Privacy statement
1 – Introduction
1.1 – With this privacy notice, we wish to inform you on how and why we Process [1] your Personal Data [2] and which rights you have under the European General Data Protection Regulation (« GDPR ») and other local laws on Privacy and the Processing of Personal Data (« Applicable Laws »).
1.2 – You will see defined terms in this privacy notice. Terms defined herein are capitalized. If not defined within this privacy notice, these terms have the meaning provided for in the Applicable Laws.
2 – Processing of Personal Data
2.1 – As part of our activities, we may Process[1] Personal Data[2] about you, your employees, directors, agents or other representatives (« Data Subject(s) » or « you ») in the manner described below. The use of the derived forms “your” and “yours” refer to you or to the Data Subjects.
2.2 – We are committed to protecting your privacy and your Personal Data and to respecting your rights. This notice explains how we Process your Data, in accordance with the Applicable Laws.
2.3 – If you are an entity, please inform your employees, directors, agents and other representatives of our Processing of their Personal Data. Every time you transfer Personal Data to us in the context of our business relationship, you guarantee to us that it is lawful for you to do so, that you have appropriately informed the respective individual of such Processing and that no transfer of Personal Data to us will put us in breach of the Applicable Laws.
3 – Data controller
3.1 – Phoenix Biosciences SA, for its activities operated under the brand Quantoom Biosciences , acts as the data controller for the Processing of your Personal Data. This means that we determine why and how your data are processed.
The details of the data controller (herein also referred to as “we” or “us”), responsible for ensuring that your data are processed in a lawful, transparent, and secure manner, are as follows:
Phoenix Biosciences SA , registered office at Rue de la Maîtrise 11, 1400 Nivelles, Belgium , registered under company number BE1027.640.071 (Register of Legal Entities Brabant Wallon).
3.2 – We have set-up a privacy point of contact which you can reach by contacting: info@quantoom.com
4 – How and why we Process your Personal Data
4.1 – We may Process your Personal Data for various purposes. Below, we describe for each purpose, the type of activities we perform, the categories of Data Subjects to whom such Processing relates to the categories of Personal Data we Process, as well as the applicable legal basis and retention period.
4.2 – We may also Process your Personal Data (e.g. as a contractor, consultant, intern or partner) in the context of our internal workforce management, which activities are described in a separate (internal) notice and which will, when applicable, be provided to you.
4.3 – In addition to the Data categories listed above, we may use other types of Data relating to you that you may have voluntarily provided to us, or that were provided to us in the context of our business relations, or that we have deducted or generated from Data that were already in our possession.
5 – We may collect your Data in different ways
5.1 – We may collect Data that you have voluntarily provided to us (for example by applying or registering for an event, visiting our booth at a congress, attending a meeting with one of our team members, by giving us your business card, responding to a survey or participating in a website feature) or through the company or organisation you work for.
5.2 – It may also be possible that we receive or indirectly collect Data about you, for example, from our business partners or from public sources such as social networks or public websites.
6 – Sharing your Personal Data with others
6.1 – We restrict access to your data to employees and any person acting under our authority on a need-to-know basis, who respect our confidentiality rules and comply with our instructions.
6.2 – Any person having access to your Personal Data (e.g. our Marketing & Communication team, our Sales team, our Procurement team, our IT team) and acting under our authority shall Processes your Data in accordance with the instructions that we have given them, and has an obligation to respect our confidentiality rules.
6.3 – We may call on internal or external Processors for the Processing of your Personal Data (e.g. internal service providers, external IT service providers, external mailing providers). In this case, we only call on Processors providing sufficient guarantees on the lawfulness, transparency and the security of the Processing of your Data.
6.4 – We may also need to transfer your Data to other Recipients (both intragroup and external) if we believe in good faith that this is necessary, at all times in accordance with our obligations under the Applicable Laws. We could transfer your Data to, for example:
- Attorneys or courts to safeguard the rights and interests of our organization, our people, our customers and partners or the public in general;
- Public or enforcement authorities to comply with a legal obligation or procedure;
- External or internal service providers;
- Potential investors or counsels in the context of an equity raise, reorganisation or an M&A transaction;
- Our (statutory) auditors to perform an audit.
6.5 – We may also share your Data with authorized distributors, business partners to communicate with you or to respond to your queries.
6.6 – We are an international organisation, operating globally and may therefore transfer your Personal Data outside the European Economic Area (EEA). Transfers from our entity in the European Economic Area to entities outside the EEA are covered by intercompany data transfer agreements in line with Applicable Laws. When your personal data is shared by us with or transferred by or to a third party outside the EEA, when required, we will enter into the appropriate data transfer agreements or otherwise make sure appropriate safeguards are in place.
6.7 – When you use our website, Personal Data collected through cookies, forms and similar technologies may also be received by the providers of those services. These currently include Google (Tag Manager, Analytics, Ads, Tag, YouTube and, where used, reCAPTCHA), HubSpot (forms, CRM, tracking and meeting widgets), LinkedIn / Microsoft (Insight Tag), Leadsy.ai and Apollo (B2B visitor identification), Sketchfab (Virtual Showroom), Pipedrive (TAMARA demo scheduler operated by our partner Inside Therapeutics), and our hosting and IT providers. Some of these providers (in particular Google and LinkedIn) may process certain data as independent controllers under their own policies.
Automated analysis and AI tools
We do not operate our own AI agents on Personal Data collected from you, and we do not send your cookie or CRM data to ChatGPT, Claude or similar tools for analysis.
We do use third-party tools that apply automated analysis, including AI-based features:
- Leadsy.ai and Apollo, to identify business visitors and measure marketing interest when marketing cookies are accepted;
- Google and HubSpot, which may apply automated reporting or AI features available in their products, according to each provider’s settings and policies;
- AI crawlers such as GPTBot (OpenAI) and ClaudeBot (Anthropic), which we allow to read the public content of our website (including via our llms.txt file). This concerns publicly available pages, not your cookie profile or form submissions.
These providers process data under their own terms. You can object or withdraw consent as described in this notice and in our Cookies notice.
7- Minimizing and securing your Personal data – Data retention & deletion
7.1 – At all times we aim to minimize the Personal Data we process, to make sure we only use your Data when and in so far we need it. Where possible we also pseudonymise or key-code your Data so that you cannot be directly identified.
7.2 – We only keep your data where and in so far as we need it, in line with the mandatory retention terms. Once we are no longer required to keep your Personal Data or have an appropriate basis to continue the Processing, we will either delete or anonymise your Data, however we will be under no obligation to inform you about such deletion or anonymisation.
8 – We respect your rights
8.1 – We have implemented reasonable, risk-based technical and organisational measures to ensure that your Data is protected from loss or disclosure, unauthorised use, modification or destruction.
8.2 – Under the Applicable laws You have certain rights in relation to the Personal Data we Process, including:
- the right of information about and access to your Personal Data;
- the right to rectify or erase your Personal Data;
- the right to restrict or to object to certain processing;
- the right to data portability;
- the right to withdraw your consent, where the processing is based on consent.
8.3 – You can request the exercise of your rights by contacting us using the contact details below.
8.4 – In order to guarantee the security of your Data and to avoid any misuse, before responding to your request, we will ask you to provide us with an acceptable proof of your identity and will verify the legitimacy of your request and whether all the conditions have been satisfied.
9 – Contact us
9.1 – If you have any questions or concerns about the way we Process your Personal Data, do not hesitate to direct them to our privacy point of contact:
- By email: info@quantoom.com
- By mail: rue de la Maîtrise 11, 1400 Nivelles, Belgium.
9.2 – We will use our reasonable efforts to find a quick and appropriate solution to any request that you may submit to us.
9.3 – In addition, if you have reasons to believe that the Processing of your Personal Data by us infringes the Applicable Laws, you have the right to lodge a complaint with the supervisory authority. You can reach the Belgian Data Protection Authority through: www.dataprotectionauthority.be
© Phoenix Biosciences SA
[1] “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. A Processor is any person or entity who Processes Personal Data.
[2] “Personal Data” or “Data” means the information that identifies you or allows you to be identified either on its own or in combination with other information.