Privacy Policy (GDPR) | Quantum Stakes Oy

1. Who is responsible for your data

The data controller is Quantum Stakes Oy, a private limited company registered in Finland with Business ID 3195161-8 and EU VAT number FI31951618, at Henry Fordin katu 5 C, 00150 Helsinki, Finland.

For any question about this policy or about your personal data, write to privacy@quantumstakes.net or to the postal address above. No statutory Data Protection Officer is required under GDPR Art. 37; privacy enquiries are handled by the management team at the address above.

2. What we collect, and why

2.1 Advisory enquiry form

The form has six inputs you fill in, and this is all of them. When you submit it we collect:

Company or group name - required. The legal entity you are enquiring for.
Your name - required. So we know who to address the reply to.
Your business email address - required. Used only to reply to this enquiry.
Area of enquiry - required. One of the advisory practices, chosen from a list.
Organisation size - required. A band, chosen from a list.
Your message - required. Whatever you write.

Alongside those, and not typed by you, we store:

A truncated IP prefix, produced as described in section 2.4, so that an abuse investigation is possible at all.
The version of the privacy notice shown beside the form when you submitted it, and the time of submission. This is a transparency record under Art. 13 - evidence of what you were told. It is not a consent record, and we do not treat it as one.

The form also contains one hidden anti-spam decoy input, which is not a question for you and is described in section 2.5. It is never stored. There is no fax-number field and no other hidden field on this form: the list above is complete, and if we ever add an input we will list it here in the same edit.

Purpose: answering your enquiry, arranging a briefing if you want one, and preparing a written scope if the conversation goes further.
Lawful basis: GDPR Art. 6(1)(b) - steps taken at the request of the data subject prior to entering into a contract. Where you are enquiring on behalf of an organisation rather than yourself, we also rely on our legitimate interest in responding to business correspondence (Art. 6(1)(f)). We do not rely on your consent for this, we do not ask you to give it, and the form does not require you to tick anything in order to send your enquiry.
Recipients: our own advisory and administrative staff on a need-to-know basis, plus the hosting and email processors named in section 4. Nobody else.
Retention: 24 months from our last contact with you, unless a signed engagement or a statutory obligation requires longer, after which it is deleted.

2.2 General contact form

The form has five inputs you fill in, and this is all of them. When you submit it we collect:

Your name - required.
Your email address - required. Used only to reply.
Your phone number - optional. Give it only if you would rather we called; leaving it blank does not affect anything.
Subject - required. Chosen from a list.
Your message - required.

Alongside those we store a truncated IP prefix (section 2.4) and the version of the privacy notice shown beside the form, with the time of submission, for the same Art. 13 transparency reason as above.

This form also contains the same single hidden anti-spam decoy input described in section 2.5, which is never stored. There is no fax-number field and no other hidden field on this form either.

Purpose: answering your message and routing it internally.
Lawful basis: GDPR Art. 6(1)(f) - legitimate interest in answering business correspondence. We do not ask for your consent for this, and you may object to the processing at any time under Art. 21. We do not rely on your consent for this, and the form does not require you to tick anything in order to send your message.
Recipients: our own staff on a need-to-know basis, plus the hosting and email processors named in section 4. Nobody else.
Retention: 24 months from our last contact, then deleted.

Sending the advisory enquiry or general contact form does not subscribe you to our newsletter or to any other marketing.

The newsletter form has four inputs you fill in, and this is all of them. When you submit it we collect:

First name - required.
Last name - required.
Email address - required. Used only to send the newsletter you asked for.
Marketing consent - required. You must tick the box before the form will submit.

Alongside those we store:

A truncated IP prefix (section 2.4).
The version of the privacy notice and the version of the consent wording shown beside the form, with the time of registration.

The form also contains the same single hidden anti-spam decoy input described in section 2.5, which is never stored.

Purpose: Sending occasional B2B email updates about company news and published advisory insights to people who have asked to receive them.
Lawful basis: GDPR Art. 6(1)(a) - consent. You must tick the consent box before we send you anything. You can withdraw consent at any time.
Recipients: our own administrative staff on a need-to-know basis, plus the hosting and email processors named in section 4. Nobody else.
Retention: 24 months from registration, or until you unsubscribe, whichever is sooner.
Unsubscribe: write to privacy@quantumstakes.net at any time, or use the unsubscribe link in any newsletter email once we send one.

2.4 Server logs

Our web server records the requested URL, the HTTP status, the time, the user agent and a truncated IP address (the final octet of an IPv4 address, or the final 80 bits of an IPv6 address, are discarded before the entry is written). These logs exist to keep the service available and to investigate abuse and errors.

Lawful basis: legitimate interest in the security and availability of our own service (Art. 6(1)(f)).
Retention: 30 days, then deleted automatically.

2.5 Abuse prevention, and the hidden decoy field

To stop automated submission floods we count recent submissions per truncated IP address for a short period. We do not use a third-party CAPTCHA service, because that would place a third-party script and cookies on a site whose Cookie Policy says there are none.

Instead, each form carries one decoy input. We disclose it here rather than leave it for you to find in the page source. Both forms contain one hidden decoy field, kept off-screen and out of the tab order, that a person never sees or fills in. If it arrives with anything in it the submission is discarded unread and nothing is stored. It is not personal data and it is never written to our database. It exists so that we do not have to load a third-party CAPTCHA, which would place a tracker on a site whose Cookie Policy says there is none.

Earlier versions of these forms used a decoy labelled “Fax number”. An invisible input that looks like a real personal-data field is misleading even when nothing is stored, so it was renamed to say plainly what it is, and it is now listed here.
Lawful basis: legitimate interest in keeping our own forms usable and free of automated abuse (Art. 6(1)(f)).
Retention: none - a submission that trips the decoy is discarded rather than written, and the rate-limit counters expire within minutes.

2.6 Cookies and similar technologies

We set one item of browser storage, and only after you have made a choice: your consent decision. There are currently no analytics or advertising cookies on this site at all. If that changes, the Cookie Policy is updated first and your consent is asked for before anything is set. You can review or change your choice at any time using .

3. What we do not do

We do not sell personal data, and we never have.
We do not share personal data with advertising networks or data brokers.
We do not build behavioural profiles, and we do not carry out automated decision-making or profiling with legal or similarly significant effects (Art. 22).
We do not add you to the newsletter because you used the advisory enquiry or general contact form alone.
We do not ask you to consent to us handling an enquiry or contact message, and those forms will not refuse a submission because you declined something. Consent is the lawful basis for your newsletter registration (section 2.3) and for your cookie choice (section 2.6).
We do not ask for, and do not want, special-category data (Art. 9) in a form submission.

4. Who else sees your data

Personal data submitted through this site is accessible to our own advisory and administrative staff on a need-to-know basis, and is processed on our behalf by:

Our hosting provider, which operates the servers this site and its database run on, under a data processing agreement pursuant to Art. 28.
Our email provider, which delivers enquiry notifications to us and our replies to you, under the same kind of agreement.

We will also disclose data where we are legally obliged to - for example to a competent authority acting within its powers - and, if we are ever party to a corporate transaction, to the counterparty under confidentiality. We will not do so for any other reason without telling you.

5. International transfers

We host and process personal data inside the European Union / European Economic Area. We do not transfer personal data to a third country. If that ever changes, we will update this policy before the transfer happens and will rely on an adequacy decision or on Standard Contractual Clauses with supplementary measures, as Chapter V of the GDPR requires.

6. Security

The site is served over HTTPS only. Form submissions are validated and escaped on the server, database access uses least-privilege credentials, and administrative access requires individual accounts. We keep the number of people who can read enquiry data to those who need it. No system is perfect; if a breach ever affects your data and is likely to result in a high risk to your rights, we will tell you directly as well as notifying the supervisory authority within 72 hours (Arts. 33-34).

7. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you, and receive a copy (Art. 15).
Rectify anything inaccurate or incomplete (Art. 16).
Erase your data where the grounds in Art. 17 apply.
Restrict processing while a dispute about accuracy or legitimacy is resolved (Art. 18).
Portability - receive the data you gave us in a structured, machine-readable format (Art. 20).
Object to processing based on legitimate interest (Art. 21).
Withdraw consent at any time, without affecting processing carried out before you withdrew it (Art. 7(3)) - which on this site means your newsletter registration and your cookie choice. Enquiry and contact form submissions are not consent-based; the right that applies to them is the right to object above.

Write to privacy@quantumstakes.net. We answer within one month and will tell you if we need the extension Art. 12(3) allows. Exercising any of these rights is free of charge. We may ask you to confirm your identity, but only enough to be sure we are not disclosing your data to somebody else.

8. Complaints

If you think we have handled your data wrongly, please tell us first - it is usually the fastest fix. You also have the right to complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Ratapihantie 9, 00520 Helsinki, Finland. If you live or work in another EU/EEA country, you may complain to your own national authority instead.

9. Children

This is a business-to-business site. Its services are not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, write to privacy@quantumstakes.net and we will delete it.

10. Changes to this policy

We will update this policy when what we do changes - not to reflect what we would like to do later. Each version carries a version number and a date at the top of this page. Where a change materially affects how we process data you have already given us, we will contact you directly rather than rely on you rereading this page.

11. How to reach us

Quantum Stakes Oy
Henry Fordin katu 5 C
00150 Helsinki
Finland
Business ID 3195161-8 · VAT FI31951618
privacy@quantumstakes.net

Privacy Policy