Review version for the pre-launch website. Email operations, provider contracts and safeguards, technical logs and retention require validation before final publication. This is not the messaging app's policy.
Reviewed:01 / QUANTUMCHAT
Data controller
QuantumChat GovSec, S.L.NIF: B21932728
Avenida Platja, 56, planta 1, puerta 2, 08930 Sant Adrià de Besòs, Barcelona, EspañaRegistro Mercantil de Barcelona · Sección 8 · Hoja B 635456 · Inscripción 1
BORME · 30/05/2025 · 244064 ceo@quantumchatapp.com info@quantumchatapp.com www.quantumchatapp.com02 / DPO
External Data Protection Officer
Manuel Navarro RajoyAEPD-DPD · A2025166DPD
info@legaldata.pro Agencia Española de Protección de Datos (AEPD)Scope and data
This notice covers the pre-launch website and demo dashboard, not the app or legacy systems. Browsing does not require an account. Server connections involve technical data such as IP address, time, requested resource and browser headers; actual logging and retention remain to be verified. The portal code contains no analytics, advertising, geolocation or profiling. The disabled launch form does not save or send emails. The contact form is a local demonstration. Do not enter real or sensitive data in demos.
Purposes and legal bases
If you email us, we receive your address, message and information you voluntarily provide. General enquiries rely on our legitimate interest in responding (GDPR Article 6(1)(f)); steps you request before a contract rely on Article 6(1)(b). Rights requests and legal duties rely on Article 6(1)(c). Serving and protecting the website may rely on the legitimate interest in a secure service, subject to minimisation and a documented balancing assessment. Providing enquiry data is voluntary, but we need a reply address to respond. This portal makes no automated decisions with legal or similarly significant effects.
Retention
Enquiries should be retained until resolved, then only necessary information for applicable legal liability periods, with restricted retention where required. The operational schedule for email, technical logs and backups still needs validation before final publication. No unverified 12-month log period or immediate deletion is claimed. Persistent demo storage has no automatic expiry; see the cookies policy for session details.
Recipients and transfers
The controller confirms OVH hosting in Spain and France. Authorised staff and hosting, email or support providers may need access under appropriate contracts, and authorities where legally required. The contracting entity, subprocessors, email service, locations and transfers still need verification. Declared hosting locations do not prove every processing activity stays in the EEA. The reviewed portal does not connect to Stripe, PayPal or Google reCAPTCHA.
Your rights
Contact the controller or DPO to request access, rectification, erasure, restriction, objection or portability where applicable. You may withdraw consent at any time without affecting earlier lawful processing. Requests are normally free and answered within one month; a justified extension of up to two further months must be notified within the first month. Do not send identity documents by default: proportionate additional information is only requested if there are reasonable identity doubts. You may complain directly to the Spanish supervisory authority (AEPD), without contacting us first.
Launch notification and gift
The launch list is not open. Once enabled, it must provide information beside the form and request specific permission for the launch announcement and gift, without other campaigns or restricting browsing. Gift terms, retention, email confirmation and easy withdrawal must be defined. Google reCAPTCHA is planned, not active; configuration, contract, storage and transfers need review before loading it. No children's data is requested through this inactive list. Purpose changes will be explained before new processing; browsing or scrolling is not consent. Approved rule for the future list: specific consent (GDPR Article 6(1)(a)). Delete data on withdrawal or at most one month after launch, whichever comes first; always before two years from signup, even if launch is delayed or cancelled. This does not apply to server logs and is not yet implemented in a backend.