Privacy Policy

Quantum Code Technologies Ltd ("QC Tech", "we"), a company incorporated under the laws of England and Wales with its registered office in Bishop's Stortford, Hertfordshire, United Kingdom, Company Number 17317573, is the Data Controller of personal data collected through the QuiPalermo portal (quipalermo.it).

For any privacy-related request: hello@qc-tech.co.uk

QC Tech Ltd is currently assessing the appointment of a representative pursuant to Art. 27 GDPR for users resident in the European Union. Until appointment, all requests relating to data processing may be addressed directly to the Data Controller at the address indicated above. This notice will be updated as soon as a representative is appointed.

Civic reports: description, category, geographic location, attached photograph (optional), IP address (stored only in anonymised form via cryptographic hash, never in plain text). Purpose: publication of the report on the civic map, abuse prevention (submission limits).

Events: for events published by private users — no personal data beyond what is entered in the event content. For paid "featured" events — organiser name and email, payment data (processed directly by Stripe, not stored by us).

Business reviews: name entered by the author, rating, comment, anonymised IP address (hash).

Commercial enquiries ("For businesses" page): business name, contact name, email, phone (optional), message.

Event notification subscription: email address, categories of interest, geographic area of interest. Subscription confirmed via double opt-in (confirmation email).

Push notifications (PWA): technical identifier of the browser push subscription (endpoint and cryptographic keys), no personally identifiable data.

Administrator/moderator accounts: email and password (managed via the Supabase authentication service), restricted to authorised QC Tech personnel.

Premium businesses: owner's email, billing data processed directly by Stripe Inc. pursuant to its privacy policy.

Browsing data: via Google Analytics 4 we collect aggregated and anonymised statistical data on site usage (pages visited, origin, device).

• Performance of a service requested by the user (Art. 6(1)(b) GDPR): publication of reports, events, reviews, Premium subscription management.
• Consent (Art. 6(1)(a) GDPR): email/push notification subscription, analytics cookies.
• Legitimate interest (Art. 6(1)(f) GDPR): abuse prevention via IP hash, platform security.

[TO BE DEFINED WITH LEGAL COUNSEL — current placeholder: data is retained for as long as necessary to provide the requested service and, thereafter, for the period strictly necessary to comply with legal obligations. User-published content (reports, events, reviews) remains visible until removed by the user or the Data Controller. This section will be updated with specific retention periods for each category of data.]

Data is processed via the following third-party providers (sub-processors), acting as data processors:

• Supabase Inc. — database hosting
• Vercel Inc. — application hosting
• Resend — transactional email delivery
• Stripe Inc. — payment processing (Premium plan)
• Google LLC — Google Analytics 4, Google Places API (commercial business data, not users' personal data), maps (OpenStreetMap/CARTO tiles)

Some of these providers are based in the United States. Transfer of data to countries outside the EU is carried out on the basis of Standard Contractual Clauses approved by the European Commission or equivalent transfer mechanisms provided by each supplier.

You have the right to request at any time: access to your data, rectification, erasure, restriction of processing, data portability, objection to processing. You may exercise these rights by writing to hello@qc-tech.co.uk.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your country of residence.

Use of QuiPalermo by persons under 18 is permitted only with the consent of a parent or legal guardian. QC Tech does not knowingly collect data from minors without such consent; if we become aware of unauthorised collection we will proceed with deletion.

The site uses technical cookies necessary for operation and analytics cookies (Google Analytics 4). [TECHNICAL NOTE: verify presence of cookie consent banner before publication — if absent, it must be implemented before this section is fully compliant.]

This notice may be updated. The "last updated" date at the top of the page reflects the current version. In case of material changes, we will provide appropriate notice.