Privacy Policy

The controller is Quandtec Ltd., a company registered in Canada (Province of Ontario). In accordance with the accountability principle, we have designated a privacy officer reachable at legal@quandtec.com.

We process personal data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian law.

Where a user is mandatorily subject to the data-protection law of their own jurisdiction (for example, the GDPR for EU residents), that law prevails to that extent. If the user's jurisdiction has no applicable data-protection law, we apply, as a minimum, PIPEDA-equivalent safeguards and international good practice, so that no user is left without protection.

We collect only the data we need: contact details you provide (name, email, company, message), contractual and billing data, and technical browsing data (approximate IP address, device type and pages visited) through analytics tools.

We use your data to respond to inquiries, to provide and bill services, to operate and secure our products, and to improve the site. The legal basis is performance of the contract, your consent, compliance with legal obligations, and our legitimate interest in operating and improving the service.

We use first- and third-party cookies to analyze traffic and improve your experience. You can accept or reject them through the consent banner.

We rely on infrastructure and technology providers acting as data processors, for example Vercel, Supabase, Cloudflare, GitHub, Google, Microsoft, Amazon Web Services, Stripe, OpenAI and Anthropic, in addition to Quandtec's own infrastructure.

These providers may host or process data outside your country; in such cases we apply appropriate contractual safeguards (such as data-protection and transfer clauses) to protect your information to a standard equivalent to the one described here.

Where a product uses artificial intelligence, we may process data with our own or third-party models solely to deliver the contracted functionality. We do not make automated decisions with significant legal effect without human involvement or a legal basis and, unless expressly agreed, we do not use your confidential data to train models.

ATLAS is Quandtec's client portal, hosted on its own domain, where you manage your contracted services, project documentation, billing and communication with our teams. Access is limited to clients holding an authorized account, created by Quandtec at the client's request.

Using ATLAS involves three groups of data. Account data: first and last name, corporate email address, job title or role within the organization, contact phone number where you provide one, and access credentials — always stored encrypted using key-derivation functions, never in plain text — together with any additional authentication factors you have enabled. Commercial-relationship data: contracted services, proposals and contracts, support requests and tickets, documents you upload or that we make available to you, and billing and payment-status data. Technical access data: activity logs recording connection date and time, IP address, device identifier, operating system and browser, and the relevant actions performed in the portal.

The purposes and their legal bases are as follows. Managing your account and delivering the contracted services rest on performance of the contract between us. Billing and the retention of supporting records respond to compliance with legal, accounting and tax obligations. Technical access logs are processed on the basis of our legitimate interest in ensuring the security, integrity and traceability of the platform, and in preventing, detecting and investigating unauthorized access, fraud and abuse; these logs also allow us to support audits and demonstrate compliance where the law requires it. All of the foregoing is carried out in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).

To operate ATLAS we rely on processors providing the portal's hosting, database, document storage and transactional email infrastructure, under contract and on documented instructions. These providers process the data solely to deliver the service to us and are bound by confidentiality and security duties equivalent to those described in this Policy.

International transfer: the ATLAS infrastructure may be located in Canada, the United States or the European Union, and data belonging to clients in other regions served by Quandtec may be processed in any of those locations. In such cases we apply appropriate contractual safeguards with each processor so that the information retains a level of protection equivalent to the one described here.

We retain your account data for as long as the commercial relationship remains in force. On termination, we deactivate access and delete or anonymize account data after thirty (30) days, during which period you may request an export of your documents. Contractual and billing records are retained for the applicable limitation periods and for the periods required by applicable accounting and tax rules. Technical access logs are retained for a maximum of twelve (12) months, unless they must be kept longer to investigate a security incident or to respond to a legal requirement.

In respect of the data processed in ATLAS you may exercise your rights of access, rectification, erasure (cancellation), portability and objection, as well as restriction of processing and withdrawal of consent where consent is the applicable basis. You may do so by writing to legal@quandtec.com from the email address associated with your account, or by verifying your identity through another reasonable means; we will respond within the periods set by applicable law. If you believe we have handled your data improperly, you may turn to the Office of the Privacy Commissioner of Canada (OPC — priv.gc.ca).

We retain data for as long as necessary for the purposes described and to comply with legal, accounting and tax obligations.

You can request access, rectification, deletion, objection or portability of your data, and withdraw your consent, by writing to legal@quandtec.com. Depending on your jurisdiction, you may have additional rights under applicable local law.

We apply reasonable technical and organizational measures (encryption in transit, access control and good development practices) to protect your data.

In the event of a security breach posing a real risk of significant harm, we will notify affected individuals and the relevant authority as required by applicable law.

If you believe we have handled your data improperly, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC — priv.gc.ca). We ask that, whenever possible, you contact us first at legal@quandtec.com so we can resolve your request.

We may update this Policy; the version in force is the one published on this site. To exercise your rights or resolve questions, contact us at legal@quandtec.com.