c, in particular the daily time record required by art. 34.9 of the Spanish Workers’ Statute) and its legitimate interest in organising work (art. 20.3 of the Workers’ Statute and art. 6.1.f).

07Geolocation on clock-in

• It is off by default. Nothing is recorded unless the customer company explicitly switches it on in its account settings.
• When it is on, only the latitude and longitude at the instant of the CLOCK-IN are captured, together with the accuracy radius the device reports. Nothing is captured at clock-out or on breaks.
• There is no continuous tracking. Location is not followed during the working day, outside it, or with the app in the background.
• Beyond those coordinates and their accuracy radius nothing else is collected: no speed, no routes, no altitude, no nearby wifi networks, no cell identifiers.
• Coordinate history is kept for the same period as the time record it belongs to.

08Artificial intelligence and automated decisions

• No automated decisions with legal effects, or that significantly affect people, are taken within the meaning of article 22 GDPR. The assistant looks things up and presents them: it does not discipline, score, rank or recommend disciplinary, promotion or dismissal measures. Every decision about an employee is taken by the customer company through human means.
• No profiling of employees is carried out for predictive or automatic assessment purposes.
• The model provider receives the question, the conversation so far and the account data the assistant looks up to answer it, within the scope of the asker's role. And, when somebody uses “Upload latest payslip” on an employee record, that payslip, to read its amounts: only the figures come back, and the provider does not keep it. The copy that is kept is the one left in that person's files, in the app's storage, like any other document. Nothing else.
• The text of each question is kept, with its date and the model usage, to apply each plan's daily limit and to handle support issues. The text is deleted after 90 days. Answers are not stored.
• The data is not used to train or improve the provider’s models. We use its programming interface, whose terms exclude content from training by default.
• The model provider acts as a sub-processor, bound by a data processing agreement and standard contractual clauses. It is listed in the recipients table.

09Who we share data with

• Public authorities and official bodies where there is a legal obligation: the Spanish tax agency, the social security treasury, the labour inspectorate, law enforcement and the courts.
• Tax, accounting and legal advisers, within the scope of their professional services.
• Financial institutions, to handle collections and payments.

10International transfers

11How long we keep data

12Your rights

• How to exercise them: write to info@quantummycos.com saying which right you want to exercise and attaching a copy of a document proving your identity. We will reply within one month at most, extendable by two more months in particularly complex cases, and we will tell you if that happens.
• If you are an employee of a customer company, send your request to your employer, which is the controller. If you send it to us, we will pass it on without delay and tell you we have.
• Complaints: if you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, at www.aepd.es or through its electronic office at sedeagpd.gob.es.
• We would appreciate the chance to sort it out first, by writing to info@quantummycos.com, before you go to the supervisory authority.

13Security measures

• TLS encryption on every connection to the website and the application.
• Encryption of data at rest in the document store.
• Passwords stored using key derivation functions. They are never kept in plain text.
• Token-based authentication with expiry and session control.
• Role and privilege based access control, on a least-privilege basis.
• Activity logging and traceability of sign-ins and significant actions.
• Logical separation of each customer’s data.
• Regular backups and verified restore procedures.
• Request rate limiting and protection against automated abuse.
• Regular dependency review and application of security updates.
• Access to customer data restricted to strictly necessary staff, under a duty of confidentiality.

14Minors

15Cookies and third-party links

16Changes to this policy, and contact