Privacy notice.

Who we are

QMC4 Group Limited, Ohana, Hougues Magues Lane, St Sampson, Guernsey GY2 4WA, is the controller of personal data collected through qmc4.com.

For any privacy question or request, email security@qmc4.com.

What we collect

When you book a call or contact us

The booking form asks for your name and work email, and optionally your organisation, a preferred date and time, and a message. When you send it, the details are emailed to our team. The website itself doesn’t store them.

When you request a Guardian Snapshot

The Snapshot form asks for your name, work email, organisation and the domain you’d like us to check, and optionally a phone number, the reference code from our email and how you’d like to meet. It also records your authorisation for the checks and whether you’d like occasional security tips by email. As with the booking form, the details are emailed to our team and the website itself doesn’t store them.

To produce the Snapshot we run passive checks on the domain you name: public DNS and certificate records, your website’s public configuration, and breach exposure data. We report how many work email addresses appear in known breaches and which ones; we never collect, store or show exposed passwords. We don’t scan or access your systems.

If we emailed or called you about Guardian

We found your name and work email address on a public source: a company register, your company’s website or your professional networking profile. Each email says which. We use them, with your company name, job title and work phone number, to tell you about our services. We send at most three emails, and make at most two calls after each. If you reply “no thanks” or email security@qmc4.com, we stop the same day and keep only what we need to make sure we don’t contact you again. Otherwise we delete your details 12 months after our last contact.

When you visit the website

Our hosting provider’s servers record technical information needed to deliver and protect the site, such as your IP address, browser type and the pages requested. The site also measures page-load performance. We don’t use cookies or advertising trackers, and our fonts are served from our own domain.

When you email us

We receive whatever you choose to include in your email.

Why we use it

We use your details to reply to your enquiry, arrange the call you asked for and, if you choose, discuss our services with you. We rely on our legitimate interest in responding to enquiries and in telling businesses about our services, and on taking steps you have asked for before entering into a contract. We run Snapshot checks only with your authorisation, and send security tips by email only if you ask for them. We don’t sell your details or use them for advertising.

Who processes it for us

• Netlify, Inc. hosts this website. When you send the booking or Snapshot form, your details pass through Netlify’s servers in the United States for the moment needed to send the email, and are not stored there. Netlify protects this under its data processing agreement, using standard contractual clauses and the EU–US Data Privacy Framework.
• Resend sends the booking email to us. Resend keeps a copy of sent emails and their delivery logs for 30 days, stored in the United States, and then deletes them. It protects these transfers with the EU standard contractual clauses and the EU–US Data Privacy Framework.
• Microsoft 365 hosts our mailbox, where booking and Snapshot requests and your emails are received.
• Our breach-monitoring provider checks the domain you name for a Snapshot against known breach data, through the Guardian security portal. It processes this data for us under a data processing agreement, and the data is hosted in the European Union.

Apart from the form handling described above, we hold personal data in locations that comply with the GDPR.

How long we keep it

We keep enquiry details only for as long as we need them to deal with your enquiry and any relationship that follows, and then delete them. Snapshot working data is deleted after 90 days if you don’t become a client.

Your rights

Under the Data Protection (Bailiwick of Guernsey) Law, 2017 you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data, or restrict how we use it;
• stop using it where we rely on legitimate interests;
• provide your data in a portable format.

To make a request, email security@qmc4.com. If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Authority in Guernsey at odpa.gg.

Changes

We will update this notice if the way we handle personal data changes. The date at the top shows when it was last updated.