Data Minimisation as a Default.
This privacy notice details the processing of personal data on qgentic.co. Summary: Our public web infrastructure operates with zero advertising trackers and zero third-party telemetry. Data collection is strictly limited to active, user-initiated communications (e.g., inquiry submissions). Personal data is never monetised or shared externally. The designated Data Controller is Qgentic Ltd (registered in England and Wales).
Effective: 14 July 2026 · Last Revised: 31 July 2026.
Privacy Architecture Baseline.
Zero-Tracker Architecture
We deploy zero analytics frameworks, advertising pixels, or third-party scripts. A strict same-origin Content Security Policy (CSP) actively prevents unauthorised network egress.
Active Collection Only
Data processing is restricted to explicit user inputs (e.g., form submissions, direct emails). The platform does not support user accounts, marketing newsletters, or behavioural profiling.
GDPR Data Subject Rights
Full support for Data Subject Access Requests (DSARs), rectification, and erasure under UK/EU GDPR. Requests are processed directly via technical support channels without friction.
Data Controller Identification.
Qgentic Ltd operates as the Data Controller for personal data processed via this public web infrastructure. We are registered with the UK Information Commissioner's Office (ICO reference: ZC200554). This notice governs only the public-facing domain (qgentic.co) and associated inbound inquiries. Regulatory data processed within Qgentic platform modules (DORA, OpRes, MTD, AI Act) is governed by the Master Services Agreement and Data Processing Addendum (DPA), under which Qgentic acts as a Data Processor; what the software processes is summarised publicly in Product Data Governance and, for the MTD service specifically, How the MTD Service Uses Your Data.
Data Collection & Lawful Processing Basis.
| Data Category | Processing Purpose & Lawful Basis (GDPR) |
|---|---|
| Inbound Inquiries — Identity attributes (name, corporate email, organisation), selected module interest, and submitted payload. | Purpose: Inquiry resolution, technical scoping, and communication logging. Basis: Pre-contractual facilitation (Art. 6(1)(b)) and legitimate operational interests (Art. 6(1)(f)). |
| Infrastructure Logs — IP address, User-Agent string, URI paths, and temporal data (processed by edge hosting provider). | Purpose: Infrastructure delivery, availability monitoring, and DDoS/abuse mitigation. Basis: Legitimate security and operational interests (Art. 6(1)(f)). |
| UI Preferences — Local UI state (light/dark mode toggle). | Purpose: UI state persistence. Implemented exclusively via client-side `localStorage`; data is never transmitted to our infrastructure. |
Qgentic explicitly prohibits the collection of special-category data, behavioural profiling, automated decision-making (ADM), and third-party analytics telemetry.
Zero-Cookie Tracking Policy.
Our public infrastructure deploys zero analytics or marketing cookies, negating the requirement for cookie consent banners. Client-side storage is restricted to a single localStorage key (qgentic-theme) utilised exclusively for UI state persistence (light/dark mode). This state is read locally and never transmitted externally. Our edge infrastructure provider may deploy transient, strictly-necessary cookies exclusively for network load-balancing and security mitigation; these are structurally incapable of cross-site tracking.
Authorised Data Processors.
Edge Infrastructure — Netlify
Public site delivery and edge routing are managed by Netlify, functioning as an authorised sub-processor. They process ephemeral technical logs (IP/User-Agent) for DDoS mitigation and infrastructure delivery.
Inquiry Routing — Qgentic API
Form submissions are routed directly to our internal gateway (api.qgentic.co) for processing by Qgentic personnel. Direct email communications are processed by our designated corporate email provider under standard processor terms.
Data monetisation is strictly prohibited. Information is shared exclusively with authorised sub-processors necessary for infrastructure operation, or when legally compelled by a recognised authority.
Data Residency & Retention Policies.
Cross-Border Transfers
Authorised sub-processors (e.g., our edge network) may route or process data outside the UK/EEA. Such transfers are strictly governed by approved legal mechanisms, including adequacy decisions or execution of UK IDTAs/EU Standard Contractual Clauses (SCCs).
Retention Boundaries
Inquiries are retained for the duration of the commercial relationship and a defined subsequent archival period, subject to early deletion upon request. Edge infrastructure logs are subject to aggressive TTLs (Time-To-Live) and are purged after short-term security analysis.
Exercising Regulatory Rights.
Pursuant to UK and EU GDPR frameworks, you maintain comprehensive rights over your personal data: rights of access, rectification, erasure (Right to be Forgotten), restriction of processing, objection, and data portability. Consent-based processing may be revoked instantly. DSR requests initiated via our contact infrastructure are processed strictly within statutory SLA mandates.
While we request the opportunity to remediate any concerns directly, you retain the unencumbered right to lodge complaints with the relevant supervisory authority: the UK Information Commissioner's Office (ico.org.uk) or the applicable EEA Data Protection Authority.
Public Domain Protection Controls.
Public infrastructure mandates TLS 1.2+ (HTTPS) with HSTS enforcement. The domain utilises a strict Content Security Policy (CSP) mitigating XSS, preventing framing (Clickjacking), and explicitly blocking unauthorised third-party script execution. For details on how our core platform safeguards regulatory workloads (e.g., cryptographic audit logs, read-only ERP connectors, air-gapped deployments), refer to the Security Architecture documentation.
Regulatory Platform Data Boundaries.
Execution of Qgentic platform modules (DORA, OpRes, MTD, AI Act) involves data processed under a discrete Master Services Agreement (MSA) and Data Processing Addendum (DPA), establishing Qgentic strictly as a Data Processor: the customer remains the Data Controller for everything the platform touches. The platform is architected for read-only ERP integration, localised artifact generation, and zero-egress operation via Air-Gapped deployments. The commercial terms live in the MSA/DPA; the summary below discloses publicly what the software actually processes. Review our Integration Architecture or request our standard DPA for full technical details.
How the MTD Service Uses Your Data.
Qgentic MTD prepares and — once a customer's named approver finalises a return — transmits filings to HMRC under the customer's own Government Gateway authority. For this service Qgentic acts as Data Processor on the customer's instructions; the customer is Controller. The MTD pipeline is deterministic: no AI inference is involved in preparing, validating or transmitting a filing, and tax data is never used for any secondary purpose, analytics, or model training.
| Data Category | Purpose & Handling |
|---|---|
| VAT Return Data — the nine-box VAT summary figures and VAT Registration Numbers (VRNs). | Assembled from the customer's ERP records, validated deterministically, and submitted to HMRC only after approval by the customer's named approver. Retained as part of the filing evidence record. |
| Income Tax (ITSA) Data — self-employment and property income/expense figures, National Insurance number (NINO), business and property identifiers. | Processed for quarterly updates and final declarations under Making Tax Digital for Income Tax, on the same approval-gated basis. |
| Identity Data — entity and taxpayer names, and the identity of each named approver. | Approver identity is recorded in the tamper-evident audit trail of every filing: who approved, and when. This is the accountability record the service exists to provide. |
| HMRC OAuth Tokens — the refresh token issued when a customer connects their Government Gateway account. | Encrypted at rest with a dedicated key, excluded from evidence exports, and held only until the customer disconnects or the token expires (approximately 18 months). Deleted on tenant offboarding. |
| Fraud Prevention Header Data — device identifier, local IP addresses, MAC addresses, timezone, operating-system username, device manufacturer and model. | Transmitted to HMRC with every API call, as mandated for all MTD software by HMRC's transaction-monitoring requirements (a statutory obligation on software vendors). Values are honest observations of the submitting installation; where a value cannot be collected it is sent empty. |
Hosting & Residency
Customer tax data for the cloud MTD service is hosted in a UK region. On-premise and air-gapped editions keep all processing on the customer's own infrastructure, with zero data reaching Qgentic.
Retention
Filing evidence (prepared returns, receipts, audit chains) is retained for the customer's statutory record-keeping window — HMRC requires VAT records to be kept for six years — unless the customer directs earlier deletion. HMRC OAuth tokens are held only while a connection is active. All tenant data is erased on offboarding.
Notice Updates & Controller Details.
Material changes to infrastructure data processing will be reflected in revisions to this notice, alongside updated effective dates. For privacy-specific technical or legal inquiries, utilise our contact form for direct routing to our compliance team. Qgentic Ltd is registered in England and Wales (Company No. 17341486) and holds ICO Registration Reference ZC200554.
Data Minimisation Principle. The most secure data is data that is never acquired. We operate this infrastructure in alignment with the strict operational standards expected by the compliance professionals we serve. Direct inquiries to us.