Privacy Policy

This English translation is provided for convenience only. In the event of any discrepancy, the Spanish version prevails.

I. Privacy and data protection policy

In compliance with applicable legislation, Quantumsec S.L. (hereinafter, "Quantumsec" or the "Website"), as a company specializing in cybersecurity, digital intelligence, surveillance automation and critical infrastructure protection services, undertakes to adopt the technical and organizational measures necessary to ensure a level of security appropriate to the risk, guaranteeing the confidentiality, integrity and availability of the personal data processed.

This privacy policy has been drafted in accordance with:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
  • Organic Law 3/2018 of December 5 on Data Protection and Guarantee of Digital Rights (LOPD-GDD)
  • Royal Decree 1720/2007 (RDLOPD), implementing regulation of the former Spanish data protection law
  • Law 34/2002 of July 11 on Information Society Services and Electronic Commerce (LSSI-CE)

II. Identification of the data controller

  • Identity: Quantumsec S.L.
  • Tax ID (NIF): B19439413
  • Postal address: C/ Trafalgar 52, esc. 2, 9D, 46023, Valencia
  • Email: contacto@quantumsec.es
  • Phone: +34 960 730 013
  • Book a call: https://www.quantumsec.es/en/contact/

III. Principles applicable to processing

Processing is governed by the principles set out in Article 5 of the GDPR:

  • Lawfulness, fairness and transparency.
  • Purpose limitation.
  • Data minimization.
  • Accuracy and keeping data up to date.
  • Storage limitation.
  • Integrity and confidentiality.
  • Accountability.

IV. Information we collect

The data we collect includes:

  • Identification data: first name, last name, Spanish tax or national ID number (NIF/DNI), email address, phone number, postal address.
  • Transaction and order data.
  • Browsing data (IP address, access logs, cookies). See the Cookie Policy.
  • Professional data, where applicable (company, job title).

V. Purposes of processing

  • Managing orders, invoicing, shipments, returns and warranties.
  • Creating and maintaining user accounts.
  • Responding to requests for information or technical support.
  • Managing subscription or training services.
  • Sending commercial communications (subject to prior consent).
  • Audience measurement (Google Analytics), only if the user accepts the corresponding cookie category. See the Cookie Policy.
  • Protecting the system against malicious activity (including cyber threat intelligence).
  • Regulatory and contractual compliance.
  • Internal audits, controls and fraud prevention.
  • Service quality assessment and continuous improvement.

VI. Legal basis

The legal basis for processing is:

  • Performance of a contract.
  • Consent of the data subject.
  • Legitimate interest (security, service improvement).
  • Compliance with legal obligations (tax, commercial, regulatory).

VII. Retention periods

  • Invoicing and transaction data: 6 years (tax obligation).
  • Contact data: for as long as the relationship lasts or until consent is withdrawn.
  • Requests for information, commercial proposals and contact forms that do not result in a contractual relationship: up to 24 months from the last contact, or until consent is withdrawn, if earlier.
  • Browsing data: up to 12 months, unless required for security or legal compliance purposes.
  • Security logs: up to 2 years in critical infrastructure or monitored environments.

VIII. Recipients and disclosures

We may share data with:

  • Financial institutions and payment gateways.
  • Logistics and courier services.
  • Hosting, messaging and storage providers: Google Cloud, WhatsApp LLC, Telegram FZ-LLC, STRATO AG, among others.
  • Google LLC, through Google Calendar, for managing appointments booked from the contact page (quantumsec.es/en/contact/).
  • HighLevel, Inc. ("GoHighLevel"), as data processor, for managing the subscriber list and sending the newsletter, and for the commercial management of requests for information, proposals and contact forms (including the Cyber Resilience Act scoping sheet).

IX. International transfers

  • WhatsApp LLC (USA): Standard Contractual Clauses (EU) 2021/914.
  • Google LLC (USA): Standard Contractual Clauses.
  • Telegram FZ-LLC (UAE): GDPR assessment and safeguards implemented.
  • STRATO AG: Operations within the EU, with possible international redundancy in accordance with the GDPR.
  • HighLevel, Inc. (USA): Standard Contractual Clauses (EU) 2021/914 (Module Two, controller-to-processor), incorporated by reference into its data processing agreement, and participation in the EU-U.S. Data Privacy Framework.

X. Minors

Quantumsec does not collect data from children under 14 years of age without the consent of their parents or legal guardians.

XI. Security measures

Quantumsec applies advanced security controls and measures:

  • AES and TLS encryption in transit.
  • Continuous infrastructure monitoring.
  • SIEM systems, encrypted backups, multi-factor authentication.
  • Zero-trust access policies.
  • Technical, ethical and legal audits.

XII. Data subject rights

You may exercise the following rights:

  • Access, rectification, erasure.
  • Restriction of or objection to processing.
  • Portability.
  • Not to be subject to automated decision-making.

XIII. Supervisory authority

Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) — www.aepd.es — C/ Jorge Juan, 6, 28001 Madrid.

XIV. Limitation of liability

Quantumsec is only responsible for the data it collects and manages directly. It is not responsible for personal information voluntarily disclosed by the user on external websites or services.

XV. Quality and accuracy of data

The user warrants that the data provided is true, accurate, up to date and complete, and assumes any liability for false or inaccurate information.

XVI. Changes to this policy

Quantumsec may modify this Policy at any time. Changes will be posted on this page. You are advised to review it periodically.