Privacy Notice

Who We Are

Consianimis Consulting Ltd. is a company registered in England and Wales, with its registered office at:

We are the controller for personal data processed through the Site and our own business and marketing activities. We are registered with the UK Information Commissioner’s Office (ICO) under registration reference ZB001465.

We process personal data in accordance with the UK GDPR (the retained EU General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland) and the Data Protection Act 2018. Our lead supervisory authority is the ICO.

For any privacy question, or to exercise your rights, contact us at contact@qualitax.io.

Our Two Roles

The way this Notice applies to you depends on how your data reaches us.

As a controller. When you visit the Site, contact us, or interact with our marketing, we determine the purposes and means of processing your personal data. This Notice governs that processing.

As a processor. When we deliver training or consulting services to a subscribing organisation (for example, through the QualitaX AI Training Sandbox), we process learner and participant data on behalf of that organisation, which is the controller. In that role we act only on the controller’s documented instructions under a Data Processing Agreement (DPA). If your personal data has been provided to us by such an organisation, that organisation’s privacy notice governs the processing, and you should direct requests to them in the first instance; we will support them as required. Our processor commitments, sub-processor arrangements and security measures are described on our Security page and in the applicable DPA.

Information We Collect

Information you provide to us, including:

• your name, email address, organisation and role, and any other details you provide when you register, request a consultation, or otherwise contact us;
• the content of your enquiries, comments and correspondence.

Information we collect automatically when you use the Site, including:

• your Internet Protocol (IP) address and approximate location derived from it;
• your device, browser and operating system information;
• the pages you visit, the time and duration of your visits, and referring pages;
• information collected through cookies and similar technologies (see Cookies and Analytics below).

We do not intentionally collect special category data (as defined in Article 9 of the UK GDPR) through the Site, and we ask that you do not submit it to us unsolicited.

How We Use Your Information and Our Lawful Bases

Under the UK GDPR we must have a lawful basis for each purpose for which we process your personal data. Our purposes and corresponding lawful bases are:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. You may ask us for information about that assessment, and you have the right to object (see Your Rights).

We will not use your personal data for a new, incompatible purpose without providing you with notice and, where required, obtaining your consent.

Cookies and Analytics

We and our service partners use cookies and similar technologies (such as pixels) for the operation of the Site, and, where you consent, for analytics and to understand how the Site is used. Our use of cookies is governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) alongside the UK GDPR.

Strictly necessary cookies are set without consent because the Site cannot function without them. Non-essential cookies (including analytics) are set only where you have given consent through our cookie banner, which you can review or change at any time via the Cookie Settings link at the bottom of the page.

We use Google Analytics to understand who uses the Site and how. Google Analytics uses cookies to collect information such as pages visited, time on page, and truncated IP address. You can opt out using the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout.

We honour recognised browser-based opt-out signals, including Global Privacy Control (GPC), for the setting of non-essential cookies where technically supported.

Marketing and Your Choices

We send marketing communications only where you have consented, or where you are an existing customer and the “soft opt-in” under PECR applies (in which case the communications relate to our own similar products and services and you were given the opportunity to opt out when your details were collected).

You can unsubscribe at any time using the link in the footer of any marketing email, or by emailing contact@qualitax.io. Even after opting out of marketing, you will still receive service and administrative messages relating to any account or engagement.

How We Share Your Information

We do not sell your personal data. We share personal data only as described below, and always under appropriate contractual and security safeguards.

• Service providers and sub-processors. We use trusted third parties to help us operate the Site and deliver the Services (for example, hosting, edge/network security, backup storage, and LLM API providers). They process personal data only on our instructions and only for the purposes we specify. Our current infrastructure providers and the safeguards that apply to them are described on our Security page; a list of sub-processors is available as part of our standard DPA.
• Professional advisers and authorities. We may disclose personal data where necessary to comply with a legal or regulatory obligation, to respond to a lawful request from a public authority, to establish, exercise or defend legal claims, or to protect our rights, property or safety and those of others.
• Business transfers. If we are involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to the protections of this Notice.

Where a third party acts as a controller in its own right (for example, an independent website you choose to visit), its own privacy notice applies.

International Data Transfers

We are established in the United Kingdom and store and process personal data primarily in the UK. Some of our service providers and sub-processors are located outside the UK (for example, in the United States). Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, which may be:

• transfer to a country covered by UK adequacy regulations;
• transfer to a recipient certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), where applicable;
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism permitted under the UK GDPR.

The specific mechanism relied on for each sub-processor is documented in our DPA and sub-processor list. You may request a copy of the relevant safeguards by contacting us at contact@qualitax.io.

Individuals in the European Economic Area

Where we offer Services to, or monitor the behaviour of, individuals located in the European Economic Area (EEA), the EU GDPR may also apply to that processing under its Article 3(2). Where it does, we comply with the EU GDPR in respect of that processing and, where we are required to do so and no exemption applies, we will appoint a representative in the EU under Article 27. EEA residents may contact their local supervisory authority in addition to the ICO.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting, regulatory or reporting requirements. The retention period depends on the type of data and the purpose of processing. When personal data is no longer required, we securely delete or anonymise it. For personal data we process on behalf of a subscribing organisation, retention and deletion are governed by that organisation’s instructions and the applicable DPA.

Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration. These measures are described in more detail on our Security page. No transmission over the internet can be guaranteed to be completely secure, so please take care when submitting information online and keep any account credentials confidential.

Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Access — to be told whether we process your personal data and to receive a copy of it;
• Rectification — to have inaccurate personal data corrected and incomplete data completed;
• Erasure — to have your personal data deleted in certain circumstances;
• Restriction — to limit how we use your personal data in certain circumstances;
• Portability — to receive certain personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller;
• Objection — to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing;
• Rights relating to automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such automated decision-making through the Site; and
• Withdrawal of consent — to withdraw your consent at any time where we rely on it, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email us at contact@qualitax.io, specifying the nature of your request and the personal data concerned. We may ask for information to verify your identity. We will respond within one month; where a request is complex or we receive a number of requests, we may extend this by up to two further months and will let you know if we do.

There is normally no charge for exercising your rights. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline to act, as permitted by law.

If we process your personal data on behalf of a subscribing organisation (as a processor), we will forward your request to that organisation and assist them in responding.

Right to complain. If you are unhappy with how we have handled your personal data, you can complain to the ICO. We would, however, appreciate the chance to address your concerns first.

Children

The Site and Services are intended for business users and are not directed at children. We do not knowingly collect personal data from children under 13. If you believe we may have collected personal data from a child under 13, please contact us at contact@qualitax.io and we will take steps to delete it.

Links to Other Sites

The Site may contain links to third-party websites we do not operate. This Notice does not apply to those sites, and we are not responsible for their content or privacy practices. We encourage you to review the privacy notice of any site you visit.

Changes to This Notice

We may update this Notice from time to time. When we do, we will revise the “Last Updated” date above and, where changes are material, take reasonable steps to notify you. Please review this Notice periodically.

How to Contact Us

For any question about this Notice or about how we handle your personal data, contact us at: