Privacy notice

Controller and scope

The controller responsible for the processing of personal data described in this Privacy Notice is:

This notice applies only to this website and initial business or privacy inquiries sent to us. It does not describe personal information handled during a client engagement. Any engagement-specific processing will be addressed by the relevant agreement, instructions, or privacy information, as applicable.

Information we handle

The information we handle depends on how you interact with us:

• Website and device information: internet protocol (IP) address, request date and time, pages or files requested, response and security information, browser or device type, user-agent information, and the referring page where supplied by your browser.
• Cloudflare performance information: a per-page load identifier, page and landing address, referring page, page-load timing, and Core Web Vitals such as loading speed, visual stability, and interaction responsiveness.
• Google Analytics information, if you consent: pages viewed, page title and address, referring source, visit and engagement times, interaction events, approximate location derived from your IP address, browser, operating system, device category, screen information, and pseudonymous client and session identifiers.
• Inquiry, scheduling, and communication information: your name, business contact details, organization and role, meeting details you provide through Microsoft Bookings, the contents of your message and attachments, and our related correspondence.

We receive this information directly from you, through Microsoft Bookings when you choose to schedule a consultation, automatically from your browser through our hosting provider and Cloudflare’s Real User Measurements, if you accept Google Analytics through Google, or from a colleague who includes you in an inquiry.

Providing information in an inquiry is voluntary, but we may be unable to respond or assess your request without enough contact and contextual information.

Why we use information and our legal bases

Where European or UK data protection law applies, we rely on the legal bases described below. Equivalent grounds may apply elsewhere.

Except for optional Google Analytics and any other use for which we expressly request consent, we do not rely on consent for the activities described above. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

When we share information

We disclose personal information only where it is reasonably necessary for the purposes above. Recipients may include:

• Cloudflare, the hosting, delivery, security, and cookieless performance-measurement provider configured for this website;
• Google Ireland Limited, which provides Google Analytics if you consent to Google Analytics;
• Microsoft, which provides the Bookings scheduling service when you choose that contact option;
• our email and information-technology providers when you send us a message;
• professional advisers where needed to address an inquiry, comply with law, or protect legal rights; and
• courts, regulators, law-enforcement bodies, public authorities, or other parties where disclosure is legally required or necessary to protect rights and safety.

Cloudflare explains its handling of end-user data in its privacy policy. Google describes how it safeguards and uses Analytics data in its Google Analytics privacy and data safeguards information and Google Privacy Policy. Microsoft explains its handling of personal data in the Microsoft Privacy Statement.

International transfers

Our website is available worldwide. Cloudflare’s global network and, if you consent to Google Analytics, Google’s infrastructure may process information in countries other than the one where you live, including the United States. For transfers not covered by an EU adequacy decision or UK adequacy regulation, the providers’ contractual terms provide for recognized safeguards such as the EU Standard Contractual Clauses and UK Addendum, as applicable. See Cloudflare’s Data Processing Addendum and Google’s data processing terms. You may contact us for information about safeguards relevant to your information.

We do not sell personal information covered by this notice or share it for cross-context behavioral advertising or targeted advertising.

Links in this notice to Cloudflare and privacy regulators lead to websites operated by those organizations. Their privacy notices apply when you follow those links.

How long we keep information

We keep personal information only while its purpose and applicable legal requirements continue to apply:

• Website and security information is retained under Cloudflare’s service settings and terms for the period needed to deliver and protect the website, diagnose a problem, or investigate an incident. The static site source does not create a separate visitor database.
• Cloudflare RUM performance information: Cloudflare states that it retains unsampled beacon data for seven days, after which it aggregates and reduces the data used for longer-term reporting. Web Analytics reports are available to us for the previous six months. We do not create a separate raw RUM database.
• Google Analytics information is retained according to the settings in our Analytics property only while it remains useful for understanding website trends, then deleted or aggregated. Google notes that its user-level and event-level retention control does not apply to standard aggregated reports. Analytics cookies may remain for up to two years unless you withdraw consent or delete them sooner.
• Your analytics choice is stored in your browser’s local storage for up to six months so the website can respect it. It is then removed and you will be asked again.
• Inquiry records are kept while we respond and complete reasonable follow-up, then only while needed to document the exchange, meet a legal obligation, or address a possible legal claim.
• Privacy-request records are kept for the period needed to complete the request and demonstrate how it was handled.

Your privacy rights

Depending on where you live, the law that applies, and the legal basis for processing, you may have the right to:

• ask whether we process your personal information and receive a copy;
• correct inaccurate or incomplete information;
• ask us to delete information or restrict how it is used;
• object to particular uses of your information;
• receive information you provided in a portable format;
• withdraw consent where processing is based on consent; and
• complain to, or seek review by, the privacy or data-protection authority in your jurisdiction.

Where EU GDPR applies to our processing, you may complain to the supervisory authority where you live or work, or where an alleged infringement occurred. The European Data Protection Board lists EEA authorities. Where UK GDPR applies, you may complain to the Information Commissioner’s Office.

To exercise a right, email privacy@qa4tech.com. We may ask for information reasonably needed to verify your identity and authority. Rights are not absolute, and lawful exemptions may apply. We will explain our decision and any available appeal route if we cannot fulfill a request.

Cookies, analytics, and automated decisions

Cloudflare Web Analytics

Cloudflare automatically injects a Real User Measurement (RUM) performance beacon when it delivers an HTML page. This operates independently of your Google Analytics choice and measures page-load timing, Core Web Vitals, the page and landing address, and the referring page. A random identifier relates only to the current page load and is not used to recognize you on a later visit.

Cloudflare states that the RUM beacon does not store or access cookies, local storage, session storage, IndexedDB, or other information stored on your device. Cloudflare receives the source IP address as part of normal HTTP request handling but states that it discards the address at the nearest data centre and does not store it in its core databases or logs. See Cloudflare’s RUM privacy and data-collection information.

Google Analytics

We use Google Analytics 4 with measurement ID G-RGZH59GBFZ only after you select “Accept Google Analytics.” Until then, the website does not request the Google tag or send Analytics data to Google. If you accept, the Google tag is loaded from www.googletagmanager.com and sends measurement data to Google Analytics. We have disabled Google Signals and advertising-personalization signals in the tag configuration.

Google Analytics sets first-party cookies including _ga, used to distinguish pseudonymous visitors, and _ga_<measurement-id>, used to maintain session state. Google lists a default lifetime of up to two years for these cookies. Google uses IP addresses at collection time for functions including approximate location and routing, but states that GA4 discards IP addresses before logging them.

Your choice

You may accept or reject Google Analytics in the choice panel. We store that choice, together with the date it was made, in your browser’s local storage under qa_analytics_consent for up to six months. This preference is necessary to remember and apply your request. You can reopen the panel at any time using “Cookie settings” in the website footer. If you withdraw consent, the website disables further Google Analytics measurement, attempts to remove its Analytics cookies, and will not load the Google tag on later pages. This choice does not control Cloudflare’s cookieless RUM performance measurement. You can also delete cookies and site data using your browser controls.

When the site is delivered through Cloudflare, Cloudflare necessarily processes request data and may provide aggregate edge-traffic statistics. It may also use strictly necessary cookies or similar technologies when required to provide security, prevent abuse, or operate its network. We do not use Google Analytics or Cloudflare activity for advertising on this site.

The site does not include advertising pixels or technology intended by us to track your activity across unrelated websites. Because we use an express analytics choice rather than the legacy browser “Do Not Track” signal, that signal does not change the site’s behavior.

This website does not make decisions based solely on automated processing that produce legal or similarly significant effects.

Security and children

This site is configured as a statically generated website for delivery through Cloudflare. It uses response headers that restrict content-type interpretation, framing, referrer information, and access to selected browser features. No internet transmission or storage system is completely secure, so please use care when deciding what to send by email.

This business website is intended for professionals and is not directed to children. We do not knowingly solicit personal information from children. If you believe a child has sent personal information to us, contact us so we can review and delete it where appropriate.

Changes and contact

We may update this notice when our services, technology, or legal obligations change. We will post the revised notice on this page and update the date above. Where required, we will also provide prominent or direct notice before a change materially affects how we use information already collected.

For questions, rights requests, or concerns about this notice or our handling of personal information, contact: