At a glance. A plain-English summary of this document. It is for guidance only; the clauses below govern.
- Covers data collected through the QED website (enquiries and automatic technical/log data) and the business contact data we hold for business development - separate from the Employee Privacy Notice or General Data Protection Policy.
- Cookies used are strictly necessary (consent, bot protection), analytics (Google Analytics 4, Hotjar) and functional (the Aria AI assistant) - analytics and functional cookies only set after consent, never for advertising. Analytics identifiers and Hotjar session recordings are personal data, not anonymous statistics.
- Data is never sold; shared only with service providers under written agreements, where legally required, or in a business transfer.
- Retention varies by data type: enquiry data 2 years, client relationship data 6 years, Google Analytics event data 2 months and user-level data 14 months, Hotjar recordings 12 months, cookie consent records 12 months, server logs 90 days.
- We also hold business contact data obtained from LinkedIn and other public sources for business development, on legitimate interests. You can tell us to stop at any time.
- Visitors can exercise their rights under the UK GDPR or the EU GDPR by emailing info@qedcode.io, and can complain to the ICO in the UK or to AZOP in Croatia.
1. Who We Are
- 1.1.
QED Ltd ("QED", "we", "us", "our") is a software development and AI technology company registered in England and Wales (company number 15952144). Our registered address is 66 Paul Street, London, EC2A 4NA.
- 1.2.
We are the Data Controller of personal data collected through this website and any related web pages operated by QED. This policy covers that data, and it also covers the business contact data we obtain from public sources for business development, which is explained in Section 6. It does not cover staff data, which is covered by our Employee Privacy Notice, or personal data we process for clients as their processor, which is governed by the applicable data processing agreement.
- 1.3.
If you have questions about this policy or wish to exercise your rights, please contact us at: info@qedcode.io
2. What Data We Collect & How We Use It
- 2.1.Data You Provide Directly
When you contact us through our website we collect:
- •
Your name and email address
- •
Your phone number (if provided)
- •
Your company name (if provided)
- •
The content of your message or enquiry, including any attachments.
We use this information to respond to your enquiry and follow up where relevant. We do not add you to marketing lists without your explicit consent.
The lawful basis for this processing is our legitimate interests (Article 6(1)(f) UK GDPR) in responding to and managing business enquiries.
- •
- 2.2.Data Collected Automatically (Log Files)
Like most websites, our hosting infrastructure automatically logs certain technical data when you visit our website. This includes:
- •
IP address
- •
Browser type and version
- •
Internet Service Provider (ISP)
- •
Date and time of visit
- •
Pages visited and referring/exit pages
- •
- 2.3.
Your IP address is personal data under the UK GDPR and the EU GDPR, so this log data is personal data even though we do not use it to find out who you are. We do not combine it with your name or contact details, and we do not use it to build a profile of you. It is used to analyse trends, administer and secure the site, and understand how visitors move through the website. The lawful basis is our legitimate interests in maintaining, securing and improving our website.
3. Cookies
- 3.1.What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They are widely used to make websites function efficiently and to provide analytical information to site owners.
- 3.2.Cookies We Use
We use the following categories of cookies on our website:
Cookie / Tool Category Purpose Duration Set when cc_cookie (vanilla-cookieconsent) Strictly necessary Stores your cookie consent choice so you aren't re-asked. ~6 months (182 days) Always, once you interact with the banner _GRECAPTCHA (Google reCAPTCHA v2) Strictly necessary (security) Bot/abuse protection on forms. Third-party, set on google.com. ~6 months Only on pages with a form protected by reCAPTCHA _ga, _ga_[ID] (Google Analytics 4) Analytics Records how visitors use our site (pages visited, time on site, approximate region) against a random identifier for your browser. Up to 2 years Upon user consent to analytics cookies _hjSession_<id>, _hjSessionUser_<id>, other _hj* (Hotjar) Analytics Session recordings + heatmaps. _hjSession*: 30 min; _hjSessionUser*: ~12 months Only after you accept analytics cookies, on pages where session recording is enabled Aria Functional On-site AI assistant. Loads its widget and processes what you type to generate a reply. 12 months Only after you accept functional cookies We do not use cookies for targeted or behavioural advertising. We do not sell data collected via cookies to any third party.
- 3.3.Managing Your Cookie Preferences
- •
When you first visit our website, our cookie consent banner will ask for your preferences. You can accept all cookies, accept only strictly necessary cookies, or change your preferences at any time via the Cookie Settings link in the website footer.
- •
You can also control or delete cookies through your browser settings. Note that disabling certain cookies may affect website functionality. For guidance on managing cookies in specific browsers, visit www.aboutcookies.org.
- •
4. Analytics
- 4.1.
Where you accept analytics cookies, our website uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC. GA4 sets cookies that give your browser a random identifier and records pages visited, time spent, and approximate geographic region. That identifier is personal data under the UK GDPR and the EU GDPR, even though we never use it to work out who you are and never combine it with your name or contact details. GA4 does not record or store your full IP address. We report on this data in aggregate; the underlying records are not anonymous. The _ga cookie can stay in your browser for up to 2 years, but that is only how long the identifier lasts: Google deletes the data recorded against it after 14 months (2 months for event data), so data older than that is gone even while the cookie remains.
- 4.2.
As Google LLC is based in the United States, GA4 data may be transferred to and processed there. QED Ltd is a UK controller, so the transfer mechanism we rely on is the UK Extension to the EU-US Data Privacy Framework, under which Google LLC is certified. For any transfer not covered by that certification we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment on file.
- 4.3.
Where you accept analytics cookies, we also use Hotjar to understand how pages are used. Hotjar records your individual session, including pages viewed, mouse movement, clicks and scrolling, and produces aggregated heatmaps from those recordings. A session recording is a record of your visit, not anonymous aggregate data. Hotjar is configured to mask text entered into form fields, so what you type is not captured. Hotjar keeps recordings and heatmap data for 12 months from capture, then deletes them.
- 4.4.
You may opt out at any time by rejecting analytics cookies in our consent banner, or by withdrawing consent through the Cookie Settings link in the website footer. For GA4 you may also install the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout
5. How We Share Your Data
- 5.1.
We do not sell your personal data. We share data only in the following limited circumstances:
- •
Service providers: we use third-party tools to operate our website and business (e.g., hosting providers, analytics). These providers act as data processors under written agreements and are not permitted to use your data for their own purposes.
- •
Legal obligations: we may disclose data where required to do so by law, court order, or a regulatory authority.
- •
Business transfers: in the event of a merger, acquisition, or sale of QED's business, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.
- •
- 5.2.
We do not share your data with advertising networks or permit third-party advertisers to collect data through our website.
6. Business Contacts & Business Development
- 6.1.
Separately from the data collected through this website, we process a limited amount of business contact data about people at organisations we believe may have a use for our services. This is business-to-business activity: we do not carry out consumer marketing.
- 6.2.
Where we get it. From professional networking sites, principally LinkedIn, from company websites and public registers, from industry events and directories, and from people who give us their details at those events or through a referral.
- 6.3.
What we hold. Name, job title, employer, business email address and business telephone number, LinkedIn profile, and a record of our contact with you.
- 6.4.
What we do with it. We contact you about QED's services, and keep a record of that contact in our CRM, including a suppression list of anyone who has unsubscribed or asked us not to contact them.
- 6.5.
Our lawful basis. Our legitimate interests in developing our business, under Article 6(1)(f) of the UK GDPR and the EU GDPR. We have carried out a legitimate interests assessment and keep it under review. Where an electronic marketing rule requires consent, we obtain consent instead and rely on it for that message.
- 6.6.
Your right to object. You can tell us to stop at any time, with no reason and no cost, by emailing info@qedcode.io or by using the unsubscribe link in any message. We will stop contacting you and keep the minimum record needed to make sure we do not contact you again.
- 6.7.
How long we keep it. Two years from our last meaningful contact with you, after which we review and delete. Your entry on the suppression list is kept for as long as we carry out business development, so that we do not contact you again.
- 6.8.
This section is the information required by Article 14 of the UK GDPR and the EU GDPR for personal data we obtain other than from you.
7. Third-Party Links
Our website contains links to third-party websites, including social media profiles (LinkedIn, GitLab, and similar). Once you leave our website, this Privacy Policy no longer applies. We encourage you to review the privacy policies of any third-party sites you visit.
8. Children's Privacy
Our website is not directed at children under the age of 13 and we do not knowingly collect personal data from children. If you believe a child has submitted personal information through our website, please contact us at info@qedcode.io and we will delete it promptly.
9. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Contact / enquiry data | 2 years from last contact | Enquiry management; limitation periods |
| Client relationship data | 6 years from end of relationship | Limitation Act 1980 |
| GA4 analytics data | Event data 2 months; user-level data 14 months (our Google Analytics settings) | Trend analysis; auto-deleted by Google |
| Hotjar recordings and heatmaps | 12 months from capture | Understanding how pages are used; auto-deleted by Hotjar |
| Cookie consent records | 12 months | Evidence of valid consent |
| Server log files | 90 days | Security and performance monitoring |
| Business contact data | 2 years from last meaningful contact | Business development; see Section 6 |
10. Your Rights
- 10.1.
If you are in the UK, the UK GDPR gives you the rights below. If you are in the EEA, the EU GDPR gives you the same rights; QED Ltd is the controller, and our Croatian company, QED d.o.o. of Viljevski put 6, 10000 Zagreb, acts as our representative in the EU under Article 27 of the EU GDPR. These rights are free to exercise and we will respond within one calendar month of receiving your request.
- •
Right of Access (Art. 15): request a copy of the personal data we hold about you.
- •
Right to Rectification (Art. 16): ask us to correct inaccurate or incomplete data.
- •
Right to Erasure (Art. 17): ask us to delete your data, subject to legal retention obligations.
- •
Right to Restrict Processing (Art. 18): ask us to pause processing while a dispute is resolved.
- •
Right to Data Portability (Art. 20): request your data in a structured, machine-readable format where applicable.
- •
Right to Object (Art. 21): object to processing based on our legitimate interests, including the business development processing in Section 6.
- •
Right to Withdraw Consent (Art. 7(3)): where we rely on your consent, including for analytics cookies, withdraw it at any time. Withdrawing consent does not affect processing carried out before you withdrew it. For cookies, use the Cookie Settings link in the website footer.
- •
- 10.2.
We do not make any decision about you by automated means that produces a legal effect or similarly significantly affects you, so the additional protections in Article 22 do not apply. If that ever changes, we will say so in this policy before we start.
- 10.3.
To exercise any right, email: info@qedcode.io. We do not charge for reasonable requests.
11. Right to Complain
- 11.1.
If you are dissatisfied with how we have handled your personal data you may lodge a complaint with your supervisory authority. You may also complain to the authority in the country where you live or work, or where the matter arose.
- 11.2.
In the UK, the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113, ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
- 11.3.
In Croatia and the EEA, the Croatian Personal Data Protection Agency (Agencija za zastitu osobnih podataka, AZOP): azop.hr, Selska cesta 136, 10000 Zagreb.
- 11.4.
We would welcome the opportunity to resolve your concern directly first.
12. Policy Review
This policy is reviewed annually by the COO and, where applicable, at Board level, and updated in response to changes in law, regulatory guidance, or how we operate. The current version, with its version number and effective date, is always the one published on this website. Where a change materially affects how we use your personal data, we will say so on this page before the change takes effect.