GDPR and data protection at Quotem

Who is responsible for what

When a company uses Quotem to capture its own experts, that company decides how each recording is used and is the controller. Quotem provides the technology and acts as its processor.

When someone holds a Quotem account, Quotem is the controller for their account data, such as their name, email and how they use the app.

How we act as your processor

The data protection section of our terms sets out our commitments as your processor. In short, we:

• use your contributors' data only to provide Quotem, on your instructions;
• keep it confidential and protect it with appropriate security measures;
• use only the sub-processors on our current list, and tell you at least 30 days before adding or replacing one so you can object;
• help you answer people's requests and pass on any we receive within 5 working days;
• tell you about any personal data breach affecting your data without undue delay, and within 48 hours;
• delete it when the agreement ends, and give you the information you need to show all this is done.

Lawful bases

For contributors, the lawful basis is the consent they give before recording, and the legitimate interests of the company that invited them. For account holders, it is performance of the contract, and our legitimate interest in improving the app for counting how it's used. Anyone can object to that by writing to privacy@quotem.ai.

Consent from contributors

Before anyone records, they see who is asking, what it's for and how their words will be used, and they give their consent. They can withdraw at any time through the link they were invited with: we stop using everything from their recording straight away, and only they can start it again.

Anyone can choose to be described rather than named.

People's rights

People have the rights of access, correction, erasure, restriction, objection and portability, and can withdraw consent at any time. Contributors should usually start with the company that invited them, as the controller, and Quotem will help them reach it.

If a contributor asks to be erased, we delete their recordings, video clips, photographs and the written record of what they said, and remove their name and contact details. We keep a record that consent was given, when and to what wording, without their name, because that is what proves nobody published their words without permission.

Where data is processed

Data is stored in the United Kingdom, in London. Off-platform backups are held in the European Union. Some processing, such as AI drafting, transcription and video, happens in the United States, for that job only. Each transfer outside the UK relies on the safeguards the law requires.

See the subprocessors page for the kinds of provider we use and where they work. Customers can ask for the full named list at any time.

How long we keep data

Recordings and the content made from them are kept for as long as the customer's account is active. When a contributor's recording is removed, our backup copies are deleted when their 14-day protection ends, and copies inside database exports within thirty days. Consent and approval records are kept without the person's name, as evidence. Product analytics about account holders are kept for one year.

Questions and complaints

Email privacy@quotem.ai. If you're a contributor, the company that invited you is the right place to start. You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk, without going to either company first.