1. Controller and contact details
QODIQA RESEARCH AND DEVELOPMENT S.R.L. (the ‘Company’, ‘we’, ‘us’ or ‘our’), established in Bucharest, Romania, is the controller, within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the ‘GDPR’), of the personal data processed through qodiqa.com (the ‘Website’) and in the correspondence and business relationships described in this notice. Data protection enquiries, requests to exercise rights and notices may be addressed to the Company’s data protection contact at privacy@qodiqa.com. The Company has not designated a data protection officer under Article 37 GDPR, as its processing activities do not meet the criteria set out in that Article; this position is reviewed periodically.
2. Scope of this notice
This notice applies to (a) visitors to the Website; (b) individuals who contact the Company or submit a request through the Website, including investor, partner, pilot, collaboration and security enquiries; (c) individuals with whom the Company communicates in a business context; and (d) individuals who interact with the Company in public channels. It does not apply to third-party websites and services referenced on the Website, including GitHub, LinkedIn, X, Medium and YouTube, which are governed by their own notices. The qodiqa software and specification are published openly for independent use and verification. Where the software is operated on a user’s own systems, that user determines which personal data is processed, and the Company does not receive it.
3. Data protection principles
The Company processes personal data in accordance with Article 5 GDPR: lawfully, fairly and transparently; for specified, explicit and legitimate purposes; limited to what is necessary; accurately and kept up to date; for no longer than necessary; and with appropriate security. The Company is responsible for, and able to demonstrate, compliance with these principles.
4. Categories of personal data, purposes, legal bases and retention
| Category and data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Visit dataIP address, date and time, requested pages, browser type, referrer. | Delivery and security of the Website; diagnosis of errors. | Legitimate interests (Art. 6(1)(f) GDPR). | Server logs are retained by the hosting provider for the period it determines, normally short-term. They are not used to build visitor profiles. |
| Enquiries and requestsName, email address, organisation, role, the content of the message and any other information the individual chooses to provide. | Responding to the request; assessing pilots, partnerships and investment discussions; providing requested materials. | Steps taken at the request of the individual prior to entering into a contract (Art. 6(1)(b)); legitimate interests in conducting business discussions (Art. 6(1)(f)); consent where requested (Art. 6(1)(a)). | For the duration of the discussion and up to 24 months thereafter, and longer only where a contract or a legal obligation requires. |
| Contact form abuse-prevention dataA salted hash of the sender’s IP address and a signed time value. | Preventing abuse and spam of the contact form; security of the Website. | Legitimate interests (Art. 6(1)(f)). | Up to 24 hours, then deleted automatically. |
| Business contactsName, professional role, organisation, business email address and publicly available professional information. | Identifying and approaching organisations and individuals relevant to the Company’s work, where applicable law permits; keeping a record of those communications. | Legitimate interests (Art. 6(1)(f)). | Until the relationship ends or the individual objects, and in any case no longer than 24 months after the last contact. |
| Business recordsContract, invoicing and accounting data, where a business relationship is established. | Performance of the contract; compliance with legal obligations. | Art. 6(1)(b) and Art. 6(1)(c). | For the periods required by applicable law. |
| Security reportsContact details and the content of a vulnerability report. | Investigation and remediation of vulnerabilities. | Legitimate interests (Art. 6(1)(f)). | Until the matter is resolved and for up to 24 months thereafter. |
| Public repository activityGitHub username and the comments, issues and pull requests published by the individual. | Collaboration on the open projects and handling of contributions. | Legitimate interests (Art. 6(1)(f)). | For as long as the content remains public on GitHub, which controls its own retention. |
The Company does not seek special categories of personal data within the meaning of Article 9 GDPR. Such data should not be submitted through the Website or in correspondence.
5. Sources of personal data
Personal data is obtained (a) directly from the individual, through forms, correspondence, calls and meetings; (b) automatically from the device used to access the Website; (c) from publicly available professional information, such as company websites, public professional profiles and public repository activity; and (d) from third parties who introduce the individual, such as the individual’s organisation or professional network. The Company does not purchase personal data lists.
6. Use of personal data
The Company uses personal data to operate and secure the Website; to respond to enquiries; to prepare and conduct discussions on pilots, partnerships, funding and collaboration; to provide requested materials; to investigate security reports; to maintain the records required by law; and to establish, exercise or defend legal claims. The Company may contact organisations and individuals about its work where applicable law permits, in compliance with Directive 2002/58/EC and Law no. 506/2004; each communication identifies the Company and provides a simple means of opting out, and the Company ceases communications upon request. Materials exchanged in investor and partner discussions may contain non-public information, which the Company treats as confidential. The contact form on the Website transmits the data entered in it (name, email address, organisation, topic, subject and message) to the Company’s server, which forwards it by email to the mailbox that corresponds to the selected topic; the message is not stored on the Website’s server beyond that transmission. To prevent abuse, the server keeps for up to 24 hours a salted hash of the sender’s IP address, not the address itself, together with a signed time value; the email does not contain the IP address. The email providers involved process the message as processors. The multi-step request forms on the investors and partners pages work the same way: the answers entered (name, role, email address, country, organisation and the answers to the questions) are sent to the Company’s server, which forwards them by email to the investors or partnerships mailbox and sends no automatic reply; files selected in those forms are not uploaded, only their names are included in the email, and the visitor is asked for the files in the reply. Personal data is not used for advertising purposes.
7. The simulation
The interactive simulation (‘Run a simulation’) runs in the user’s browser with test keys. Interactions with it are processed on the user’s device and are not transmitted to the Company.
8. Cookies and similar technologies
The Website does not set cookies and does not use analytics, advertising or tracking technologies. The simulation stores four entries in the browser’s session storage (qodiqa.console.intro, cx2.voice, cx2.cc and cx2.vol) to remember whether the introduction has been shown and the sound, caption and volume preferences chosen during the visit; this data remains on the user’s device, is removed when the browser tab is closed and is not transmitted to the Company. The Website serves its fonts, scripts and images from its own domain and does not load resources from third-party servers.
9. Recipients of personal data
Personal data may be disclosed to the following categories of recipients: (a) service providers that support the operation of the Website and of the Company’s business, namely website hosting and domain name services (the Website is hosted by a web hosting provider, GoDaddy, under a data processing agreement with the provider), email hosting, and other email and productivity services; (b) professional advisers, including legal, accounting and audit advisers; (c) public authorities, where disclosure is required by law; and (d) in connection with an investment, financing, merger, acquisition or sale of the business, the counterparties and their advisers, under confidentiality and limited to what is necessary. Service providers act as processors on the Company’s instructions or as independent controllers under their own terms. The Company does not sell personal data.
10. International transfers
Certain service providers are established in, or may access personal data from, the United States or other countries outside the European Economic Area. Any such transfer is made in accordance with Chapter V GDPR, relying on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or on the Standard Contractual Clauses adopted by the Commission, supplemented where necessary by additional safeguards. Information on the relevant safeguards may be requested at privacy@qodiqa.com.
11. Retention
Personal data is retained only for as long as necessary for the purposes set out in section 4 and as required by law. The periods stated in the table are the maximum periods normally applied; on their expiry personal data is deleted or anonymised, unless a legal obligation or the establishment, exercise or defence of legal claims requires longer retention.
12. Security and breach notification
The Company applies technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR, including encrypted transport (TLS), access controls based on the principle of least privilege, separation of environments and data minimisation. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, the Company notifies the competent supervisory authority without undue delay and, where required, the affected individuals, in accordance with Articles 33 and 34 GDPR.
13. Automated decision-making and profiling
The Company does not take decisions based solely on automated processing, including profiling, that produce legal effects concerning individuals or similarly significantly affect them (Article 22 GDPR). The qodiqa software makes enforcement decisions within the systems of those who operate it; such decisions are made in those deployments and not by the Company.
14. Rights of individuals
Under the GDPR, individuals have the right of access to their personal data (Article 15); to rectification of inaccurate data (Article 16); to erasure (Article 17); to restriction of processing (Article 18); to data portability (Article 20); and to object to processing based on legitimate interests (Article 21). An individual may object at any time to the use of personal data for direct marketing, upon which the Company ceases such use. Where processing is based on consent, the individual may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal (Article 7(3)).
15. Exercising rights
Requests may be submitted to privacy@qodiqa.com. The Company responds within one month of receipt; this period may be extended by up to two further months where necessary, taking into account the complexity and number of requests, and the individual is informed of any extension and its reasons. The Company may request additional information to confirm identity. Requests are handled free of charge, unless they are manifestly unfounded or excessive, in which case the Company may charge a reasonable fee or refuse to act, as permitted by Article 12(5) GDPR.
16. Complaints
Individuals have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement. The competent authority in Romania is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro. The Company encourages individuals to contact it first so that a concern can be resolved directly; this does not affect the right to lodge a complaint at any time.
17. Public repositories and contributions
Contributions to the Company’s public repositories, including the GitHub username, the name and email address recorded in commits, and comments, form part of a public history that GitHub and others replicate and that generally cannot be erased. Contributors who prefer not to disclose a personal email address may use a no-reply address for commits. GitHub’s own notice applies to the data that GitHub collects.
18. Children
The Website is not directed at children, and the Company does not knowingly collect personal data from individuals under the age of 16. A parent or guardian who believes that a child has provided personal data may contact the Company, which will delete it.
19. Third-party websites
The Website contains links to third-party websites. The Company is not responsible for their content or privacy practices, and individuals are encouraged to read the applicable notices.
20. Changes to this notice
The Company may update this notice from time to time. The version and effective date shown at the top identify the current version. Material changes are announced on this page and, where required by law, communicated to the individuals concerned.
21. Governing law
This notice is governed by Romanian law and by the data protection law of the European Union, without prejudice to any mandatory rights that individuals have under the law of the country in which they reside.
22. Contact
Version 1.0, effective 5 November 2026.