Privacy policy
We care about your privacy and about complying with the regulations in force regarding the personal data we process in the course of our business.
Our privacy policy applies to Visitors and Users of the Quilium websites (the “Quilium Sites”), available on the quilium.io domain and its aliases.
It tells you about the following:
1. who is the data controller?
2. what personal data do we collect?
3. how do we obtain your personal data?
4. how do we use your personal data?
5. on what legal basis do we process your personal data?
6. how long do we keep your personal data?
7. with whom do we share your personal data?
8. how do we protect your personal data?
9. to which countries do we transfer your personal data?
10. what are your rights?
1. Who is the data controller:
QUILIUM S.A. is a public limited company (société anonyme) under Luxembourg law, established and having its registered office at L-1741 Luxembourg, 67, rue de Hollerich, registered with the Luxembourg Trade and Companies Register (“RCS”) under number B201627, acting as Data Controller.
You can reach Maxime Andrade, in charge of data processing, at the following contact details:
Phone: +352 24 69 56-1
E-mail: [email protected]
2. What personal data do we collect?
We may collect certain personal data:
from Visitors and Users of our Website
from our Users' customers and from the Visitors or Users of the sites of our Users or of their customers.
2.1. Visitor and User data
When you visit our Site, we may process certain technical data while you browse the Site, such as click streams, session statistics, information about the device, operating system, browser, screen resolution, language settings and internet service provider. This data is anonymous, since it does not allow us to identify you. It may relate to a Visitor, or to a User who has not signed in.
On the other hand, when a User Account is created, we collect the User's personal data.
These are the following categories of data (the “Personal Data”):
identification data (last name, first name, job title, company you work for)
data allowing us to contact you for the performance of our services (postal address, e-mail address and phone number(s)),
information related to the invoicing of our services and the management of invoices (name, billing address, transaction details, VAT),
data allowing us to improve our services, namely information derived from your visits to the Quilium Site (when you log in to your account) or from the use of our services, or in relation to the documents and communications we send you electronically, IP address, geolocation and/or unique device identifier.
2.2. Data relating to the User's customers or to the users of the User's websites
We may also collect similar data about our Users' customers (“User's Customer”) when our Users build websites on behalf of their customers, or about the visitors and users of the websites or services of our Users or of their customers (“User Site User”), solely for and on behalf of our Users.
In this context, Quilium acts merely as a processor of the Data of User's Customers or of User Site Users. The Users or User's Customers who control and operate their User Sites are considered the controllers of the Personal Data of User Site Users and are required to comply with the applicable personal data protection regulations.
Users and User's Customers are responsible for the security, integrity and lawfulness of the processing of the Personal Data of their User Site Users, and in particular for obtaining the consent required for the collection and use of that Data.
Visitors and users of our Users or of User's Customers who have any request or question about their Personal Data (e.g. access, rectification, deletion of data, etc.) are invited to contact the relevant User or User's Customer directly (the person in charge of managing the website).
2.3. Data sent through the “Got an idea?” feature (product feedback)
The Quilium back office offers a “Got an idea?” button that lets the User send us an improvement suggestion, a feature request or free-form feedback. When You use this feature, we receive and keep:
• the content of your message and the type of feedback chosen (idea, improvement of a screen, other);
• your identification data from your User Account (name, e-mail address, account identifier), so that we can reply to you;
• the technical context attached automatically: the name of the back-office screen from which the feedback is sent, the software version, the identifier of the User Site concerned and the browser type (“user agent” string). No capture of your screen is made without your knowledge;
• where applicable, the screenshot You choose to attach Yourself. It is Your responsibility not to include third-party personal data or confidential information in it;
• your choice of whether or not to be kept informed by e-mail of the follow-up given to your feedback.
This information is processed by Quilium on the basis of its legitimate interest in improving its services (section 5 below). It is recorded on a collection platform operated by Quilium and hosted in the European Union, forwarded by e-mail to the Quilium product team through our e-mail delivery provider, and is neither published nor disclosed to third parties. The attached screenshot is kept with the feedback and deleted with it. This data is kept for a maximum of 24 months after the feedback has been handled.
3. How do we obtain your Personal Data?
• We collect data from your use of the site and its services: when you use our services, including when you browse a User's website(s), subscribe to a User Account, edit your User website, transfer information and content, this may lead to the reassembly, collection and recording of these uses, sessions and information, both independently and with the help of third-party services as detailed in section 7 below, including through the use of cookies and other tracking technologies, as detailed in section 4 below.
• We collect the Personal Data you provide to us voluntarily (for example when creating your User Account, by e-mailing us or by subscribing to a newsletter).
4. How do we use your Personal Data?
We collect Personal Data for the following purposes:
Operating and improving our website, including statistics and tracking of its use;
Providing and operating our services (e.g. creation of a User Account);
Developing, customising and improving our services, based on the common and individual preferences and difficulties of visitors and users;
Providing our users with assistance and technical support;
Improving our data security;
Contacting visitors and users of the site with general or personalised notifications;
Providing certain information requested by our users;
Fulfilling our legal, regulatory and risk-management obligations, including in the context of audits or administrative or judicial proceedings.
Information about Cookies:
What is a “cookie”?
A cookie is a text file placed on your device (computer, mobile, tablet) when you visit a website. It records information about your browsing on that site and allows its issuer to identify the device on which it is stored, for the period of validity of that cookie.
Some cookies are essential to the use of the site, others make it possible to optimise and personalise the content displayed.
For what purpose do we use cookies?
QUILIUM uses several types of cookies serving different needs:
Cookies required to use the site:
These are the cookies essential to browsing our site, which allow you to use the main features of the site and to secure your connection. These cookies are issued exclusively by QUILIUM. If you disable the use of these cookies, you may no longer be able to benefit from certain features of the site.
Performance and functional cookies:
These cookies are not essential to the use of the site, but they make it possible to optimise the operation of our site and to give you access to personalised features. For example, they allow the presentation of the site to be adapted to the display preferences of your device.
Analytics:
The Quilium Sites use no third-party analytics or tracking tool and set no third-party cookies. Audience statistics are produced with Matomo, an open-source tool hosted by Quilium on its own infrastructure in the European Union and fed from the server logs; the data (pages visited, browser, truncated IP address) stays on Quilium's infrastructure and is not shared with anyone.
How to object to or limit cookies?
You can object to or limit the storage of cookies by configuring your browser software (Internet Explorer, Chrome, Firefox, etc.). Please refer to the help section of your web browser for all technical details on the options available regarding the storage of cookies on your device.
Please note that if you refuse the storage of certain cookies, this may affect the proper operation of certain features of the site.
5. On what legal bases is the processing of your Personal Data founded?
We collect Personal Data on the following grounds:
For the conclusion or performance of our service contract,
For the exercise or defence of claims or legal proceedings,
To comply with legal and regulatory obligations,
On the basis of your consent for processing for commercial purposes,
For our legitimate interest, where necessary to improve our services.
6. How long do we keep your Personal Data?
We delete your Personal Data as soon as it is no longer needed for the purposes mentioned above.
Your Personal Data is kept for the retention period appropriate to each category of data. These periods are based on the requirements of the applicable data protection regulations and on the purpose of their collection and use, taking into account:
legal and regulatory obligations to retain Data and documents (e.g. accounting and tax obligations, anti-money-laundering regulations, etc.),
the limitation periods during which data subjects may assert their rights in court against our company,
good practice,
Quilium's business objectives.
The maximum retention period for Personal Data is 10 years.
7. With whom do we share your Personal Data?
We may share Personal Data internally for the purposes described in this Privacy Policy.
We may share your Personal Data with certain trusted third parties in accordance with the contractual provisions in force with them.
Quilium has partnerships with several service providers whose services and solutions complement, facilitate and improve its own, namely:
our payment service provider,
our hosting service provider,
our website analytics and performance optimisation service provider,
our e-mail delivery service provider.
These service providers may receive or have access to certain Personal Data of our Visitors and Users and/or of Users' users, each according to their role, in accordance with the contractual provisions, and they may only use it for these purposes.
Please note that, although our services may include links to other websites, we are not responsible for the privacy practices implemented on those websites. This Privacy Policy does not apply to such third-party websites.
Quilium remains the data controller with respect to the service providers it uses to process Personal Data on its behalf.
Where necessary, or for the reasons set out in this privacy policy, Personal Data may also be shared with authorities such as courts and public administrations, in order to comply with the legal or regulatory requirements to which we are subject.
We do not sell or make Personal Data available to any third party.
Quilium may share your Personal Data in ways other than those described above, with your consent, or if the law requires us to do so. Furthermore, Quilium may transfer, share, disclose or otherwise use anonymous data at its sole discretion and without any further need for approval.
Sharing with third parties and countries where your personal data is stored
We may share data internally for organisational reasons and with various service providers in accordance with the contractual provisions in force with them.
Some personal data is transferred to processors under processing agreements. These processors have undertaken to process the data entrusted to them in accordance with the GDPR (General Data Protection Regulation).
Some personal data is entrusted to processors under GDPR-compliant processing agreements:
Fly.io, Inc. (2045 West Grand Avenue, Chicago, IL 60612, USA), hosting of Quilium sites and services, Frankfurt region: data and backups are stored in the European Union. Fly.io adheres to the EU-US Data Privacy Framework and provides a data processing agreement (DPA).
Tigris Data, Inc. (object storage offered through Fly.io): storage of the media and files uploaded to Quilium sites, in European Union regions.
Amazon Web Services EMEA SARL (Luxembourg): backups and a mirror copy of media, stored in the Frankfurt region (eu-central-1), within the European Union.
Cloudflare, Inc. (United States): content delivery network, web application firewall, TLS certificates and DNS in front of the Quilium services and of the sites hosted on Quilium. Data processed: visitors' network traffic (IP address, request metadata). Cloudflare adheres to the EU-US Data Privacy Framework.
Google Cloud Translation (Google Cloud EMEA Limited, Ireland): alternative machine translation engine available in the CMS. Data transmitted: the text to translate only.
Sentry (Functional Software, Inc., United States): error monitoring of the Quilium applications. Data transmitted: technical error reports (stack traces, request context), with the collection of personal data disabled where the tool allows it, stored in the United States under the EU-US Data Privacy Framework and retained for 90 days.
Anti-spam screening of forms: forms published on the Quilium Sites are screened by OOPSpam, which receives the e-mail address and message content of the submission. Sites built on Quilium may instead use CleanTalk (submission content, IP address and browser of the sender) or Google reCAPTCHA (IP address, browser information and interaction signals), depending on their configuration.
UptimeRobot (UptimeRobot s. r. o., Slovakia, European Union): availability monitoring of the sites hosted on Quilium. Data transmitted: the public URL and the name of the site only.
Artificial intelligence model providers: Anthropic, PBC (United States) for the built-in AI assistant and the AI features integrated into the CMS (for example translations, content preparation and SEO suggestions), and OpenAI, L.L.C. (United States) for image generation. Only the data needed for the request is transmitted to them: the messages exchanged with the assistant and the user's name (sent for session context), the content the assistant is asked to work on, and image generation prompts. No browsing data (IP address, device identifier, geolocation) is transmitted. Both providers act as processors under a data processing agreement and do not use the data sent through their API to train their models.
E-mail delivery provider: Brevo SAS (France, European Union), for transactional e-mails (account e-mails, notifications and form submissions sent to their recipients). Data transmitted: recipient's e-mail address and message content.
Third-party resources loaded by your browser: some pages of the Quilium Sites, of the account area and of the back office load fonts, icons, scripts and images from third-party servers (Google Fonts, Font Awesome, jsDelivr, Gravatar and DiceBear for default avatars, Google Maps on map fields). When your browser fetches these resources, their provider receives your IP address and browser information. These providers do not process data on our behalf. You can replace your default avatar with your own picture from your account.
8. How do we protect your Personal Data?
We use various technical and organisational measures to protect your Personal Data against unauthorised access, use, disclosure, alteration or destruction, in accordance with the applicable data protection laws.
9. To which countries do we transfer your Personal Data?
Your personal data is stored in the European Union: the hosting infrastructure of our services (Fly.io) operates from the Frankfurt region, in Germany, and the backups are kept by Amazon Web Services in the same region.
Some processing is carried out outside the European Union by our artificial intelligence model providers, Anthropic, PBC and OpenAI, L.L.C., both established in the United States. It is limited to the data described in section 7: the messages exchanged with the built-in assistant, the user's name sent for context, the content the assistant is asked to work on and image generation prompts. These transfers are governed by a data processing agreement with each provider and rely on the safeguards provided for in Chapter V of the GDPR (the European Commission's standard contractual clauses included in each provider's data processing addendum). No other personal data (IP address, device identifier, browsing data) is transmitted to them. Hosting, backups and e-mail delivery take place within the European Union. Certain technical services (security and anti-spam tools, error monitoring, availability monitoring) may process visitors' traffic or technical data outside the European Union, under the safeguards listed in the Data Processing Agreement.
10. Your rights regarding your Personal Data
In accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, you have a right of access, rectification and, where applicable, erasure of the information concerning you. You also have the right to withdraw your consent at any time and, on legitimate grounds, the right to object to the processing of your data.
Please note that some of the rights set out above may be limited where we have an overriding interest or a legal obligation to continue processing the data.
You may also lodge a complaint with the Commission nationale pour la protection des données, whose registered office is at 1 Avenue du Rock'n'Roll, L-4361 Esch-sur-Alzette.
The European Union's General Data Protection Regulation provides data subjects with certain rights:
Right of access:
If you so request, we will confirm that we process Personal Data concerning you and we may provide you with a copy of that data. If you need additional copies, we may charge a reasonable fee.
Right to rectification:
If the Personal Data we hold about you is inaccurate or incomplete, you have the right to request rectification. If you are entitled to rectification and we have shared your Personal Data with third parties, we will inform them of the rectification where possible. If you so request, where possible and where we are legally entitled to do so, we will tell you with whom we have shared your Personal Data so that you can contact them directly.
Right to erasure:
You may ask us to remove or delete your Personal Data in certain circumstances, for example where we no longer need it or where you withdraw your consent (where applicable). If you are entitled to erasure and we have shared your personal data with third parties, we will inform them of the erasure where possible. If you so request, where possible and lawful for us to do so, we will also tell you with whom we have shared your Personal Data so that you can contact them directly.
Right to restrict processing:
You may ask us to restrict the processing of your Personal Data in certain circumstances, for example where you contest the accuracy of that Personal Data. If you are entitled to this restriction and we have shared your Personal Data with others, we will inform them of the restriction where possible. If you so request, and where possible and lawful for us to do so, we will tell you with whom we have shared your personal data so that you can contact them directly.
Right to data portability:
You have the right, in certain circumstances, to obtain the Personal Data you have provided to us (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer it to a third party of your choice.
Right to object:
You may ask us to stop processing your Personal Data, and we will do so if:
we rely on the legitimate interest of our company or of a third party to process your personal data, unless we can demonstrate compelling legitimate grounds for the processing;
the processing of your personal data is carried out for direct marketing purposes.
Where the processing of your Personal Data is based on the performance of our service contract, your objection to the processing we carry out on your Personal Data that is necessary for the performance of the contract will end the performance of our services.
Most web browsers can be configured to warn users of attempts to set cookies or to limit the type of cookies they accept. Please refer to the help section of your browser to find out which options your browser offers.
Right to withdraw your consent:
If we rely on your consent as the legal basis for processing your personal data, you have the right to withdraw that consent at any time.
Right to lodge a complaint with the supervisory authority:
If, after exercising your rights as detailed above, you have not received a reply from us, or in the event of a dispute about the processing of your Personal Data, you may report it to the competent supervisory authority.
Please note that some of the rights set out above may be limited where we have an overriding interest or a legal obligation to continue processing the data.