Privacy Policy
This policy explains what personal data we process when you use this site or write to us, why, and what you can demand from us at any point. It is written to be understood, not to cover us.
Last updated — 25 July 2026
1. Who the controller is
The data controller is Quantum Nova Solutions S.L., tax ID B26753574, registered office at Calle Apolo 75, Bajo, 03182 Torrevieja (Alicante), Spain.
For anything about your data, including exercising your rights, write to info@quantumnovaagency.com. One of the two people who run the company answers — not an automated mailbox.
2. What we collect
We process only three kinds of data, none of which is a special category (health, beliefs, biometrics or sexual orientation):
- What you give us in the contact form: name, email address and the content of your message. All three are needed to reply; we ask for no phone number and no company name.
- Subsequent correspondence: if you email or message us, we keep that thread and whatever it contains.
- Technical browsing data: IP address, browser type and pages visited. Server logs are generated by the mere act of serving the page; analytics data is collected only if you accept cookies.
We do not build commercial profiles, make automated decisions about you, or buy or enrich third-party databases.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Answering your enquiry and, where relevant, preparing a quote | Name, email, message | Pre-contractual steps at your request (art. 6(1)(b)) |
| Keeping the commercial conversation open while there is interest | Name, email, thread history | Legitimate interest in serving someone who contacted us (art. 6(1)(f)) |
| Measuring how the site is used in order to improve it | Analytics identifiers, pages viewed | Your consent, withdrawable at any time (art. 6(1)(a)) |
| Keeping the site secure and available | IP, server logs | Legitimate interest in service security (art. 6(1)(f)) |
| Meeting tax and accounting obligations if you become a client | Billing data | Legal obligation (art. 6(1)(c)) |
We do not use your data to send marketing you did not ask for. If we ever run a newsletter, it will be a separate, explicit opt-in.
4. How long we keep it
- Enquiries that do not become projects: up to one year from the last message, then deleted.
- Enquiries that do become projects: for the duration of the relationship and six years afterwards, the retention period for commercial records required by the Spanish Commercial Code.
- Technical server logs: thirty days maximum.
- Analytics data: up to fourteen months, the retention configured in Google Analytics.
- Your cookie choice: stored in your own browser until you clear it.
5. Who we share it with
We do not sell personal data or hand it to third parties for their own purposes. We do use providers who process it on our behalf, each under a data processing agreement (GDPR art. 28):
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | Runs the function that processes the form submission | US / EU |
| Resend (Plus Five Five, Inc.) | Delivers the form email to our inbox | US |
| Google Ireland Ltd. | Site analytics (Google Analytics 4), only if you accept it | Ireland / US |
| Hosting provider | Serves the site and generates the technical logs | EU |
If you use the WhatsApp button, that conversation also becomes subject to the privacy policy of WhatsApp Ireland Ltd. (Meta). Opening that channel is your choice; email and the form do not involve it.
We may also disclose data to public authorities and the courts where a law requires it.
6. Transfers outside the European Union
Some of the providers above are established in the United States. Where that is the case, the transfer relies on the Standard Contractual Clauses approved by the European Commission or on the provider's certification under the EU-U.S. Data Privacy Framework, with supplementary measures as appropriate. Write to us and we will send you a copy of the safeguards that apply.
7. Your rights
Over your data you may exercise, free of charge and at any time:
- Access: find out what data of yours we hold and what we do with it.
- Rectification: correct anything wrong or incomplete.
- Erasure: ask us to delete it once it is no longer necessary.
- Objection: object to processing based on legitimate interest.
- Restriction: ask us to keep it but stop using it.
- Portability: receive it in a machine-readable format.
- Withdraw consent: at any time, without affecting the lawfulness of processing before then.
To exercise them, write to info@quantumnovaagency.com saying which right you want to use. We answer within one month at most. If we need to confirm you are who you say you are, we will ask in the least intrusive way we can.
If you think we handled your request badly, you can complain to the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es). We would rather you told us first, but going straight there is your right.
8. Security
The site is served entirely over HTTPS, the form validates and sanitises what is submitted, and access to our mailboxes and infrastructure is protected with two-factor authentication. Cybersecurity is part of what we do for a living, so we apply here what we audit elsewhere. That said, no system is invulnerable: if a breach ever occurred that posed a risk to your rights, we would tell you and notify the AEPD within the 72 hours set by GDPR art. 33.
9. Minors
This site is aimed at businesses and professionals. It is not intended for children under fourteen and we do not knowingly collect their data. If we find we have received a minor's data without the consent of whoever holds parental responsibility, we will delete it.
10. Changes to this policy
If we change provider, add a purpose, or the law changes, we will update this page and the revision date with it. When a change affects you significantly we will tell you through whatever channel we have with you rather than waiting for you to notice.