GDPR Compliance

Data Controller

Quantilence AI Solutions acts as the data controller for personal data collected when you:

• Visit quantilence.com and interact with the site
• Contact us via the contact form or email
• Register for a paid account

When you submit images to our API for processing on behalf of your users, Quantilence acts as the data processor and you (the customer) are the data controller. In this role, we process data only on your instructions, as set out in our Data Processing Agreement (DPA).

Lawful Basis for Processing

Special Category Data — Biometric Processing

Facial images from which biometric data can be derived are special category data under GDPR Art. 9. Our approach:

• Images submitted to production API endpoints are retained for up to 30 days in isolated, access-controlled storage for operational logging and quality assurance, then automatically and permanently deleted.
• Demo images submitted via the public demo interface are retained for up to 7 days, then automatically deleted.
• Face embeddings computed during processing are transient and are not persisted beyond the API response.
• No biometric database is built from API submissions. Images are never used to train models.
• As a data processor, we rely on the customer's lawful basis under Art. 9(2) for processing special category data submitted via the API.
• Customers must conduct a Data Protection Impact Assessment (DPIA) before processing biometric data through our API in high-risk scenarios (e.g., employee monitoring, public surveillance).

Data Protection Oversight

We have assessed our obligations under GDPR Article 37 with respect to the appointment of a Data Protection Officer. Given that our core activities involve large-scale processing of special category biometric data, privacy and data protection oversight responsibilities are a formal function within our organisation. For DPO-related enquiries, contact privacy@quantilence.com.

Your Rights under GDPR

As a data subject, you have the following rights. To exercise any of them, email privacy@quantilence.com. We will respond within one month. For complex requests, this may be extended by a further two months with notice.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office (ICO); in the EU, with your national data protection authority.

Data Retention

International Data Transfers

Our primary infrastructure is located within the European Union. Where personal data is transferred outside the EU/EEA (for example, to sub-processors in other regions), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Transfer Impact Assessments for high-risk destination countries

A list of our sub-processors and their locations is available to all paying customers on request at legal@quantilence.com. No NDA is required to obtain this list.

Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware, where feasible. If the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay.

Data Processing Agreement

All paying customers who process personal data through our API are entitled to a Data Processing Agreement (DPA) that formalises our respective roles and obligations under GDPR. To request a DPA, email legal@quantilence.com with "DPA Request" in the subject line. We aim to return a signed DPA within 5 business days.

Contact

For GDPR-related enquiries or to exercise your rights, contact our privacy team:

For our full privacy practices, see the Privacy Policy.