Privacy Notice

This Privacy Notice outlines how QUADRUM SA (“Company”, “we”, “us”, or “our”) collects, uses, stores, and protects Personal Data in connection with our website, software licensing, client onboarding, technical support, and business operations.

Personal Data

Any information relating to an identified or identifiable natural person.

Processing

Any operation performed on Personal Data (e.g., collection, storage, adaptation, transmission, or deletion).

Related Persons

Individuals associated with our corporate clients, partners, or vendors whose details are provided to us in the context of a business relationship (e.g., directors, compliance officers, authorized signatories, legal representatives, or IT administrators).

We kindly request that you share this Privacy Notice with any Related Persons whose data you provide to us.

The entity responsible for processing your Personal Data is:

Depending on how you interact with us, we collect and process the following categories of Personal Data:

1. B2B Account & Onboarding Data: Names, business email addresses, telephone numbers, job titles, employer details, digital signatures, and identity verification details for contract management.
2. Technical & Telemetry Data: IP addresses, operating system specifications, browser types, license key activation logs, hardware identifiers, and session timestamps collected when accessing our portal or licensing servers.
3. Communication & Service Desk Data: Form submissions, email exchanges, support ticket logs, phone call logs, and feedback collected during technical assistance.
4. Commercial & Transactional Data: Invoicing records, payment histories, audit trails, and banking details required for billing.

We process your Personal Data based on the following legal grounds under Swiss revFADP and GDPR.

We do not sell, rent, or trade your Personal Data. We may disclose Personal Data to selected third-party service providers acting strictly as Processors on our behalf, including:

• IT hosting providers and cloud infrastructure tools located in Switzerland or the EU/EEA.
• Professional advisors (external financial auditors, tax advisors, legal counsel).
• Public, administrative, or judicial authorities where required by statutory law or court orders.

All Processors are bound by strict Data Processing Agreements (DPAs) requiring equivalent security standards and limiting processing strictly to our documented instructions.

Personal Data is primarily processed and stored within Switzerland and the European Economic Area (EEA).

Switzerland is officially recognized as offering an adequate level of data protection by both the European Commission and the UK Government. If Personal Data must be transferred outside CH/EEA/UK to a third country without an adequacy decision, we guarantee protection by implementing:

• Standard Contractual Clauses (SCCs) issued by the European Commission;
• The Swiss Addendum required by the Federal Data Protection and Information Commissioner (FDPIC);
• The UK International Data Transfer Addendum (IDTA).

We store Personal Data only for as long as necessary to fulfill the purposes for which it was collected:

• Contractual Records: Retained for 10 years following contract termination, pursuant to Article 957 of the Swiss Code of Obligations (CO).
• Technical Logs & Web Analytics: Automatically deleted or permanently anonymized after 12 months.
• Marketing Contacts: Retained until you withdraw consent or object to B2B communications.

Subject to statutory conditions and legal limits, you possess the following rights regarding your Personal Data:

• Right of Access: Request confirmation of processing and obtain a copy of your Personal Data.
• Right to Rectification: Request the immediate correction of inaccurate or incomplete data.
• Right to Erasure (“To Be Forgotten”): Request deletion of data no longer required by law or contract.
• Right to Restrict & Object: Object to processing based on legitimate interest or direct marketing.
• Right to Data Portability: Request transfer of your data in a structured, machine-readable format.

In close cooperation with our hosting infrastructure providers, we enforce stringent technical and organizational measures to safeguard databases against unauthorized access, loss, misuse, or falsification. Controls include TLS 1.3 transit encryption, AES-256 storage encryption, role-based access control (RBAC), and continuous vulnerability monitoring.