This privacy policy describes the information we collect and the way we use it. It was last updated to version 2.7 on 30 September 2024. A PDF-formatted copy of the privacy policy is also available. Other company policies, including the company's general privacy policy, are provided on the Policies page.
Contents
1. Introduction
This privacy policy describes the personal data Quintessa collects via the https://www.quintessa.org/ website, the way we use them and your associated rights.
Quintessa is committed to being open and transparent about our use of data. Any personal data that we collect is handled in accordance with the Data Protection Act 2018. In the United Kingdom, Data Protection is regulated by the Information Commissioner’s Office (ICO). Any questions you may have in relation to this privacy policy should be addressed to Quintessa’s Data Protection Coordinator via or the address below. Unresolved complaints may be forwarded to the ICO.
Quintessa’s registered office is: The Hub, 14 Station Road, Henley-on-Thames, Oxfordshire, RG9 1AY, United Kingdom, and its business registration number is: 03716623.
2. Quintessa’s Guarantees
Quintessa makes the following guarantees with respect to the personal data referred to in this privacy policy.
- The data are used to carry out the activities defined in this privacy policy and for no other purpose.
- Personally identifiable data are stored on servers under Quintessa’s control within the United Kingdom. Delivery of email communications to those who have signed up to them via the Quintessa Updates system are processed by a company with globally distributed servers. Some non-personally identifiable data may be transferred to the Google Analytics service, which is stored on Google’s servers worldwide, as described in Section 3.6.
3. The Personal Data Quintessa Collects
Quintessa collects personal data if you choose to provide us with them for a given purpose, such as signing up to a newsletter or downloading software from our website. Such data can be managed via Quintessa Updates. We also collect technical information associated with your visits, as recorded by the webserver and as provided by your web browser, primarily for webserver management, diagnostics and information security. Full details of personal data collected are provided in the following subsections.
- Section 3.1: Communication Preferences via Quintessa Updates
- Section 3.2: Software Download Processes with a Licence Agreement
- Section 3.3: Software Download Software Download Technical Information
- Section 3.4: Web Server Access Logs
- Section 3.5: Content Security Policy Reports
- Section 3.6: First-party Cookies set by Google Analytics
- Section 3.7: Session Cookies
3.1. Communication Preferences via Quintessa Updates
This concerns communication preferences and associated contact information provided voluntarily when you:
- sign up to Quintessa newsletters via our website; or
- sign up to Quintessa newsletters or software release notifications when downloading software via our website; or
- sign up directly with our Quintessa Updates system; or
- are invited to sign up to our Quintessa Updates system (e.g. via email) after expressing interest in receiving communications to a Quintessa employee.
What data do we collect?
Your contact information (such as name and e-mail address), your communication preferences, any non-personal information provided when you download software (e.g. reasons for downloading the software), and any notes or records of communications between you and Quintessa.
Why do we collect them?
- Contact information is collected to allow you to opt into communications you are interested in.
- We may supplement personal data with non-personal information provided when you download software (e.g. reasons for downloading the software) for statistical purposes or to assist with provision of software support.
- We may supplement personal data with additional notes or records of communications to assist with provision of software support or where we have legitimate business interest or contractual obligation to do so.
With whom do we share them?
We will not share your personal data with third parties, except in the following circumstances.
- We share names and email addresses with a trusted third-party service provider that is contracted to deliver email communications on our behalf.
- We may share your data if required to do so by law.
- In the case of a formal external audit of Quintessa’s systems, if required, your data may be viewed within our company premises and network by the auditor who is required to maintain confidentiality.
For how long are they kept?
Personal data are kept until you unsubscribe or choose to discontinue use of Quintessa Updates. Associated non-personal data are kept for a minimum of 10 years.
Records and statistics associated with emails sent via a third-party delivery service are stored for 45 days before erasure.
What is the legal basis for processing the data?
Consent. See Section 4 for information on your associated rights.
3.2 Software Download Processes with a Licence Agreement
Certain software download processes on our website have a licence agreement component. This concerns the data we collect to process that licence agreement.
What data do we collect?
The information requested varies between software downloads. It includes any data necessary to identify an individual for the purpose of processing the licence agreement, such as their name and address.
Why do we collect them?
To manage the contract through which a visitor may use or purchase the software.
With whom do we share them?
We will not share your personal data with third parties, except in the following circumstances.
- We share names and email addresses with a trusted third-party service provider that is contracted to deliver email communications on our behalf.<\li>
- We may share your data if required to do so by law.
- In the case of a formal external audit of Quintessa’s systems, your data may be viewed within our company premises and network by the auditor who is required to maintain confidentiality.
For how long are they kept?
For a minimum of 10 years from the termination of any such agreement.
What is the legal basis for processing the data?
Contract. See Section 4 for information on your associated rights.
3.3. Software Download Technical Information
This concerns technical data that are collected when a visitor proceeds to activate a software download via our website.
What data do we collect?
Technical information provided by the visitor's browser, including web address of the download, time of the download, browser type and version, operating system, and IP address.
Why do we collect them?
To enable fault diagnosis and technical support associated with software downloads (e.g. to help us support a range of web browsers).
With whom do we share them?
We will not share your personal data with third parties, except in the following circumstances.
- We may share your data if required to do so by law.
- In the case of a formal external audit of Quintessa’s systems, your data may be viewed within our company premises and network by the auditor who is required to maintain confidentiality.
For how long are they kept?
Until you ask us to delete the data.
What is the legal basis for processing the data?
Legitimate Interests. See Section 4 for information on your associated rights.
3.4. Web Server Access Logs
This concerns data that are collected by the web server as it handles requests for web content.
What data do we collect?
Technical information associated with each website request, such as the IP address from which the request was made, the time and page requested, and also including information provided by the visitor's browser, such as the user-agent string (identifying the browser type and version) and the origin of the request.
Why do we collect them?
- To control and manage the web server and its associated traffic, including for fault diagnosis (e.g. to help us support a range of web browsers).
- For information security, including identification of malicious traffic or non-human traffic such as bots.
- To analyse general website usage patterns.
With whom do we share them?
We will not share your personal data with third parties, except in the following circumstances.
- We may share your data if required to do so by law.
- In the case of a formal external audit of Quintessa’s systems, your data may be viewed within our company premises and network by the auditor who is required to maintain confidentiality.
For how long are they kept?
For a minimum of 10 years.
What is the legal basis for processing the data?
Legitimate Interests. See Section 4 for information on your associated rights.
3.5. Content Security Policy Reports
Quintessa utilises standard web technology called Content Security Policy to help ensure that the website content is delivered exactly as it was intended. This concerns data submitted by the user’s browser to Quintessa when it identifies that an attempt has been made to interfere with the intended rendering of the content.
What data do we collect?
Technical information associated with the content security policy infringement, such as the IP address from which the request was made, the time and page requested, and also including information provided by the visitor's browser, such as the user-agent string (identifying the browser type and version) and the origin of the request.
Why do we collect them?
We collect the data as a security measure, which:
- helps us identify and prevent loading of erroneous resources within our own website content; and which
- may also help to identify and prevent viruses, malware and malicious browser extensions on the visitor’s system from interfering with the loading of the website content.
With whom do we share them?
We will not share your personal data with third parties, except in the following circumstances.
- We may share your data if required to do so by law.
- In the case of a formal external audit of Quintessa’s systems, your data may be viewed within our company premises and network by the auditor who is required to maintain confidentiality.
For how long are they kept?
Typically, about one year.
What is the legal basis for processing the data?
Legitimate Interests. See Section 4 for information on your associated rights.
3.6. First-party Cookies set by Google Analytics
Quintessa uses Google Analytics to help analyse web traffic. This concerns the cookies set and the data collected through our use of that service. Please see Google's privacy policy and documentation it provides on how it uses information from sites like our own.
The data collected do not, on their own, personally identify any user, but could theoretically be used to do so using advanced tools provided by Google. Quintessa guarantees that it will not use Google's tools to do this. We only use the service to look at data from all users aggregated over the period of a day or more to assess: trends; the impact of various events such as newsletter distribution; and routes taken by visitors through the website. We do not use the service for advertising and do not permit Google to use data collected for the purposes of ad personalisation.
If you do not wish to allow Google Analytics to collect data as you browse the web, you may opt-out of data collection via Google Analytics. Alternatively, you may configure your browser to block access to scripts originating from the domain www.google-analytics.com or use one of the various browser extensions available.
What data do we collect?
Identifiers associated with the user and their device and certain usage statistics are stored in first party cookies. Data provided by the user's browser (such as browser type, operating system and coarse location) are collected, processed (see below) and associated with the identifier and transferred to the Google Analytics service and associated with Quintessa’s account.
Why do we collect them?
- To analyse usage of our website.
With whom do we share them?
We will not share your data with third parties other than Google LLC (as explained in the introduction to Section 3.6), except in the following circumstances.
- We may share the data if required to do so by law.
- In the case of a formal external audit of Quintessa’s systems, the data may be viewed within our company premises and network by the auditor who is required to maintain confidentiality.
For how long are they kept?
Cookie duration is up to two years, or until deleted from the browser by the user. Event data is kept by Google for a period of up to 2 months. From 25 May 2018, until 24 January 2023, data will be kept by Google for a period of up to 50 months. (Prior to that date, the duration was unknown as it was not specified by Google, nor configurable.)
What is the legal basis for processing the data?
Legitimate Interests. See Section 4 for information on your associated rights.
3.7. Session Cookies
This concerns the session cookie that is part of the basic functionality of our website. If blocked or deleted by the user, certain aspects of the website, such as software downloads and newsletter subscription management, may not function.
What do we collect?
A random identifier associated with the user is stored in a first-party session cookie (Q_WWW_SESSION).
Why do we collect them?
- To enable basic functionality associated with certain parts of the website involving a sequence of pages (such as newsletter signup, software download or Quintessa Updates log in).
- As part of our website security mechanisms.
With whom do we share them?
We will not share your personal data with third parties, except in the following circumstances.
- We may share your data if required to do so by law.
- In the case of a formal external audit of Quintessa’s systems, your data may be viewed within our company premises and network by the auditor who is required to maintain confidentiality.
For how long are they kept?
Duration is controlled by the visitor's browser. Such cookies are generally deleted by the browser when it is closed.
What is the legal basis for processing the data?
Legitimate Interests. See Section 4 for information on your associated rights.
4. Your Rights
If you wish to exercise your rights in relation to your personal data, please use the facilities available to do so if appropriate (e.g. by following a link in a newsletter sent by Quintessa to unsubscribe from further such communications) or contact Quintessa’s Data Protection Coordinator. Please note that the following rights are not absolute, and may be challenged or overridden in certain circumstances, such as to satisfy legal requirements.
Quintessa will endeavour to satisfy all reasonable requests within one month. Where that is not possible and so more time is required, you will be notified and be informed as to why. If a request is considered unfounded or excessive, you will be notified. Quintessa may then charge a fee to cover administrative costs if you still wish to proceed.
You have a right to be informed about the collection and use of your personal data. If you wish to be notified about changes to this privacy policy, please manage this preference via the Quintessa Updates system, or else inform Quintessa’s Data Protection Coordinator.
You have a right to access the personal data we hold concerning you, and to have incorrect data rectified. Quintessa will make reasonable attempts to verify the identity of the source of any such requests before providing the relevant data. Whenever possible, responses will be made promptly and within one month.
You may request restriction of processing of your data for a limited period if you have a legitimate reason, such as while a disagreement about rights in relation to your personal data is resolved.
The remaining rights vary depending on the legal basis associated with the processing of the data. Please refer to Section 3 to determine which legal basis applies.
- For Consent, you may withdraw consent to processing of your personal data and may request their erasure. This can be achieved via Quintessa Updates.
- For Contract, you may request that your personal data is erased. However, since the data have been collected for the purpose of fulfilling a contract, this may not be possible or may result in the termination of the contract.
- For Legitimate Interests, you may object to the processing of your data in the specified manner and may request for them to be erased.