Privacy notice

Who we are

Quebex Labs, Inc. (“Quebex”, “we”) is a corporation incorporated in the State of Delaware, USA, with its registered office c/o Northwest Registered Agent Service, Inc., 8 The Green, STE B, Dover, Kent County, Delaware 19901.

Quebex Labs, Inc. is the data controller for personal data submitted through this website. Members of our team who process enquiries on our behalf are based in the United Kingdom and the United States.

If we are required to appoint a representative in the United Kingdom or the European Union, we will do so and name them here. Where a UK or EU group entity is later established, that entity will become the controller for enquiries originating in its territory and this notice will be updated accordingly.

Data protection enquiries: see “How to reach us” below.

What we collect

If you complete our contact form we collect the name, work email address, and any organisation, country and message details you choose to provide. That is all we collect.

This website runs no advertising scripts, no tracking pixels and no session recording, and we do not sell or share any data with advertisers.

We use Google Analytics to understand which pages are useful so we can improve them. It sets cookies in your browser. It does not load unless you tell us it may. When you first visit, you are asked to accept or decline; until you accept, no analytics cookie is set and no data is sent. Declining costs you no functionality, and you can change your mind at any time using the cookie preferences link in the footer.

Where you do consent, we have configured Google Analytics to truncate your IP address before storage, and we have switched off Google Signals, advertising features and ad personalisation. Our lawful basis for this processing is your consent, which you may withdraw at any time.

Your accept-or-decline choice is remembered in your browser’s local storage rather than in a cookie. That preference is strictly necessary to honour your choice, so it is stored whichever way you answer.

Our host records standard server log data, including IP address and browser user agent, for security and operational purposes.

If you tick the optional box to receive our monthly Quantum Threat Brief, we record that you did so, together with the date. That record is how we evidence your consent, and it is the thing we delete if you withdraw it.

How to reach us

Our enquiry form is the way to contact us about our work, and it reaches the founding team directly. We deliberately do not publish a list of mailboxes: it invites automated harvesting, and a scraped address becomes a spam and impersonation target.

For matters that must not go through the form:

• Data protection requests — access, correction, deletion, objection, or withdrawing consent: privacy@quebexlabs.com
• Security vulnerabilities — see our security.txt for the disclosure contact and our expectations.

Every address we operate reaches a monitored shared inbox rather than one individual, so nothing depends on a single person being available.

Why we use it, and on what basis

We use the details you submit solely to respond to your enquiry and, where relevant, to prepare a proposal. Our lawful basis is legitimate interests — responding to a business enquiry you initiated — and, where a contract follows, performance of that contract.

We do not sell personal data. We do not add enquirers to a marketing list without a separate, explicit opt-in.

Who processes it

We use a small number of service providers, each acting as a processor under contract, and each bound to process personal data only on our instructions:

• Netlify, Inc. — website hosting and contact-form handling. Server logs, including IP address and browser user agent, are processed for security and operational purposes. See Netlify’s Trust Center for their data processing terms.
• Google (Google Workspace) — our business email. Any correspondence with us is processed there. See Google’s Cloud Data Processing Addendum.

Where you have consented to analytics, Google also processes usage data on our behalf under the same Cloud Data Processing Addendum linked above.

We do not use any other processor for enquiry data, and we do not share it with anyone else except where we are legally required to.

Both providers are based in the United States, so personal data you submit from the UK or the EU is processed there. For those transfers we rely on the safeguards in each provider’s data processing terms — which incorporate the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum — together with any adequacy mechanism a provider is certified under.

Where form submissions are stored

When you submit the contact form, the submission is stored in our Netlify account as well as being emailed to us. That means a copy exists in two places, and we delete it from both when the retention period below expires or when you ask us to.

We review and purge stored form submissions at least once every quarter. If you would rather we deleted yours immediately, use the data protection address below and we will confirm once it is done.

We do not use your enquiry for automated decision-making or profiling, and we do not enrich it with data from other sources.

Marketing, and withdrawing consent

We only send the monthly Quantum Threat Brief to people who have actively asked for it by ticking the optional box on our contact form. We never add enquirers to a mailing list because they contacted us about something else.

Every issue carries a one-click unsubscribe link. You can also withdraw consent at any time using the data protection address in “How to reach us” above. Withdrawing is as easy as giving it, and it does not affect anything else we hold or any engagement in progress.

How long we keep it

Enquiry correspondence that does not lead to an engagement is retained for 24 months from the date of last contact, then deleted. Twenty-four months reflects how long a cryptographic migration decision typically takes to move from first conversation to budget.

Where an enquiry becomes a contracted engagement, the records are retained for 7 years after the engagement ends, to meet tax, accounting and professional-records obligations in the jurisdictions we operate in. You can ask us to delete your data sooner — see Your rights below — and we will, unless we are legally required to keep a specific record.

Your rights

Depending on where you are located you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to our processing, and to receive a copy in a portable format. To exercise any of these, email privacy@quebexlabs.com and we will respond within one month.

If you are in the UK you may also complain to the Information Commissioner’s Office at ico.org.uk. If you are in the EU you may complain to your national supervisory authority.

If something goes wrong

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the relevant supervisory authority within 72 hours of becoming aware of it, and tell you directly where the risk to you is high.

Changes to this notice

We version this notice and show the effective date at the top. Where a change materially affects how we use your data, we will say so here rather than quietly amending the text.

Security

This site is served over HTTPS. We report vulnerabilities responsibly and expect the same courtesy — see security.txt for how to reach us about a security issue.