Privacy Notice | QWYQ

1. Who we are

QWYQ is operated by QWYQ BV. QWYQ BV is the data controller for the personal data described in this Privacy Notice, unless a customer agreement states otherwise.

Legal company: QWYQ BV
Privacy contact: hello@qwyq.nl

2. What information we collect

Depending on how you use QWYQ, we may collect account details, organisation context, assessment answers, generated outputs, technical information and support messages.

Access request information: business email address, name, organisation name and submitted onboarding context.
Organisation information: company type, size, sector, phase, KvK number and public company information retrieved through a registry lookup, if used.
Assessment answers: AI readiness, cyber risk, technology stack, data classification, security maturity, business context, regulatory obligations and implementation priorities.
Generated outputs: readiness scores, risk scores, dashboards, profiles, recommendations, roadmaps, executive summaries and PDF reports.
Technical and communication data: device, browser, IP address, session data, logs, security events, support requests and feedback.

3. Why we use this information

We use data to provide access to QWYQ, run the assessment, create outputs, save progress, support users, secure the platform and improve reliability.

Provide access to the QWYQ platform and profile flow.
Run cyber risk and AI readiness assessments.
Generate dashboards, scores, reports and recommendations.
Save progress and allow users to resume assessments.
Provide support and respond to questions.
Secure the platform, prevent misuse and comply with legal obligations.

4. Legal basis

Where GDPR applies, QWYQ relies on the legal basis that matches the processing purpose. Consent is used only for optional activities, not for data that is necessary to provide the core service.

Performance of a contract: Providing QWYQ profiles, assessments, dashboards and reports.
Legitimate interest: Security, fraud prevention, basic product improvement and service reliability.
Consent: Optional marketing, non-essential analytics and optional benchmark/product-quality use.
Legal obligation: Record keeping or lawful requests where applicable.

5. AI-generated outputs

Some QWYQ outputs may be generated or supported by AI systems, including executive summaries, direction statements, recommendations or report text.

Where an external AI provider is used, QWYQ shares only the information necessary to generate the requested output.
QWYQ aims to avoid sending unnecessary personal data to AI systems.
QWYQ does not use confidential assessment answers to train public AI models unless explicitly agreed with the customer.
AI-generated outputs are decision-support materials and do not replace professional, legal, security, financial or compliance advice.
No external AI provider is integrated into this public preview. Provider details and safeguards will be published before AI-supported processing starts.

6. Confidentiality of assessment data

QWYQ may process sensitive business information, especially in cyber risk assessments. This can include information about technology infrastructure, security maturity, regulatory exposure, risk scenarios and business impact.

Individual assessment results are not published, sold or shared with third parties except where necessary to provide the service, comply with law or as agreed with the customer.
CRQ answers are treated as confidential business information.
Access to assessment data is restricted to people and processors who need it to provide or protect the service.

7. Who we share data with

QWYQ may work with trusted service providers that help operate the platform. These providers may only process data according to QWYQ instructions and for the purposes described in this notice.

Hosting and infrastructure providers.
Authentication and email providers.
Analytics providers, if optional analytics is enabled.
AI providers.
PDF/report generation tools.
Support, communication and company registry lookup providers.

Note. Current public-site processors are limited to hosting/infrastructure and transactional email where enabled. Additional sub-processors will be listed before the corresponding service is activated.

8. Data retention

QWYQ keeps data only for as long as necessary to provide the service, meet legal obligations, protect the platform or honour customer agreements.

Early-access request data: Kept for up to 24 months unless deletion is requested earlier or retention is required by law.
Assessment preview data: Not persisted by the public preview unless explicitly submitted as an early-access request.
Security logs: Kept for up to 90 days where available from hosting providers to protect the platform.
Consent-based data: Deleted or anonymised when consent is withdrawn, unless another legal basis applies.

Note. Customer deployments may use different retention periods where a signed customer agreement says so.

9. Your rights

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to or receive a copy of your personal data.

You may withdraw consent where processing is based on consent.
You may lodge a complaint with a data protection authority, including the Dutch Autoriteit Persoonsgegevens where applicable.
To exercise your rights, contact hello@qwyq.nl.

10. Cookies and analytics

QWYQ may use necessary cookies to make the platform work, including security and session cookies for platform access. Optional analytics or marketing cookies are used only with consent where required.

This implementation adds static cookie and analytics wording only.
No non-essential analytics consent banner is added until analytics is integrated.
Optional analytics consent should remain separate from the core assessment acknowledgement.

11. Changes to this notice

QWYQ may update this Privacy Notice when the platform changes or when legal requirements evolve. The latest version will be available on the QWYQ website.