Privacy Policy

1. Data Controller & Data Protection Officer

Quantum Core Institute acts as the data controller for the personal information described in this policy. Our designated Data Protection Officer (DPO) can be contacted at:

• Data Protection Officer: Quantum Core Institute, Privacy Office
• Email: dpo@quantumcoreinstitute.com
• Address: 1410 North Scott Street, #955, Arlington, VA 22209, United States

2. Information We Collect

Personal Information You Provide

• Name and contact information (email address, phone number)
• Professional information (company name, job title, industry sector)
• Educational background and professional interests
• Account credentials (encrypted and securely stored)
• Payment information (processed securely through PCI DSS-compliant third-party processors)
• Assessment and simulation responses
• Newsletter subscription preferences and communication history

Information Collected Automatically

• Device and browser information (type, version, operating system)
• IP address (anonymized where required by law)
• Website usage data, page views, and navigation patterns
• Course progress, assessment results, and completion data
• Cookies and similar tracking technologies (see our Cookie Policy)
• Referral source and campaign attribution data

Information from Third Parties

• Authentication providers (when using social sign-in)
• Analytics and advertising partners
• Publicly available professional information

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data under the following lawful bases:

• Consent (Art. 6(1)(a)): For newsletter subscriptions, marketing communications, non-essential cookies, and optional analytics. You may withdraw consent at any time.
• Contract Performance (Art. 6(1)(b)): To provide educational services, process enrollments, deliver course content, generate assessment reports, and manage your account.
• Legitimate Interest (Art. 6(1)(f)): For platform security, fraud prevention, service improvement, anonymized analytics, and direct marketing to existing customers (with opt-out). We conduct balancing tests to ensure our interests do not override your fundamental rights.
• Legal Obligation (Art. 6(1)(c)): To comply with tax, financial reporting, and regulatory requirements.

4. How We Use Your Information

• Provide, maintain, and improve our educational and assessment services
• Process payments, manage accounts, and fulfill contractual obligations
• Send course updates, educational content, and newsletter publications
• Generate personalized quantum risk assessments and Q-Risk Score reports
• Respond to support requests, inquiries, and communications
• Analyze usage patterns to enhance user experience (using anonymized/aggregated data where possible)
• Ensure platform security and prevent unauthorized access
• Comply with legal obligations and enforce our Terms of Service

5. Data Sharing and Third Parties

We may share your information with the following categories of recipients:

• Service Providers: Cloud hosting (Supabase, AWS), email delivery (Resend), payment processing (Stripe)
• Analytics Partners: Google Analytics (with IP anonymization enabled)
• Educational Partners: Instructors and content providers (limited to information necessary for service delivery)
• Legal & Regulatory: Law enforcement or regulatory bodies when required by law or to protect our legal rights

We never sell your personal information to third parties.

All third-party processors are contractually bound to process data only on our instructions and in compliance with applicable data protection laws (via Data Processing Agreements).

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence, including the United States. When we transfer data from the EEA, UK, or Switzerland to countries not deemed to provide an adequate level of data protection, we implement the following safeguards:

• Standard Contractual Clauses (SCCs): EU Commission-approved clauses incorporated into our agreements with third-party processors
• Adequacy Decisions: Where applicable, reliance on the European Commission's adequacy determinations
• EU-U.S. Data Privacy Framework: Where our processors are certified participants
• Supplementary Measures: Encryption in transit and at rest, access controls, and data minimization

You may request a copy of the applicable safeguards by contacting our DPO.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Duration of your account plus 30 days after deletion request
• Course completion & certification data: 7 years (for verification and accreditation purposes)
• Assessment and simulation results: 3 years, or until deletion is requested
• Payment records: 7 years (as required by tax and financial regulations)
• Newsletter subscriber data: Until you unsubscribe, plus 30 days for processing
• Analytics data: 26 months (anonymized/aggregated data may be retained indefinitely)
• Legal hold data: As required by applicable law or litigation

8. European Economic Area & UK Rights (GDPR)

If you are located in the EEA or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right to Access (Art. 15): Request a copy of all personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Request limitation of how we process your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right re: Automated Decision-Making (Art. 22): Not be subject to decisions based solely on automated processing that produce legal or significant effects. Our Q-Risk Score assessments involve algorithmic analysis but are provided as advisory tools, not automated decisions with legal effect.
• Right to Withdraw Consent: Where processing is based on consent, withdraw at any time without affecting the lawfulness of prior processing

To exercise these rights, contact our DPO at dpo@quantumcoreinstitute.com. We will respond within 30 days (extendable by 60 days for complex requests). There is no fee for exercising your rights unless requests are manifestly unfounded or excessive.

Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu. For the UK, contact the Information Commissioner's Office (ICO) at ico.org.uk.

9. California Residents' Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with additional rights:

Your Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: Direct us not to sell or share your personal information. QCI does not sell personal information.
• Right to Limit Use of Sensitive Personal Information: Limit use to what is necessary for providing services
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights

Categories of Personal Information Collected (Past 12 Months)

• Identifiers: Name, email address, IP address, account credentials
• Commercial Information: Purchase history, enrollment records
• Internet/Electronic Activity: Browsing history, search history, interaction with our platform
• Professional/Employment Information: Job title, company, industry
• Education Information: Course progress, assessment results, certifications
• Inferences: Profiles reflecting preferences, characteristics, and aptitudes derived from assessment data

To exercise your rights, contact us at privacy@quantumcoreinstitute.com or use the contact details in Section 15. We will verify your identity before processing requests. You may also designate an authorized agent to make requests on your behalf.

10. Canadian Residents' Rights (PIPEDA)

If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation provide you with the following rights:

• Access: Request access to your personal information held by QCI
• Correction: Challenge the accuracy and completeness of your information and have it amended
• Consent Withdrawal: Withdraw consent for the collection, use, or disclosure of your information, subject to legal or contractual restrictions
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

We obtain meaningful consent for the collection, use, and disclosure of personal information. The form of consent may vary depending on the sensitivity of the information and the reasonable expectations of the individual.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and principle of least privilege
• Regular security assessments and penetration testing
• Secure software development practices
• Employee training on data protection and security
• Incident response and business continuity procedures

12. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Art. 33)
• Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34)
• Comply with US state breach notification laws, including notifying the California Attorney General when breaches affect 500+ California residents
• Comply with PIPEDA breach requirements, including reporting to the Privacy Commissioner of Canada and notifying affected individuals when there is a real risk of significant harm
• Document all breaches and remediation actions taken, regardless of whether notification thresholds are met

13. Automated Decision-Making & Profiling

Our platform uses algorithmic analysis in the following contexts:

• Q-Risk Score Assessments: Automated scoring of organizational quantum readiness based on survey responses. These scores are advisory and informational; they do not produce legal effects or similarly significantly affect you.
• Crisis Simulation Scoring: Performance evaluation during simulation exercises, used for educational feedback only.
• Content Personalization: Algorithmic recommendations for relevant courses and resources based on your interests and activity.

You have the right to request human review of any automated assessment, express your point of view, and contest the result by contacting our DPO.

14. Cookies and Tracking

We use cookies and similar technologies to enhance your experience. For detailed information about the cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

15. Children's Privacy

Our services are not directed to individuals under the age of 16 (or 13 in jurisdictions where that is the applicable age of digital consent). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact our DPO.

16. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or regulatory guidance. Material changes will be communicated via email to registered users and through a prominent notice on our website at least 30 days before they take effect. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

17. Contact Information

For questions about this Privacy Policy, to exercise your data protection rights, or to file a complaint:

• Data Protection Officer: dpo@quantumcoreinstitute.com
• General Privacy Inquiries: privacy@quantumcoreinstitute.com
• Mail: 1410 North Scott Street, #955, Arlington, VA 22209, United States

We aim to respond to all legitimate requests within 30 days. For EEA/UK residents, if you are not satisfied with our response, you may lodge a complaint with your local supervisory authority.