Privacy Notice

What we process

• Account and contact information, such as name, email address, organization membership and invitation details. Invitations may come from another user rather than directly from you.
• Diligence enquiry information submitted through the contact form, including your name, email address and brief note, together with delivery status, follow-up status and internal notes added by authorized Qonform staff.
• Assessment material supplied by participants, including questions, answers, comments, uploaded evidence, report snapshots and activity records.
• Technical information needed to operate the site, such as session and security data, cookies and server request information.
• If enabled and you opt in, analytics information about visits to the site.

Why we process it

Account details and assessment records are used to provide the requested service and collaboration features. The legal basis for your account data is performance of a contract where you contract with us directly, or our legitimate interests in providing the service to your organization. We use security information to protect accounts and the platform on the basis of legitimate interests; some records may be needed to meet legal obligations.

Contact-form details are used to review and respond to diligence enquiries on the basis of our legitimate interests in handling requested business conversations. Authorized Qonform staff may record a follow-up status and internal notes so the enquiry can be handled consistently.

Organizations decide the purposes and lawful basis for the personal data they include in their assessments. We use that material to run their assessments and generate requested reports. Optional analytics uses consent, which is separate from accepting the terms.

Sharing and transfers

Authorized organization and assessment participants can see material according to their access rights. Hosting, storage and email providers help us operate the service. When an AI feature is requested, relevant text goes to external AI service providers: report prompts contain assessment names, questions, answers and selected risk comments, but not the contents of uploaded evidence files. Answer suggestions use the question and answer text. If you consent to optional analytics and it is enabled, an analytics provider receives visit information.

A minimal notification email tells the Qonform team that a new enquiry is ready for review through a secure internal link. The notification does not include the submitted name, email address or brief note. Only authorized platform administrators and Django superusers can view enquiry records and internal follow-up notes; organization administrators and members cannot access them.

AI and analytics providers may process data outside the EU/EEA. We cannot promise that all processing stays in the EU. Contact us before submitting personal data to these features for details of the applicable locations and transfer safeguards.

Retention

Account and assessment records remain while they are needed for the service or a legal obligation. Report snapshots are kept as part of the assessment history. Removing an assessment from an organization's view does not itself erase the underlying records. If you need data deleted or want information about retention for a specific record, contact us; we will assess the request against applicable rights and obligations.

Diligence enquiries and their internal follow-up notes remain available until a platform superuser manually deletes the enquiry. Deleting an enquiry also deletes its internal notes. Contact us directly if you want us to assess a deletion or other data-rights request.

Cookies and choices

Necessary cookies support sign-in, security, language and your cookie choice. The cookie-choice setting lasts one year. Optional analytics is loaded only after you accept analytics cookies, when configured. You can reject it without losing access to the site.

You can also remove existing cookies in your browser settings.

Your rights

Where the GDPR applies, you may request access, correction or deletion of your personal data, restriction of processing or portability, and object to processing based on legitimate interests. You can withdraw consent for optional analytics at any time. Some rights depend on the circumstances and may be subject to legal limits.

Send requests to the email address above. If the information is in an organization's assessment, you may also contact that organization; we will help route requests where appropriate. You can lodge a complaint with the data protection authority in your EU/EEA country.