Privacy policy

QuantmHill is a remote-first IT services and consulting company. Our registered company details are available on request via hello@quantmhill.com and are stated in every engagement contract. This policy explains what personal data we collect through quantmhill.com and in the course of client engagements, why we collect it, and the rights you have over it.

It applies to visitors to this website, people who contact us about a project, and client stakeholders we work with during an engagement. It does not cover data we process on a client’s behalf inside their systems — that processing is governed by the data processing agreement in each contract.

Data we collect

Information you give us

• Contact form submissions: your name, work email, company, budget range, and project summary.
• Correspondence: emails and call notes from scoping conversations and ongoing engagements.
• Contracting details: names, roles, and billing information needed to prepare and invoice a statement of work.

Information collected automatically

• Analytics data: none. This site currently runs no analytics — no tracking scripts load and no analytics cookies are set. See our cookie policy for details.
• Server logs: IP addresses and request timestamps, kept briefly for security and abuse prevention.

We don’t collect special-category data through this site, and we never sell personal data.

How we use your data

• To answer your enquiry and prepare a proposal — this is why the contact form asks about budget and project scope.
• To deliver engagements: scheduling, access provisioning, weekly reporting, and invoicing.
• To keep this site secure and working, using short-lived server logs rather than individual profiles.
• To send occasional written updates, only if you opted in, and every email includes a working unsubscribe link.
• To meet legal obligations, such as keeping accounting and tax records.

Legal bases

Where UK or EEA data protection law applies, we rely on the following bases:

• Contract — processing needed to prepare or perform an agreement with you: proposals, delivery, and invoicing.
• Legitimate interests — responding to enquiries, securing the site, and keeping ordinary business records, always balanced against your rights.
• Consent — any marketing email, and any analytics cookies we may introduce later. You can withdraw consent at any time.
• Legal obligation — retention of financial and tax records for the statutory period.

How long we keep data

• Enquiries that don’t become engagements: deleted after 24 months.
• Contracts and invoices: kept for the statutory retention period that applicable accounting and tax law requires.
• Analytics data: none is collected — we run no analytics on this site.
• Server logs: kept only briefly for security and abuse prevention, then deleted on a rolling basis.

Subprocessors

We keep our vendor footprint deliberately small. This site shares nothing with advertising or analytics vendors — the only personal data it processes is what you submit through the contact form, which is delivered to us and handled by the small set of vendors we use to run the business, such as hosting, email, and document collaboration, each under a data processing agreement.

Where a vendor processes data outside the UK or EEA, transfers rely on an adequacy decision or standard contractual clauses. A current subprocessor list is available on request at hello@quantmhill.com.

Your rights

Depending on where you live, you can ask us to do any of the following, and we respond within one month:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete data we no longer have grounds to keep.
• Restrict or object to specific processing.
• Export your data in a portable format.
• Withdraw consent you gave earlier, with no penalty.

If you believe we’ve mishandled your data, you can also complain to the data protection supervisory authority in the country where you live or work.

Contact

For any privacy question or to exercise a right, email hello@quantmhill.com — it reaches the person responsible for data protection directly. Our registered company details are available on request via the same address and are stated in every engagement contract.