EnQuanta Privacy Policy

Contact information: name, email address, phone number, address, job title, employer, and the content of any message you send us. On the Website this is what you enter in the contact form (name, work email, organization, your interest, the request type and your message).

Partner applications: company, website, your name and work email, partner type, the markets and regions you sell into, and your answers about your business.

Event and session registration: when you register for a live session, webinar, or scoping call, we collect your name and business email address, together with any further details the registration form asks for (such as employer, job title, time zone, or questions you submit). Zoom also provides us with attendance information such as join and leave times.

Documents you sign with us: if you sign a non-disclosure or similar agreement with us through PandaDoc, we collect your name, title, email address, electronic signature, IP address, and the signing audit trail that PandaDoc generates.

Server logs: our servers keep technical logs of requests to the Website (the page requested, the response, the browser type and whether the request came from a known crawler). Infrastructure that fronts the Website may record IP addresses in its own security logs for a short period. We do not build visitor profiles from these logs.

Cookies and tracking technologies: with your consent, information collected through cookies and similar technologies, including your IP address, device and browser type, pages visited and time spent, referring page, approximate (city-level) location, and a pseudonymous identifier. See Section 4, Cookies and similar technologies, for the specific tools we use and your choices.

From other sources: business contact information (name, job title, employer, and business email address) obtained from licensed business-contact databases, from publicly available professional profiles, or from partners and resellers we work with, as described in Section 5. We also receive attendance data from Zoom and delivery and engagement data (opens, clicks, bounces) from our email providers.

From Stripe: the Website does not take payments. If EnQuanta invoices you and you pay by card through a page Stripe hosts, Stripe tells us the payment status together with your name, billing address, email address, the card brand and the last four digits of the card number. We never receive or store your full card number. See Section 6 for Stripe's role.

Responses: to respond to your inquiries and provide the information, demonstrations, or documents you request.

Triage: to review and route inquiries and partner applications. An AI model that runs on EnQuanta's own servers produces a score and a short summary that our team uses to prioritize replies; no form data leaves EnQuanta for this, and a person reads every submission.

Events: to run live sessions, webinars, and scoping calls you register for, and to follow up afterwards.

Marketing: to send marketing email about our products and services to business contacts, and to measure whether it was opened or clicked (see Section 5).

Analytics: to analyze trends and usage for improving the Website, using the tools described in Section 4 and only with your consent where the law requires it.

Security: to detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities.

Export compliance: to evaluate export compliance consistent with our legal obligations regarding limitations on the export of technology and information.

Contracts: to negotiate, sign, and perform contracts such as non-disclosure agreements.

Legal: to comply with legal obligations and to establish, exercise, or defend legal claims.

Responding to inquiries and providing requested information: steps taken at your request before entering a contract (Art. 6(1)(b)); our legitimate interest in responding to people who contact us (Art. 6(1)(f)).

Triage of inquiries and applications: our legitimate interest in answering the right people promptly (Art. 6(1)(f)).

Live sessions, webinars, scoping calls: performance of our arrangement with you (Art. 6(1)(b)); legitimate interest in running and following up events (Art. 6(1)(f)).

Marketing email to business contacts: our legitimate interest in telling organizations that manage cryptographic infrastructure about our products (Art. 6(1)(f)); consent (Art. 6(1)(a)) where local law requires it.

Analytics and advertising cookies: your consent (Art. 6(1)(a); PECR reg. 6 / ePrivacy).

Strictly necessary cookies and Website security: our legitimate interest in operating a secure Website (Art. 6(1)(f)); exempt from cookie consent.

Aggregate, cookieless page counts kept on our own server: our legitimate interest in knowing how the Website is used (Art. 6(1)(f)); nothing is stored on your device and no identifier is kept, so no consent is required.

Contracts and NDAs: performance of a contract with you or your employer (Art. 6(1)(b), (f)).

Payments of invoices: performance of our contract with you (Art. 6(1)(b)); legal obligation for the transaction records tax and accounting law require (Art. 6(1)(c)).

Legal compliance and legal claims: legal obligation (Art. 6(1)(c)); legitimate interest in protecting our rights (Art. 6(1)(f)).

Strictly necessary cookies: essential for site functionality, including remembering the choices you make in our privacy banner. EnQuanta staff signing in to internal dashboards receive a session cookie for that purpose only. These do not require your consent.

Analytics cookies: enquanta.com uses Google Analytics 4 to understand how the site is used (pages visited, approximate location at city level, device and browser; Google Analytics 4 does not log or store IP addresses). Google receives a pseudonymous identifier and technical information about your visit. For the collection and transmission of that data through the tag on our site, we and Google are jointly responsible; Google is thereafter an independent controller of the data it holds, under its own privacy notice (policies.google.com/privacy). Whether the tag runs by default depends on where you are, which we read from your browser's time zone and treat as outside the United States whenever we cannot tell. If you are in the United States, the tag is on unless you decline it, as U.S. state privacy laws allow, and a Global Privacy Control signal from your browser turns it off. If you are in the European Economic Area, the United Kingdom, Switzerland or anywhere else, the tag sets no cookie and stores nothing on your device until you accept it in our privacy banner; until then it sends Google only cookieless, aggregate pings (Google's consent mode) that carry no identifier and are not used to build a profile. You can change your choice or withdraw consent at any time from Privacy settings in the footer of every page.

First-party page counts: our own server counts page views and estimates daily visitors without cookies. It hashes your network address and browser type together with a random value that changes every day and is never stored, so the count cannot identify you and no two days can be linked. Only daily totals are kept. This is strictly necessary audience measurement and runs for every visitor.

Service providers: processors acting on our instructions that run our email, CRM and automation, schedule and host live sessions, manage document signature and take payments. Our current processors are Zoom (live sessions: when you register on the Website we send Zoom your first and last name and email so it can issue your joining link; registration and scheduling), Smartlead (outbound email), Mailchimp (opt-in newsletters and email), Twenty CRM (contact records), n8n (workflow automation), PandaDoc (NDAs and agreements) and Stripe (invoice payments; Stripe acts as an independent controller for the personal data it uses to prevent fraud and meet its own legal obligations, and as our processor for the rest of the payment processing). The Website itself, the forms you submit and their automated review run on infrastructure EnQuanta operates in the United States.

Advertising and analytics partners: Google, as described in Section 4, under its own privacy notice, and LinkedIn or Meta only if we add their tags with your consent.

Affiliates: our professional advisors and related business entities, including corporate affiliates and channel partners and their professional advisers, under confidentiality obligations. We will tell you if your personal data becomes subject to a different privacy policy as a result of any change in control of EnQuanta.

Resellers and partners: if you ask about a product sold or supported through one of our authorized resellers or channel partners, we may pass your inquiry to that partner so it can follow up, and we will tell you when we do.

Legal and regulatory authorities: to comply with applicable laws and legal processes, and to protect the rights, property, or safety of EnQuanta, our customers, or others.

Inquiries, Website form submissions, partner applications and correspondence: 24 months after our last contact with you.

CRM records of business contacts: 24 months after your last interaction with us, unless you or your employer become a customer.

Marketing suppression (opt-out) list: indefinitely, so that we can continue to honor your opt-out.

Event registration and attendance records: 24 months after the event.

Google Analytics 4 data: 14 months, the retention period set in the Google Analytics property.

First-party page counts: daily totals only, 400 days.

Signed NDAs and their audit trails: 24 months after the term of the agreement.

Records of your cookie choices: 24 months, after which we ask again.

Invoice and payment records: the period tax and accounting law requires.

Technical server logs: a short period, for security and troubleshooting.

Access: request access to your personal data and a copy of it.

Correction: update or correct inaccuracies.

Deletion: request erasure of data in the circumstances set out in Article 17, for example where it is no longer needed, where you withdraw consent, or where you object to direct marketing.

Restriction: ask us to limit how we use your data while a concern is resolved.

Objection: object to processing based on our legitimate interests. You have an absolute right to object to direct marketing at any time, which we will always honor.

Portability: receive the data you gave us in a structured, machine-readable format.

Withdraw consent: at any time, where we rely on consent, without affecting processing that has already taken place.

Complaints: to the UK Information Commissioner's Office (ico.org.uk; 0303 123 1113) or to the supervisory authority in the EEA country where you live or work. We would appreciate the chance to address your concern first.

Know: request disclosure of the categories of personal data collected and its uses, the sources, the categories of third parties we disclose it to, and the specific pieces of personal information we hold about you, up to twice in a 12-month period.

Delete: request deletion of personal data, subject to legal exceptions.

Correct: request correction of inaccurate personal information.

Opt-out: direct us not to sell or share your personal information for cross-context behavioral advertising (see Section 4).

Limit: we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit.

Non-discrimination: we will not treat you differently for exercising these rights.

Authorized agents: you may use an authorized agent to make a request; we may ask for proof of authorization.

Encryption of personal data in transit and at rest.

Role-based access control for employees.

Regular security audits and monitoring to detect vulnerabilities.