Privacy Policy

Last updated: «DATE TO BE SET ON PUBLICATION» · Draft prepared 6 June 2026

1. Who we are

This Privacy Policy explains how QuantumData Strategy, Lda. ("QDS", "we", "us", "our") collects and processes personal data when you use the QDS Routes platform and related websites and services (the "Service").

• Data controller: QuantumData Strategy, Lda., a company incorporated in Portugal.
• Registered office: Rua do Lago de Prata, 16, C5, Belas «postal code TO CONFIRM».
• Company / tax number: NIPC (same as the company's NIF) 517874571.
• Contact: info@quantumdatastrategy.com.
• Data protection contact / DPO: «DPO CONTACT — or confirm no DPO is appointed (see §13)».

2. Scope and our role

QDS Routes is a business-to-business logistics and route-optimisation service. This Policy covers two distinct roles:

• Where QDS is the controller — for the personal data of the people who hold and administer an account (your name, work email, organisation, role, billing details) and for website/analytics data, we decide why and how that data is processed, and this Policy governs it.
• Where QDS is a processor — for the operational data that a customer uploads into the Service (for example the names, addresses and phone numbers of their drivers, recipients and stops), the customer is the controller and QDS processes that data only on the customer's documented instructions. Those activities are governed by the Data Processing terms in our Terms & Conditions / Data Processing Agreement, not by this Policy.

3. What personal data we collect

• Account & identity data — name, work email, phone (optional), organisation, role. Authentication is handled by Amazon Cognito; we do not store your password.
• Operational data you upload (processed on your behalf) — delivery and customer records, stop addresses, driver details (name, phone, licence), vehicle details, work orders and notes.
• Location data — geographic coordinates of stops and, where you enable it, driver/vehicle positions used for routing, tracking and dispute resolution.
• Billing data — organisation name, VAT number, billing address and email. Where you purchase a subscription, card details are entered directly with our payment processor (see §5); QDS never sees or stores full card numbers.
• Technical & usage data — IP address, device/browser information, pages and actions, timestamps, and error diagnostics.
• Cookies & analytics — see §10.
• Optional voice-assistant data — if you use the voice assistant, the audio is transcribed on our own EU infrastructure; only the transcribed text is processed by the AI provider to answer your request (see §5 and §6).

4. Why we use your data and our legal bases

We process personal data under the EU General Data Protection Regulation (GDPR) on these bases:

• Performance of a contract (Art. 6(1)(b)) — to create and secure your account, provide route optimisation and the other features of the Service, and process payments.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent fraud and abuse, maintain and improve the product, and keep records. A balancing assessment is available on request.
• Consent (Art. 6(1)(a)) — for non-essential analytics cookies, optional location tracking where applicable, and any marketing communications. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to meet tax, accounting and invoicing duties under Portuguese law.

5. Who we share data with (sub-processors)

We do not sell personal data. We share it only with service providers that process it on our behalf under written data-processing terms, and where required by law. Our current sub-processors are:

In addition (third parties that are not sub-processors): the application loads certain front-end libraries from content-delivery networks (CDNs), which makes your IP address visible to those providers when pages load (fonts are self-hosted by us; named list available on request).

Mapping and geocoding (routing, address lookup and map tiles) run on our own infrastructure using OpenStreetMap data — your addresses are not sent to any third-party maps provider for these functions. Map displays show the attribution "© OpenStreetMap contributors".

6. International transfers

Your data is hosted in the EU (Germany and Ireland). The main transfer of operational data outside the EU is to Anthropic (United States), limited to the transcribed text of requests and only if you use the optional voice assistant; that transfer is covered by the European Commission's Standard Contractual Clauses (Anthropic does not participate in the EU-US Data Privacy Framework). In addition, loading front-end libraries from CDNs (see §5) communicates your IP address to those providers. Where a sub-processor processes data outside the EEA, we rely on an adequacy decision or appropriate safeguards under Chapter V GDPR.

7. How long we keep data

• Account data — kept for the life of your account and for «90 days» after closure, then deleted or anonymised, except where we must retain it longer by law.
• Location/GPS data — retained for «30 days» for operational and dispute-resolution purposes, after which only aggregated statistics are kept.
• Billing & tax records — retained for «10 years» as required by Portuguese tax law.
• Backups — operational database backups rotate on «30-31 day» cycles, certain archive copies (database exports) are retained for up to «120 days» and snapshots up to «14 days»; deletion requests are applied to live systems immediately and expire from backups by rotation within those windows (at most «120 days»).

8. How we protect your data

We apply technical and organisational measures including field-level encryption of personal data at rest (AES-256-GCM), encryption in transit (TLS), secure session cookies (HttpOnly, Secure, SameSite), a strict Content-Security-Policy, role-based access control and multi-tenant isolation, and regular vulnerability scanning. No system is perfectly secure, but we work to protect your data against unauthorised access, loss or misuse.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent. To exercise any right, contact info@quantumdatastrategy.com. Where QDS acts as a processor on a customer's behalf, we will refer your request to the relevant customer (controller).

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

10. Cookies and analytics

We use a small number of cookies and similar technologies:

Strictly necessary cookies do not require consent. Analytics are disabled until you opt in via the cookie banner, and you can change your choice at any time.

11. Children

The Service is a business tool and is not directed to children. In Portugal, a minor's consent to information-society services is lawful only from age 13 (Article 16 of Law no. 58/2019); we do not knowingly collect personal data from anyone under 13.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the "Last updated" date; significant changes will be notified as appropriate.

13. Contact

Questions or requests: info@quantumdatastrategy.com.
Data controller: QuantumData Strategy, Lda., Rua do Lago de Prata, 16, C5, Belas «postal code TO CONFIRM», Portugal — NIPC (same as the NIF) 517874571.
Supervisory authority: CNPD — www.cnpd.pt.