Privacy Policy

1. Introduction

This Privacy Policy describes how QUANTANA PRIVATE LIMITED and its global operating entities and affiliates (collectively “Quantana”, “we”, “our”, or “us”) collect, process, store, disclose and safeguard your personal data when you visit our website at https://quantana.com.au/ and its related sub-domains, web portals or digital applications (collectively, the “Platform”).

As an ISO/IEC 27001:2022 certified enterprise, Quantana is dedicated to maintaining high standards of data governance, security and privacy. We process personal data in compliance with applicable data protection laws, including:

• India’s Digital Personal Data Protection (DPDP) Act, 2023
• The European Union General Data Protection Regulation (GDPR)
• Australia’s Privacy Act 1988 and the Australian Privacy Principles (APPs)
• Other applicable statutory privacy regulations

Under the DPDP Act 2023, Quantana acts as a Data Fiduciary when collecting personal data directly through our Platform from visitors, prospective clients and job applicants, and as a Data Processor when delivering managed technology and AI services under contract with our enterprise clients.

By accessing or browsing our Platform, providing personal details, or engaging our services, you acknowledge the terms of this Privacy Policy. If you do not agree with the practices described here, please refrain from using or accessing our Platform.

2. Personal data we collect

We only collect personal data that is adequate, relevant and limited to the necessary purposes of engagement.

A. Information you voluntarily provide

• Professional and contact details: full name, business email address, phone number, company name, office address and job title provided when completing enquiry or AI audit forms, requesting service demonstrations, registering for corporate events, or communicating with us.
• Job applications: details you share when applying through our Careers page, such as your name, email address, message and any links to your CV, LinkedIn profile or portfolio.
• Service and commercial communications: enquiries, feedback, project requirements, proposals and related correspondence exchanged during business interactions.

B. Information collected automatically

• Technical and device information: IP address, operating system, browser type and version, language preferences, device identifiers and network information.
• Usage and analytical metrics: pages viewed, navigation flows, time spent on pages, referring website URLs, date and time stamps, and interaction patterns.

C. Sensitive personal data notice

We do not collect sensitive financial credentials (such as card PINs, CVVs, net-banking passwords or UPI PINs) or biometric credentials through our public website. Quantana representatives will never contact you requesting banking passwords or card security codes. If you receive any unsolicited communication claiming to represent Quantana and requesting financial credentials, do not respond and report it immediately to our Grievance Officer.

3. Lawful grounds and purposes of processing

• Service delivery and relationship management: administering business relationships, fulfilling enterprise proposals, executing contracts, and delivering AI and software engineering services.
• Customer support and communication: responding to questions, support requests, consultation enquiries and administrative notifications.
• Recruitment: assessing job applications and contacting candidates about suitable roles.
• Platform security and fraud prevention: maintaining system stability, detecting unauthorised access, preventing security incidents and monitoring cyber threats in accordance with our ISO 27001 controls.
• Statutory compliance: fulfilling legal obligations, cooperating with law enforcement agencies, and complying with court orders or valid subpoenas.
• Business development (opt-out enabled): informing you about our solutions, industry insights and corporate updates. Every marketing communication provides a straightforward way to unsubscribe at any time.

4. Consent and consent withdrawal

• Notice and consent: personal data collected via our website is gathered based on your free, informed, specific and unambiguous consent, provided at the point of submission.
• Right to withdraw consent: you may withdraw your consent at any time by writing to our Grievance Officer with the subject line “Withdrawal of consent for processing personal data”.
• Impact of withdrawal: on verified receipt of your request, Quantana will cease processing your personal data within statutory timeframes, unless continued processing or retention is required by law. Withdrawing consent may limit our ability to provide specific services or respond to ongoing enquiries.

5. Sharing and disclosure

Quantana does not sell, trade or monetise your personal data. We disclose personal information only on a need-to-know basis:

• Intra-group entities and international offices: shared across Quantana entities in India, Australia and the USA exclusively for business administration and operational delivery.
• Authorised service providers and sub-processors: vetted third-party vendors and cloud infrastructure partners (such as Cloudflare, AWS and secure communication systems) bound by written Data Processing Agreements and confidentiality obligations.
• Legal and regulatory compliance: where strictly required by law, regulation, judicial decree or governmental inquiry, or when reasonably necessary to protect the legal rights, safety or assets of Quantana, our clients or the public.

6. International data transfers

Personal data processed by Quantana is hosted on secure cloud infrastructure in India and approved international hosting regions (including Australia and the United States). All cross-border transfers adhere to the transfer restrictions under the DPDP Act 2023, standard contractual safeguards and recognised adequacy arrangements.

7. Security

Quantana maintains an Information Security Management System (ISMS) certified to ISO/IEC 27001:2022 to protect data against unauthorised disclosure, loss, alteration or unlawful access:

• Cryptographic standards: information in transit is encrypted using TLS 1.2/1.3; data at rest is encrypted using industry-standard AES-256.
• Network and perimeter defences: network isolation, web application firewalls, automated vulnerability management and continuous security monitoring.
• Access governance: role-based access control, the principle of least privilege, and mandatory multi-factor authentication across all administration points.
• Workstation controls: centralised endpoint security and enforced full-disk encryption on corporate workstations.

While Quantana implements comprehensive security controls, transmitting information across the open internet involves inherent risks.

8. Data retention and deletion

Quantana retains personal data only for as long as necessary to accomplish the purposes outlined in this policy, or as required by statutory, regulatory and contractual retention periods. Data that exceeds its retention schedule is securely purged or cryptographically deleted under our Information Deletion and Disposal Policies. Where appropriate, records may be permanently anonymised for analytical purposes.

9. Your rights

In accordance with the DPDP Act 2023, the GDPR, the Australian Privacy Principles and other privacy frameworks, you have the following rights regarding your personal data:

• Access and information: confirmation of whether your data is processed, a summary of that data, and the identities of third parties it has been shared with.
• Correction: correction, completion or updating of inaccurate, outdated or incomplete data.
• Erasure: deletion of your data when it is no longer needed for its original purpose, or following consent withdrawal.
• Restriction, objection and portability: where applicable law provides these rights, to restrict or object to processing, or to receive your data in a portable format.
• Grievance redressal: a prompt and transparent grievance mechanism regarding our processing practices.
• Nomination: to nominate an individual to exercise your rights on your behalf in the event of death or incapacity, as provided under the DPDP Act 2023.

To exercise any of these rights, send a written request to our Grievance Officer using the details below. We respond within the timeframes required by applicable law.

10. Cookies and analytics

Our Platform uses cookies and similar technologies to keep the site secure, remember preferences, and understand how visitors use our pages. You can disable cookies through your browser settings; some features may not work as intended if you do.

11. Children’s privacy

Our Platform and services are intended for enterprise businesses and adult professionals. We do not knowingly collect personal information from individuals under the age of 18. If we learn that personal data of a minor has been received without verifiable parental or guardian consent, we will promptly remove it from our systems.

12. Updates to this policy

We may update this Privacy Policy from time to time to reflect technological, legal or business changes. Changes will be posted on this page with an updated date.

13. Grievance Officer

In compliance with Section 11 of the DPDP Act 2023 and our ISO 27001 operating procedures, Quantana has designated a Data Protection Grievance Officer:

• Grievance Officer: G Srinivas and Associates (Company Secretary)
• Address: Flat No. 202, 2nd Floor, Balaji Kalyan Apartments, J J Hospital Lane, next to Axis Bank, near SR Nagar, Kalyan Nagar, Hyderabad, Telangana 500038, India
• Email: finances@quantana.in
• Hours: Monday to Friday, 09:00–18:00 IST