PRIVACY POLICY
Originally adopted: 1 October 2018
Effective date of this version: 21 July 2026
1. Introduction
This Privacy Policy explains how Qubit Labs OÜ (“Qubit Labs”, “we”, “our” or “us”) collects, uses, stores and otherwise processes Personal Data obtained through our website and in the course of our communications with prospective and existing clients, business partners and other individuals interacting with us.
It also explains your rights under applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
For the purposes of this Privacy Policy, “Personal Data” means any information relating to an identified or identifiable natural person.
Qubit Labs acts as the data controller in respect of the processing described in this Privacy Policy.
By using our website or otherwise providing your Personal Data to Qubit Labs, you acknowledge that your Personal Data may be processed in accordance with this Privacy Policy.
2. Personal Data We Process
The type of Personal Data we process depends on how you interact with Qubit Labs and the information you choose to provide.
2.1 Website Usage Information
When you visit our website, certain technical information may be collected automatically. This may include your IP address, browser type, device information, operating system, referring website, pages visited, the date and time of access and other information relating to your use of the website.
Information relating to cookies and similar technologies is described separately in our Cookie Policy.
2.2 Information You Provide
If you contact us, submit an enquiry, request information, download materials, subscribe to our communications or otherwise interact with Qubit Labs, we may process the information you choose to provide. This may include your name, company name, business email address, telephone number, job title and the contents of your communications with us.
3. How We Obtain Personal Data
We collect Personal Data directly from you when you use our website, complete a contact form, communicate with us by email, telephone or other means, request information or otherwise interact with Qubit Labs.
In limited circumstances, we may also receive business contact information from publicly available professional sources, from the organisation you represent or from service providers supporting our website and business communications.
Where Personal Data is obtained from a source other than you, we limit the information collected to what is reasonably relevant to our legitimate business activities.
4. Why We Process Personal Data
We process Personal Data only where we have a lawful basis for doing so.
4.1. Website Operation
We process technical and usage information to operate, maintain and secure our website, identify technical issues, prevent misuse and understand how visitors interact with the website.
This processing is based on our legitimate interests in maintaining a functional, secure and effective online presence.
Where consent is required for the use of particular cookies or similar technologies, such processing will be based on consent and governed by our Cookie Policy.
4.2. Responding to Enquiries
We use contact and communication information to respond to enquiries, provide requested information, arrange meetings and maintain records of communications.
Depending on the circumstances, this processing is based on our legitimate interests in communicating with persons interested in our services, steps taken at your request before entering into a contract or performance of an existing contract.
4.3. Client Relationship Management
We process Personal Data relating to prospective and existing clients to understand service requirements, prepare proposals, negotiate agreements and provide the requested services.
During an active relationship, we may use the information to manage projects, maintain commercial and operational records, issue invoices, process payments and communicate regarding service delivery.
This processing is normally necessary to enter into or perform a contract or is based on our legitimate interests in managing client relationships, providing services and protecting our legal and commercial interests.
4.4. Business Communications and Marketing
Where permitted by applicable law, we may use your business contact details to send newsletters, legal updates, event invitations or other information that may be relevant to your professional interests.
You may unsubscribe from marketing communications at any time by following the instructions included in our communications or by contacting us directly. Unsubscribing from marketing communications will not affect our ability to send contractual, administrative or legally required notices.
4.5. Legal, Compliance and Security Purposes
Personal Data may be processed to comply with applicable law, respond to lawful requests, maintain corporate and accounting records, prevent fraud, protect our systems and business, enforce agreements, manage disputes and establish, exercise or defend legal claims.
The applicable legal basis will depend on the circumstances and may include compliance with a legal obligation, our legitimate interests or the establishment, exercise or defence of legal claims.
5. Legitimate Interests
Where we rely on legitimate interests, we consider whether the processing is necessary for a legitimate business purpose and whether that purpose is overridden by your interests, rights or freedoms.
Our legitimate interests may include operating and developing our business, communicating with prospective and existing clients, maintaining business relationships, improving our website and services, keeping accurate records, protecting our systems and legal rights and preventing fraud or misuse.
You may object to processing based on legitimate interests in the circumstances described in Section 12.
6. Sharing Personal Data
We disclose Personal Data only where this is reasonably necessary for the purposes described in this Privacy Policy.
6.1. Service Providers
We engage carefully selected third-party service providers to support our website, IT infrastructure, business communications, customer relationship management, accounting, payment processing and other business operations.
Such providers may process Personal Data only to the extent necessary to provide the relevant services. They are required to comply with appropriate contractual, confidentiality, security and data protection obligations.
6.2. Professional Advisers
Personal Data may be disclosed to lawyers, accountants, auditors, insurers, banks and other professional advisers where this is reasonably necessary for the provision of their services.
6.3. Public Authorities
We may disclose Personal Data to tax authorities, regulatory bodies, courts, law enforcement agencies or other public authorities where required by law or necessary to protect our rights and legitimate interests.
6.4. Corporate Transactions
If Qubit Labs is involved in a merger, acquisition, investment, financing, restructuring, transfer of contracts or sale of all or part of its business or assets, relevant Personal Data may be disclosed to prospective purchasers, investors, advisers or other participants in the transaction.
Any such disclosure will be subject to appropriate confidentiality and data protection safeguards.
6.5. Disclosure at Your Request
We may share Personal Data with another recipient where you have instructed us to do so or have otherwise provided valid consent.
Where third parties process Personal Data on our behalf, they do so under written agreements that require them to implement appropriate technical and organisational measures and process Personal Data only on our documented instructions where required by applicable law.
7. International Transfers
Qubit Labs is established in Estonia and primarily processes Personal Data within the European Economic Area (“EEA”). In the course of providing our services, we may also engage service providers or cooperate with business partners located in other jurisdictions. Where necessary, Personal Data may therefore be accessed, stored or otherwise processed outside the EEA in accordance with applicable data protection laws.
Where Personal Data is transferred outside the European Economic Area to a country that has not been recognised by the European Commission as providing an adequate level of data protection, we use an appropriate transfer mechanism where required.
As a general approach, Qubit Labs seeks to use service providers that process Personal Data within the EEA, the United Kingdom or other jurisdictions recognised by the European Commission as providing an adequate level of data protection. Processing in other jurisdictions takes place only where an appropriate transfer mechanism has been implemented.
This may include the Standard Contractual Clauses approved by the European Commission, another legally recognised contractual mechanism, an applicable statutory derogation or another safeguard permitted under Chapter V of the GDPR.
Where appropriate, Qubit Labs also considers the legal and practical circumstances of international transfers and, where necessary, implements supplementary contractual, technical or organisational safeguards to ensure that Personal Data continues to receive a level of protection consistent with the GDPR.
You may contact us to request additional information concerning the safeguards applicable to a particular transfer.
8. Data Retention
We retain Personal Data only for as long as it is reasonably required for the purposes for which it was collected.
In determining the relevant retention period, we consider the nature and sensitivity of the information, the duration of our relationship with you, the purpose of the processing, contractual requirements, statutory recordkeeping obligations and applicable limitation periods.
Contact and enquiry records may be retained for a reasonable period after the relevant communication to allow us to respond to follow-up questions, maintain an appropriate business record and protect our legal interests.
Client, contractual, billing, tax, accounting and corporate records may be retained for the period required under applicable law.
Information relevant to a complaint, dispute or potential legal claim may be retained until the matter has been resolved and the applicable limitation period has expired.
When Personal Data is no longer required, it will be deleted, anonymised or securely archived, unless further retention is required or permitted by law.
9. Data Security
Qubit Labs implements technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unlawful processing.
The measures applied depend on the nature of the Personal Data, the systems involved and the risks associated with the processing. They may include access restrictions, authentication controls, confidentiality obligations, secure storage and communication solutions, backup and recovery procedures, monitoring, internal policies, personnel awareness measures, vendor controls and incident response procedures.
Although we take reasonable steps to protect Personal Data, no method of electronic transmission or storage can guarantee absolute security.
10. Accuracy of Personal Data
We take reasonable steps to ensure that Personal Data is accurate and, where necessary, kept up to date.
You should ensure that the information you provide to us is accurate and notify us if your contact details, position or other relevant information changes.
You may request correction or completion of inaccurate or incomplete Personal Data at any time.
11. Automated Decision-Making
Qubit Labs does not make decisions that produce legal or similarly significant effects solely through automated processing.
If Qubit Labs introduces automated decision-making that falls within Article 22 of the GDPR, we will provide the affected individuals with the information and safeguards required by law.
12. Your Data Protection Rights
Subject to applicable legal conditions and limitations, you may have the right to:
- request confirmation as to whether Qubit Labs processes your Personal Data and obtain access to that information;
- request correction of inaccurate information or completion of incomplete information;
- request deletion of Personal Data where there is no longer a lawful reason for its processing;
- request restriction of processing in the circumstances provided by law;
- object to processing based on legitimate interests;
- object to direct marketing at any time;
- receive certain Personal Data in a structured, commonly used and machine-readable format;
- request transmission of eligible Personal Data to another controller;
- withdraw consent where processing is based on consent; and
- lodge a complaint with a competent supervisory authority.
The right to deletion is not absolute. We may retain Personal Data where this is required to comply with law, administer a contract, protect the rights of another person or establish, exercise or defend legal claims.
Where you object to processing based on legitimate interests, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds for continuing or the information is required for legal claims.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
13. Exercising Your Rights
Requests concerning Personal Data may be submitted using the contact details provided in Section 17.
Your request should contain sufficient information to allow us to identify you and understand what action you are requesting. We may ask for additional information where reasonably necessary to verify your identity and prevent unauthorised disclosure.
We will respond without undue delay and within the timeframe required by applicable law. Under the GDPR, a response will normally be provided within one month after receipt of a valid request.
The response period may be extended where permitted by law due to the complexity or number of requests. If an extension is required, we will inform you accordingly.
14. Complaints
You have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement.
As Qubit Labs is established in Estonia, you may also contact:
Estonian Data Protection Inspectorate
Andmekaitse Inspektsioon
Tatari 39, 10134 Tallinn, Estonia
We encourage you to contact Qubit Labs before submitting a complaint so that we have an opportunity to review and address your concerns.
15. Third-Party Websites
Our website and communications may contain links to websites, platforms or services operated by third parties.
Qubit Labs does not control and is not responsible for the privacy practices, security or content of third-party services that independently determine how Personal Data is processed.
You should review the applicable privacy notice before providing Personal Data to a third-party service.
16. Changes to This Privacy Policy
We may revise this Privacy Policy to reflect changes in our website, business operations, systems, service providers, processing activities or applicable legal requirements.
The current version will be published on our website and will state its effective date.
Where required by law, we will provide additional notice of material changes or obtain consent before applying them.
17. Contact Details
Qubit Labs OÜ is the controller responsible for the processing described in this Privacy Policy, except where expressly stated otherwise.
Questions, requests or concerns relating to this Privacy Policy or the processing of Personal Data may be submitted to:
Qubit Labs OÜ
Registry code: 14079287
Registered office: Sepapaja tn 6, Lasnamäe district, Tallinn, Harju County, 15551, Estonia
Email: dpo@qubit-labs.com
General business enquiries may be sent to info@qubit-labs.com.
Where your communication concerns the exercise of a data protection right, please include “Data Protection Request” in the subject line.
