Privacy Policy

Part I: Global Privacy Policy

1. Introduction
Quantum Heaps Pte. Ltd. (“Quantum Heaps”, “we”, “our”, “us”) provides Software as a Service (SaaS) sales CRM solutions globally. We are committed to protecting privacy and handling personal data responsibly. This policy was last updated in May 2026. We may change the policy at any time, and the same will be updated here. This policy explains how we collect, use, disclose, store, and protect personal data when you use our services and websites.

2. 2. Scope
      This policy applies to all Quantum Heaps websites, applications, and services that link to it, including mobile apps and APIs. By using our services, you agree to this policy.

2. 2. Definitions
      “Personal Data” means information relating to an identified or identifiable natural person. “Processing” means any operation performed on Personal Data. “Controller” and “Processor” have the meanings given in applicable data protection laws (e.g., GDPR, PDPA, CCPA/CPRA).

2. 2. Categories of Personal Data We Collect
      – Account & Profile (e.g., name, business email, job title, company)
      – Authentication & Security (e.g., passwords, MFA tokens, logs)
      – Usage & Device (e.g., IP address, browser type, pages viewed, product interactions)
      – CRM Service Data you upload (e.g., leads, contacts, notes, deals)
      – Billing & Payment (processed via secure gateways)
      – Communications & Support (e.g., tickets, chat transcripts)
      – Marketing Preferences

2. 2. How We Collect Personal Data
      – Directly from you (account creation, forms, support)
      – Automatically via cookies, SDKs, and logs
      – From authorized third parties and integrations you enable
      – From public sources where lawful and relevant to B2B CRM use

2. 2. Purposes of Processing & Legal Bases
      We process Personal Data to: (a) provide, maintain, and secure the services; (b) deliver support; (c) manage billing and accounts; (d) perform analytics and improve services; (e) prevent fraud and enhance security; (f) comply with legal obligations; (g) conduct marketing with consent where required. Legal bases include contractual necessity, consent, legitimate interests (e.g., service improvement and security), and compliance with legal obligations.
   3. Location Information
      We may access and collect the location of sales representatives when they use features that require location verification.
      Purpose of Location Collection: Location information is used to verify and record that a sales representative is physically present within or near the designated meeting area when attending a customer or business meeting. This information may be used to tag or record meeting attendance and to support meeting-related activity tracking within the Quantum Heaps platform.
      How Location Is Collected: With the sales representative’s permission, the Quantum Heaps mobile application may access the device’s location services, including GPS-based location information, while using features that require meeting-location verification.
      How We Use Location Information: We use location information to:
      Verify that a sales representative is present at the designated meeting area;
      Tag or record meeting attendance and meeting-related activities;
      Support sales activity tracking and reporting;
      Maintain the accuracy and integrity of meeting records; and
      Prevent misuse or inaccurate reporting of meeting attendance.

      We do not use location information for purposes unrelated to these meeting and sales activity features, and we do not sell location information to third parties.

      Location access is subject to the permissions granted by the sales representative through their device. Disabling location permission may prevent features that require meeting-location verification from functioning properly.

      Location information is retained only for as long as reasonably necessary to provide these features, maintain meeting records, comply with applicable legal requirements, and fulfill legitimate business purposes.

2. 2. Data Minimization & Retention
      We collect only what is necessary and retain it no longer than required: (a) for active accounts retained while services are provided; (b) following termination deleted from active systems within six (6) months and from backups within ninety (90) days, unless retention is required by law or for the establishment, exercise, or defense of legal claims.

   3. DATA SUBJECT RIGHTS

      Under applicable privacy laws (including GDPR, UK GDPR, CCPA/CPRA, and PDPA), you possess specific legal rights concerning the personal data Quantum Heaps collects and maintains. Quantum Heaps guarantees the execution of the following data subject rights:

      1. Right to Be Informed: You have the right to receive clear, transparent, concise, and easily understandable information regarding how we collect, process, store, and share your personal data. This Privacy Policy fulfills our obligation to inform you.

      2. Right of Access: You have the right to request confirmation as to whether we process your personal data and to obtain a copy of that personal data, along with supplementary details regarding its processing.

      3. Right to Rectification / Correction: You have the right to request the prompt correction, updating, or completion of any inaccurate, outdated, or incomplete personal data we hold about you.

      4. Right to Be Forgotten (Erasure): You have the right to request the permanent deletion or erasure of your personal data from our active systems, operational databases, and backup repositories, subject to specific regulatory exceptions.

      5. Right to Restrict Processing: You have the right to request that we temporarily or permanently suspend or restrict the processing of your personal data under specific circumstances (e.g., while data accuracy or legal legitimacy is being contested).

      6. Right to Data Portability: You have the right to obtain your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV) and to request the direct transfer of that data to another data controller where technically feasible.

      7. Right to Object to Processing: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interests or public interest. You have an absolute right to object to direct marketing and related profiling.

      8. Right in Relation to Automated Decision-Making and Profiling: You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. Quantum Heaps does not execute automated decision-making that produces legal or significant consequences without meaningful human intervention.

      9. Right to Correction: Specifically recognized under applicable regional statutes, you maintain the independent right to demand that inaccurate or misleading personal records maintained by Quantum Heaps be updated and rendered accurate without cost.

      10. Right to Erasure: Independent of broader “right to be forgotten” claims, you hold the right to demand explicit deletion of personal data when such data was unlawfully processed, consent was withdrawn, or processing is no longer required under the original collection purpose.

   4. HOW TO EXERCISE YOUR RIGHTS

      To exercise any of the rights enumerated in Section 8, you or your legally authorized agent may submit a formal Data Subject Access Request (DSAR) to our Compliance Office through the following channels:

      • Email: privacy@quantumheaps.com

      • Mail: Attn: Data Protection Officer & Chief Compliance Officer, Quantum Heaps Legal Department.

   5. Security Measures
      We implement appropriate technical and organizational measures, including encryption in transit (TLS) and at rest (AES-256), access controls, multi-factor authentication, vulnerability management, logging and monitoring, employee training, and periodic audits aligned to ISO 27001/SOC 2 practices.

2. 2. Cross Border Transfers
      Personal Data may be transferred and processed outside the country of origin. Where applicable, we implement appropriate safeguards such as EU Standard Contractual Clauses (SCCs) and comparable protection under Singapore’s PDPA. We maintain transfer mechanisms and list of sub processors in our Data Processing Addendum (DPA).

2. 2. Sub processors & Third Parties
      We engage vetted sub processors for hosting, support, analytics, and related functions under written agreements imposing data protection obligations. A current list is available at [link], and we provide notice of material changes with an opportunity to object where required. We do not sell Personal Data. We may disclose Personal Data to: (a) sub processors; (b) affiliates for support/operations subject to safeguards; (c) competent authorities when legally required; (d) third parties at your direction via integrations. We may disclose aggregated or de-identified data that does not identify individuals.

2. 2. Automated Decision Making & Profiling
      We do not use automated decision-making producing legal or similarly significant effects without human involvement. Any profiling used for product analytics or marketing is subject to consent and opt-out rights where applicable.

2. 2. Your Rights
      
      

      QuantumHeaps Pte. Ltd. is committed to protecting your privacy and ensuring that your personal data is processed in accordance with applicable data protection laws, including the Singapore Personal Data Protection Act (PDPA) and other applicable privacy regulations. Below are your rights regarding the personal data we collect and process.

      Right

      Description

      The right to be informed and give consent Before QuantumHeaps Pte. Ltd. collects any of your personal data, we will clearly explain what information we need, why we need it, and how we will use it. We will only collect your personal data with your explicit consent. The right to access your data You have the right to request access to the personal information QuantumHeaps Pte. Ltd. holds about you. This includes the ability to review and verify its accuracy and completeness. The right to correct mistakes If you find any errors or missing information in your data held by QuantumHeaps Pte. Ltd., you have the right to request corrections. We will take reasonable steps to update your information promptly upon verification of your request. The right to withdraw consent You can withdraw your consent for QuantumHeaps Pte. Ltd. to process your sensitive personal data at any time. Once you withdraw consent, we will stop using your data for the purpose originally agreed upon, unless there’s a legal reason for continued processing (like a court order). To withdraw consent, please (click here)

2. 2. Children’s Data
      Our services target business users and are not directed to children. We do not knowingly collect Personal Data from individuals under 18. If discovered, we will delete it.

2. 2. Marketing & Communications
      We may send service and transactional communications. We obtain consent for marketing where required and include opt-out mechanisms in every marketing message.

2. 2. Data Breach Notification
      We will notify affected controllers/customers without undue delay upon becoming aware of a Personal Data breach, and where required, notify regulators and individuals (e.g., within 72 hours under GDPR; per PDPA thresholds for significant harm or scale).

2. 2. Updates & Version Control
      We may update this policy to reflect changes in laws or practices. We will provide notice of material changes via email or in-product banners and indicate the effective date at the top. Prior versions can be requested at privacy@quantumheaps.com.

2. 2. Dispute Resolution & Arbitration
      This policy is governed by Singapore law. Disputes shall be finally resolved by arbitration administered by the Singapore International Arbitration Centre (SIAC) in accordance with the SIAC Rules then in force. Seat: Singapore. Tribunal: one arbitrator unless otherwise agreed. Language: English. Nothing precludes urgent interim relief from a court of competent jurisdiction.

Part II: Region Specific Addenda 

1. 1. EU GDPR Addendum

1. 1. Roles: Quantum Heaps acts as processor for Customer CRM data and controller for account-level data.

1. 1. EU Representative: Where Article 27 requires, we will appoint and publish contact details.

1. 1. Lawful Bases: Contract, consent, legitimate interests, legal obligations.

1. 1. Rights: Access, rectification, erasure, restriction, objection, portability, and rights concerning automated decision-making; submit requests via privacy@quantumheaps.com.

1. 1. International Transfers: Use SCCs and supplementary measures following transfer impact assessments.

1. 1. Breach Notification: We notify controllers without undue delay and, where required, individuals/regulators within statutory timelines.

1. 1. DPA: Our DPA incorporates SCCs (Module 2), sub processor change notifications, audit options, and technical/organizational measures.

1. 1. US CCPA/CPRA Addendum

1. 1. Scope: Applies to California residents’ personal information.

1. 1. No Sale/Share: We do not sell or share personal information for cross-context behavioral advertising.

1. 1. Consumer Rights: Right to know categories and specific pieces, right to delete, right to correct, right to opt out of sale/share, right to limit use of sensitive personal information, and non-discrimination.

1. 1. Verified Requests: Submit via privacy@quantumheaps.com or our Privacy Center; we verify identity before fulfilling requests.

1. 1. Sensitive PI: Used only for permitted purposes.

1. 1. Recordkeeping: We maintain request logs and metrics to demonstrate compliance.

1. 1. Singapore PDPA Addendum

1. 1. Consent & Notification: We collect, use, and disclose personal data with consent or under PDPA exceptions, and notify individuals of purposes.

1. 1. Access & Correction: Individuals may request access to and correction of their personal data subject to statutory exceptions.

1. 1. Protection, Retention, Accuracy: We protect personal data with reasonable security arrangements, retain only as necessary, and make reasonable efforts to ensure accuracy.

1. 1. Data Breach Notification: We assess incidents and notify the PDPC and affected individuals where the breach results in, or is likely to result in, significant harm or involves significant scale.

1. 1. Cross Border Transfers: We ensure recipients provide a comparable level of protection (e.g., contractual clauses).

1. 1. DNC: We comply with Do Not Call provisions for marketing to Singapore numbers.

Part III: Cookie & Consent Management Policy

1. 1. PurposeThis policy explains how Quantum Heaps uses cookies and similar technologies and how users can manage consent and preferences on our websites and applications.

1. 1. What Are Cookies?
      Cookies are small text files placed on your device to remember settings and track usage. We also use SDKs, pixels, local storage, and server-side logs.

1. 1. Types of Cookies We Use
      – Strictly Necessary: Enable core functionality and security.
      – Functional: Remember preferences and improve experience.
      – Performance/Analytics: Measure usage and help improve services.
      – Marketing: Subject to consent; used for our own outreach (no third party ad sales).

1. 1. Consent & Preference Center
      On first visit, we present a consent banner with granular controls. You can accept, reject, or customize categories at any time in the Privacy/Consent Center. We honor browser based signals (e.g., Global Privacy Control) where applicable by declining non essential tracking.

1. 1. Managing Cookies
      You may manage cookies via browser settings or via our platform, designed to give you a secure experience. While you may disable certain cookies, please note that doing so could limit functionality and reduce the performance of personalized features. For optimal security and tailored services, we recommend enabling essential and performance cookies.

1. 1. Cookie Lifetimes
      Strictly necessary cookies typically persist for the session; analytics/functional cookies generally expire within 12–24 months unless renewed by consent.

1. 1. Third Party Tools & Integrations
      Where you enable third-party integrations (e.g., chat widgets, analytics, forms), those providers may collect data and set cookies under their own privacy policies. Quantum Heaps does not control and is not responsible for the privacy or security practices of such third parties. We provide disclosures and controls to help you manage these integrations, and recommend reviewing the privacy policies of any third party services you enable.

1. 1. Updates
      We may update this policy to reflect changes in law or technology. Material changes will be communicated via banner notices.