Privacy Policy

This Privacy Policy ("Policy") describes how Quantum Bridge Services LLC ("Quantum Bridge", "we", "us", "our") collects, uses, discloses, and safeguards personal information when you visit quantumbridgellc.com (the "Site"), engage us for services, work with us as a client, partner, vendor, or candidate, or otherwise interact with us.

Quantum Bridge Services LLC is a limited liability company headquartered at 1021 E Lincolnway Rd, New Lenox, Illinois 60451, United States, with delivery and business offices in Lahore (Pakistan), Ajax (Canada), London (United Kingdom), and Madrid (Spain). We are the data controller (or "business", under California law) for the personal information described in this Policy — except where we process data on behalf of a client, in which case we act as a processor (see Section 13).

This Policy does not apply to third-party websites, platforms, or software that we do not control, including Salesforce, Microsoft, Shopify, or other platforms we may implement for clients (see Section 17).

We collect personal information in three ways: information you give us, information collected automatically, and information we receive from third parties.

A. Information you give us directly

• Contact & enquiry data: name, business email, phone number, company name, job title, country, service interest, project description, and anything else you type into our contact, quote, or demo forms.
• Client & account data: billing contacts, purchase-order references, tax or VAT identifiers, invoicing and payment details, contract and SOW information.
• Support data: messages, tickets, attachments, and diagnostics you send to our support team, including any credentials you share for troubleshooting.
• Recruitment data: résumé/CV, work history, references, portfolio links, and eligibility-to-work information you submit through our Careers page.
• Event & communication data: newsletter subscriptions, survey responses, webinar registrations, and feedback.

B. Information collected automatically

When you visit the Site, our hosting infrastructure and (where enabled) analytics tools may record technical data such as: IP address, approximate location derived from IP, browser type and version, device type and operating system, referring URL, pages viewed, time on page, and general interaction events.

C. Information from third parties

• Business-contact data from professional networks and verified data providers, used strictly for B2B outreach;
• Referral details shared by a partner, client, or colleague who introduces you to us;
• Publicly available information, such as company websites and professional profiles;
• Background-check or identity-verification results for personnel and contractors, where lawfully required.

We use personal information only for clear, legitimate business purposes, and we keep our processing proportionate to those purposes.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you.

Where the EU General Data Protection Regulation ("GDPR") or the UK GDPR applies, we rely on one or more of the following legal bases. You may contact us at any time to ask which basis applies to a specific activity.

Cookies and similar technologies (pixels, local storage, SDKs) help the Site function, remember your preferences, and — where you agree — understand how visitors use it. You can control cookies through your browser at any time.

• Browser controls: most browsers let you block or delete cookies — see your browser's help pages. Blocking strictly necessary cookies may break parts of the Site.
• Your choices travel with you: if you withdraw consent, we stop using the relevant non-essential cookies going forward.
• Third-party cookies are set by providers we work with and are governed by their own privacy notices.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising in exchange for money. We disclose personal information only in the limited circumstances below.

• Service providers & sub-processors — hosting, cloud infrastructure, email, CRM, helpdesk, analytics, payment, and security vendors that process data on our documented instructions (Section 7).
• Platform partners — where you ask us to implement or integrate Salesforce, Microsoft, Shopify or similar platforms, we may exchange the minimum data required with those partners, under their terms.
• Professional advisers — auditors, insurers, lawyers, and accountants, under confidentiality obligations.
• Group & delivery offices — our affiliated delivery and business offices in Pakistan, Canada, the UK, and Spain, under intra-group data-protection terms.
• Corporate transactions — in a merger, acquisition, financing, or sale of assets, information may transfer to the successor, subject to this Policy.
• Legal & safety — where required by law, court order, or to protect the rights, property, or safety of Quantum Bridge, our clients, or the public.
• With your direction — whenever you ask us to, or as described when we collect the data.

We may also share aggregated or de-identified information that cannot reasonably be linked to you — for example, industry benchmarks or service-usage statistics.

Every vendor that touches personal information on our behalf is vetted before onboarding and bound by a written agreement requiring, at minimum: processing only on our instructions, confidentiality obligations, appropriate technical and organisational security measures, breach-notification duties, and deletion or return of data at the end of the engagement.

Current categories of sub-processors include: cloud hosting and infrastructure, business email and productivity suites, CRM and marketing automation, customer-support tooling, form and spam-protection services, payment processing, and security monitoring.

We operate across five countries, so personal information may be transferred to and processed in countries other than the one in which it was collected — including the United States, the United Kingdom, the European Union, Canada, and Pakistan. Some of these countries have been recognised as providing an adequate level of protection; others have not.

Where we transfer personal data out of the EEA, the UK, or Switzerland, we put appropriate safeguards in place, such as:

• The European Commission's Standard Contractual Clauses (2021/914) and, for the UK, the International Data Transfer Addendum;
• Where applicable, reliance on the EU–US Data Privacy Framework and the UK Extension for transfers to certified US recipients;
• Transfer impact assessments covering local law, access by public authorities, and supplementary technical measures such as encryption in transit and at rest;
• Contractual commitments on onward transfers, so the same protections follow the data.

You can request a copy of the safeguards we use by emailing [email protected].

We retain personal information only as long as it is needed for the purposes we collected it, or as the law requires. Our standard retention schedule is:

When a retention period ends, we delete, anonymise, or aggregate the data. Data may persist briefly in encrypted backups until those backups roll off their normal cycle (typically within 90 days).

Security is not an afterthought at Quantum Bridge — it is part of how we architect systems. The controls below apply to our own environment and are the same practices we bring to client work:

No method of transmission or storage is 100% secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security.

Depending on where you live, you may have some or all of the following rights. We honour these requests regardless of where you are, as a matter of good practice.

How to exercise your rights

Email [email protected] with the subject line "Privacy Request", or write to us at Quantum Bridge Services LLC, 1021 E Lincolnway Rd, New Lenox, Illinois 60451, USA. Please tell us what you want and enough about you for us to verify the request — we never ask for more than we need. Authorised agents may submit requests with proof of authorisation.

We will not discriminate against you for exercising your rights: you will not receive a different level of service, be denied services, or be charged differently because you exercised a privacy right.

This section supplements our Policy for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). It is our notice at collection.

Categories we collect, and why

• Sale & sharing: we do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months.
• Sensitive personal information: we do not collect or use sensitive personal information for purposes requiring a limit-use right — please don't send it to us through the Site.
• Your California rights: know/access, delete, correct, portability, limit use of sensitive personal information, opt out of sale/sharing (not applicable but honoured), and non-discrimination.
• Shine the Light (California Civil Code §1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.
• Financial incentives: we offer none in exchange for personal information.

To exercise any right, email [email protected] with the subject "California Privacy Request".

When we deliver services — application engineering, AI and data systems, cloud and infrastructure, platform implementation, staff augmentation, or managed services — we frequently handle personal data belonging to our clients' customers, employees, or end users ("Client Data").

Some of our services and products include artificial-intelligence and machine-learning capabilities. Where AI is involved, we follow these principles:

• Human oversight by default — AI assists our engineers; it does not replace accountable human review of deliverables.
• No training on your data without permission — we do not use Client Data or your personal information to train our own or third-party models unless a separate written agreement expressly permits it.
• Transparency — where a service uses AI in a way that materially affects you, we will tell you in the applicable agreement or notice.
• No solely automated decisions with legal effect — we do not use automated processing to make decisions that produce legal or similarly significant effects about individuals.
• Output is reviewed, not guaranteed — generative output may contain errors and must be validated before it is relied upon (see our Terms & Conditions).

If you are a business contact, we may send you relevant insights, service updates, or event invitations. Every marketing email includes a one-click unsubscribe link, and we honour opt-outs promptly — usually immediately.

• Unsubscribe: use the link in any marketing email, or email us and we will remove you from marketing lists.
• Service messages are different: we will still send essential, non-promotional messages about contracts, invoices, security notices, and support — these are part of the service.
• We keep a suppression record: if you opt out, we retain the minimum data needed to make sure we don't contact you again.

Our Site and services are intended for businesses and professionals. They are not directed to children, and we do not knowingly collect personal information from anyone under 16 years of age (or under 13 where a different threshold applies locally). If you believe a child has provided us personal information, contact us and we will delete it promptly.

The Site may link to third-party websites, and our work may involve platforms such as Salesforce, Microsoft Dynamics 365, Power Platform, Shopify, and cloud providers. Those services are governed by their own privacy notices, which we do not control and are not responsible for. We encourage you to read the privacy notice of every service you use.

We honour Global Privacy Control (GPC) opt-out preference signals sent by your browser or device, as required by applicable law. Because we do not sell personal information or conduct cross-context behavioural advertising, there is no "sale" or "share" for those signals to switch off — but we record and respect the signal regardless.

When you apply through our Careers page, we process your application to assess your suitability, communicate with you, and — where lawful — verify references and eligibility to work. We keep unsuccessful applications for up to 12 months (longer only with your consent) and we do not sell recruitment data or use it for marketing unrelated to your application.

We may update this Policy to reflect changes in our services, technology, or legal requirements. When we make material changes we will update the effective date and version number above and, where appropriate, notify you by email or with a prominent notice on the Site. Continued use of the Site after an update means you accept the revised Policy.

We would rather fix a concern than have you carry it. Contact our privacy team first — we aim to resolve every question within one business day.

Supervisory authorities

If you are not satisfied with our response, you have the right to complain to a data-protection authority, including:

• EEA: your local supervisory authority (e.g., AEPD in Spain, your member-state DPA)
• UK: the Information Commissioner's Office (ICO)
• Canada: the Office of the Privacy Commissioner of Canada (OPC)
• California: the California Privacy Protection Agency (CPPA) or the Attorney General
• Pakistan: the relevant authority under applicable national data-protection law
• United States: your state Attorney General's office

This Policy should be read together with our Terms & Conditions. Where a signed agreement between you and Quantum Bridge conflicts with this Policy, the signed agreement controls.