AgeniQA — Privacy Policy
Effective Date: 27 October 2026
This document requires legal review before it is relied upon. It
describes what this software actually does, which is the part an
engineer can verify. Whether that is sufficient for your obligations,
and whether the legal bases claimed below are the right ones, is a
question for qualified counsel.
1. Who is responsible for your data
The controller for personal data described in this policy is:
Bruno Mota
Calle Manuel Vivas Santillán, 14
06200 Almendralejo
Spain
Spain
Registration number: Z2497111Y
VAT number: Z2497111Y
Questions about privacy and all data protection requests:
Hello, For any questions or requests concerning privacy, data protection, or legal matters related to AgeniQA, please contact us using the appropriate channels provided on our website. This includes matters such as: Personal data protection and GDPR-related requests Data subject rights, including access, rectification, deletion, and objection Privacy or security concerns Legal notices and regulatory matters Questions regarding the processing, storage, or use of personal data Requests concerning our Privacy Policy, Cookie Policy, or Legal Notice We are committed to handling personal data responsibly and in accordance with applicable data protection and privacy legislation. For detailed information about how AgeniQA processes personal data, please refer to our Privacy Policy and Legal Notice. Kind regards, AgeniQA Team ageniqa.eu
Data Protection Officer: Bruno Mota
*Where a field above is blank, that detail has not been published yet.
Please write to the address above and it will be provided.*
2. Controller and processor
This service has two distinct relationships with personal data, and your
rights differ between them.
We are the controller for the accounts of the people who sign up for
and administer a workspace: signup details, billing contacts, sign-in
records and support correspondence.
We are a processor for the operational data a customer puts into their
own workspace - their agents, rotas, quality evaluations, coaching records
and performance data. That data belongs to the customer, who is its
controller. If you are an agent or team member whose data is held in an
employer's workspace, your rights are exercised against your employer,
not against us. Contact them first; we will assist them in responding.
3. What we collect
Account and signup data. Name, work email address, company name, and a
hashed password. Optionally, if you choose to provide them: job title,
telephone number, country, company size, VAT number, and how you heard
about us. These optional fields are not required to create or use an
account.
Billing data. Company billing name and address, VAT number, invoices,
and references issued by the payment provider (a customer id, a
subscription id). **We never receive or store full card numbers, expiry
dates or security codes** - those go directly to the payment provider.
Authentication data. Password hashes (never the password itself),
two-factor secrets and recovery codes, session records, and password reset
tokens.
Consent records. Which version of the terms and privacy policy you
accepted, when, and the IP address and browser user agent at that moment.
These are kept as evidence that consent was given, which is itself a legal
requirement; without the IP and timestamp the record would not be worth
holding.
Technical and security data. IP addresses, request paths, timestamps
and outcomes in application and audit logs. Failed sign-in attempts.
Support correspondence. The content of tickets you open and any
messages exchanged on them.
Operational workspace data. Whatever the customer chooses to record
about their own staff. We do not decide what goes in here.
4. What we do not collect
We do not use analytics, advertising or third-party tracking cookies. No
third-party script runs on our pages. We do not build profiles, we do not
track you across other websites, we do not buy or sell personal data, and
we make no automated decision that produces a legal or similarly
significant effect on you.
We do not ask for date of birth, gender, or precise location, and we do not
knowingly collect special category data.
5. Why we use it, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account and signup data | Creating and running your workspace | Contract, Art. 6(1)(b) |
| Optional profile fields | Understanding who our customers are | Consent, Art. 6(1)(a) - they are optional and can be left blank or cleared |
| Billing data | Invoicing, tax records, collecting payment | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) for retention |
| Authentication data | Signing you in and keeping accounts secure | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Consent records | Proving what was agreed and when | Legal obligation, Art. 6(1)(c); Art. 7(1) |
| Security and audit logs | Detecting and investigating abuse | Legitimate interests, Art. 6(1)(f) |
| Support correspondence | Answering your question | Contract, Art. 6(1)(b) |
| Marketing email | Product news, only if you opt in | Consent, Art. 6(1)(a) - withdrawable at any time |
| Operational workspace data | Providing the service to our customer | Processed on the customer's instructions, Art. 28 |
6. How long we keep it
| Data | Retained for |
|---|---|
| Account data | While the workspace is active |
| Cancelled or lapsed workspace | A retention window after it ends, then permanently deleted |
| Invoices and tax records | The statutory period required by tax law, which a deletion request does not override |
| Consent records | For as long as the related account exists, plus any limitation period |
| Email delivery logs | 90 days |
| Session records | Until expiry or sign-out |
| Password reset tokens | Until used or expired, whichever comes first |
| Support tickets | While the account is active |
| Backups | Rolling window; a deletion works through backups as they age out |
Deleting a workspace cascades to the personal data inside it. Backups are
the exception: a record already written to a backup is removed when that
backup ages out of the retention window, not on the day of the request.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy.
- Rectification of anything inaccurate. Most account details you can
correct yourself in your account settings.
- Erasure, subject to records we are legally required to keep.
- Restriction of processing while a dispute is resolved.
- Portability - a copy in a structured, machine-readable format.
- Object to processing carried out on the basis of legitimate interests.
- Withdraw consent at any time, for anything based on consent. This
does not affect processing that already happened.
Signed-in account holders can exercise access and portability directly
from Account → Privacy in the application, which produces a JSON export
of the personal data held about you. No request and no waiting.
For anything else, write to Hello, For any questions or requests concerning privacy, data protection, or legal matters related to AgeniQA, please contact us using the appropriate channels provided on our website. This includes matters such as: Personal data protection and GDPR-related requests Data subject rights, including access, rectification, deletion, and objection Privacy or security concerns Legal notices and regulatory matters Questions regarding the processing, storage, or use of personal data Requests concerning our Privacy Policy, Cookie Policy, or Legal Notice We are committed to handling personal data responsibly and in accordance with applicable data protection and privacy legislation. For detailed information about how AgeniQA processes personal data, please refer to our Privacy Policy and Legal Notice. Kind regards, AgeniQA Team ageniqa.eu. We respond within one
month, as Art. 12(3) requires. If we need longer because the request is
complex, we will tell you within that month and explain why.
We may ask you to verify your identity before acting on a request. That is
not obstruction: acting on an unverified erasure request would itself be a
breach.
8. Cookies
We set three first-party cookies, all strictly necessary: one that keeps
you signed in, one that holds a part-finished two-factor sign-in, and one
that records your answer to the cookie notice. There are no analytics,
advertising or third-party tracking cookies, and no third-party script runs
on our pages.
The full list, with purposes and expiry times, is on the
Cookie Policy page, where you can also review your choice.
9. Who else processes your data
We use a small number of processors, each under a data processing
agreement. The current list, with what each one receives and where it
operates, is published on the Cookie Policy and
Legal Notice pages.
Card and PayPal payment details are handled by the payment provider you
choose at checkout. Their pages are theirs and are governed by their own
privacy policies; nothing of theirs runs on our pages.
10. International transfers
This service is hosted by Europe in Europe.
Where a processor operates outside the EEA, transfers rely on an adequacy
decision or on Standard Contractual Clauses. Details are available on
request from Hello, For any questions or requests concerning privacy, data protection, or legal matters related to AgeniQA, please contact us using the appropriate channels provided on our website. This includes matters such as: Personal data protection and GDPR-related requests Data subject rights, including access, rectification, deletion, and objection Privacy or security concerns Legal notices and regulatory matters Questions regarding the processing, storage, or use of personal data Requests concerning our Privacy Policy, Cookie Policy, or Legal Notice We are committed to handling personal data responsibly and in accordance with applicable data protection and privacy legislation. For detailed information about how AgeniQA processes personal data, please refer to our Privacy Policy and Legal Notice. Kind regards, AgeniQA Team ageniqa.eu.
11. How we protect it
Passwords are hashed, never stored or recoverable in plain text. Optional
two-factor authentication is available on every account. Stored credentials
are encrypted at rest. Access is controlled by role and separated by
workspace, so one customer cannot reach another's data. Administrative
actions are recorded in an audit log. Support access to a customer
workspace requires that customer's approval, is time-limited, and is
visible to them throughout.
Security is a practice, not a state. We do not claim to be unbreachable,
and we hold no security certification - see the Security page
for exactly what is and is not in place.
12. If something goes wrong
If a personal data breach occurs and it is likely to result in a risk to
your rights and freedoms, we will notify the competent supervisory
authority within 72 hours of becoming aware of it, as Art. 33 requires, and
inform affected people directly where Art. 34 requires it.
13. Children
This is a workplace tool. It is not directed at children and we do not
knowingly collect data from anyone under 16. If you believe a child's data
has reached us, write to Hello, For any questions or requests concerning privacy, data protection, or legal matters related to AgeniQA, please contact us using the appropriate channels provided on our website. This includes matters such as: Personal data protection and GDPR-related requests Data subject rights, including access, rectification, deletion, and objection Privacy or security concerns Legal notices and regulatory matters Questions regarding the processing, storage, or use of personal data Requests concerning our Privacy Policy, Cookie Policy, or Legal Notice We are committed to handling personal data responsibly and in accordance with applicable data protection and privacy legislation. For detailed information about how AgeniQA processes personal data, please refer to our Privacy Policy and Legal Notice. Kind regards, AgeniQA Team ageniqa.eu and we will delete it.
14. Complaints
If you are unhappy with how we have handled your data, please tell us
first - most things are quicker to fix directly.
You also have the right to complain to a supervisory authority, in
particular in the EU or EEA country where you live, work, or where you
believe the problem occurred. In Spain that is the national
data protection authority.
15. Changes to this policy
When this policy changes materially we publish a new version with a new
effective date, and existing consent records are not rewritten - they
continue to record the version that was actually accepted.
16. Contact
Bruno Mota
Calle Manuel Vivas Santillán, 14
06200 Almendralejo
Spain
Privacy: Hello, For any questions or requests concerning privacy, data protection, or legal matters related to AgeniQA, please contact us using the appropriate channels provided on our website. This includes matters such as: Personal data protection and GDPR-related requests Data subject rights, including access, rectification, deletion, and objection Privacy or security concerns Legal notices and regulatory matters Questions regarding the processing, storage, or use of personal data Requests concerning our Privacy Policy, Cookie Policy, or Legal Notice We are committed to handling personal data responsibly and in accordance with applicable data protection and privacy legislation. For detailed information about how AgeniQA processes personal data, please refer to our Privacy Policy and Legal Notice. Kind regards, AgeniQA Team ageniqa.eu
Legal: info@ageniqa.eu