This policy explains how Quantum Intelligence Hub Ltd (“QIH”, “we”, “us”) appoints service providers that process personal data, and how QIH manages international transfers across its websites, infrastructure, AI Digital Reception services and related digital operations.
This policy applies to QIH-controlled services, including qihhub.com and related QIH ecosystem domains, customer portals, hosting and automation environments, educational services, e-commerce operations and AI Digital Reception services. A service-specific agreement, Data Processing Agreement (“DPA”) or order form takes precedence where it provides more specific terms.
QIH may engage providers where reasonably necessary to host and secure systems, deliver communications, process payments, operate customer support and CRM functions, provide analytics, maintain backups, deliver educational or e-commerce services, support compliance, or provide AI and automation capabilities.
Named providers may change. QIH will not represent a provider as active unless it is actually used for the relevant service.
Depending on configuration, AI Digital Reception may involve telephone and communications providers, speech recognition, text-to-speech, language models, hosting, logging and automation services. These providers may process caller numbers, call metadata, audio, recordings, transcripts, summaries, messages, appointment details and instructions supplied by the customer.
Before appointing a material provider, QIH seeks proportionate assurance concerning security, privacy, reliability, location and contractual protections. Where required, QIH enters into written data-processing terms requiring confidentiality, appropriate security, assistance with data rights and incidents, deletion or return of data, and equivalent protection when another sub-processor is used.
Where QIH acts as processor, the customer gives general written authorisation for QIH to use sub-processors needed to provide the service. QIH will provide reasonable notice of a material new or replacement sub-processor where required by the DPA, normally through the service, account notice, policy update or email.
A customer with a genuine data-protection objection should contact QIH within the notice period stated in its DPA. The parties will seek a practical solution. If none is reasonably available, the affected service may be terminated in accordance with the agreement. Urgent replacements may be made without advance notice where necessary to address a security, legal or service-continuity risk, with notice provided as soon as reasonably practicable.
Providers may process data in the United Kingdom, European Economic Area and other countries in which they or their infrastructure operate. QIH does not rely on a user’s mere acknowledgement as the legal safeguard for a restricted transfer.
Where required, QIH uses an applicable adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, EU Standard Contractual Clauses, or another lawful transfer mechanism. QIH may also assess transfer risks and implement supplementary contractual, technical or organisational measures where appropriate.
Measures are selected according to risk and may include encryption in transit, access controls, least-privilege permissions, multi-factor authentication, logging, monitoring, backups, incident procedures, separation of customer environments and contractual confidentiality. No internet service can guarantee absolute security, but this does not reduce any security duty that applicable law or a written agreement places on QIH.
Material providers are expected to notify QIH of qualifying personal-data incidents without undue delay. Where QIH acts as processor, QIH will notify the affected controller without undue delay after becoming aware of a personal-data breach and will provide available information reasonably needed for the controller’s assessment and regulatory duties. The controller remains responsible for determining whether notification to a regulator or affected individuals is required.
QIH instructs providers to retain personal data only for the service, security, backup, dispute, financial or legal period applicable to their function. At the end of processing, data is returned or deleted in accordance with the agreement, subject to backup cycles and lawful retention requirements. Any retained data remains protected and is not used for unrelated purposes.
Where QIH acts as processor, it will provide reasonable assistance to the controller with access, correction, deletion, restriction, objection and portability requests, taking account of the nature of processing and available information. Requests concerning a customer-controlled AI Digital Reception deployment should normally be directed first to that business customer.
QIH maintains proportionate records of material processing and provider relationships. Subject to confidentiality, security and reasonable scope limits, QIH will make available information reasonably necessary to demonstrate compliance with its processor obligations and will support audits where required by an applicable DPA or law.
Each party is responsible for its own acts, omissions, instructions and legal obligations, and for breaches caused by matters within its control. QIH does not exclude responsibility merely because a sub-processor is involved. Contractual liability limits are governed by the applicable service agreement and do not apply where liability cannot lawfully be limited, including fraud or other mandatory statutory liability.
Quantum Intelligence Hub Ltd
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Privacy: privacy@qihhub.com
Security: security@qihhub.com
Legal: legal@qihhub.com
QIH may update this policy when providers, services, processing locations or legal requirements change. Material changes will be communicated as described above. Mandatory rights under applicable law are not displaced by this policy.