1. Who we are
Quantistic Systems is a UK-based provider of automated lead-handling software for estate agencies. For the purposes of UK GDPR, we act as:
- Data Controller for information about prospects, website visitors, and client contacts (the people we talk to directly).
- Data Processor for information about leads, applicants, and appointments that our clients store in the CRM we provide.
To contact us about privacy: quantisticsystems@gmail.com.
2. Data we collect directly
When you contact us or book a demo
- Name, email address, agency name, phone number (if provided)
- Content of your message and any follow-up correspondence
- Technical data: IP address, browser, device, referrer URL
When you become a client
- Billing details (processed via our payment provider — we do not store card numbers)
- Account credentials, API keys, n8n workflow URLs
- Usage analytics: logins, feature usage, error logs
When you visit our website
- Cookies and similar technologies as described in our Cookie Policy
- Aggregated analytics (page views, session duration)
3. Lawful basis for processing
- Performance of a contract — to deliver the service you've signed up for.
- Legitimate interests — to respond to enquiries, secure the platform, and improve our product. We balance this against your rights.
- Consent — for marketing communications and non-essential cookies. You can withdraw consent at any time.
- Legal obligation — tax, accounting, and record-keeping requirements.
4. Data we process on behalf of clients
When a client uses our CRM, they may upload or capture personal data about their own leads (homeowners enquiring about a valuation) and applicants (registered buyers). This data includes names, phone numbers, email addresses, property addresses, and message history.
For this data the client is the Data Controller and we act strictly as a Processor. We process it only on documented instructions from the client and under a Data Processing Agreement that forms part of our service contract. We do not sell, mine, or repurpose client data.
5. Third parties we share data with
We use a small number of vetted subprocessors. These are the main ones:
- Twilio — SMS and WhatsApp delivery. Messages and phone numbers pass through Twilio's infrastructure.
- n8n — workflow execution (self-hosted by client or on n8n Cloud).
- Render — application hosting for the CRM backend.
- Google Workspace — email delivery and inbox parsing.
- Stripe — payment processing (for clients only).
We do not sell personal data to anyone, ever.
6. International transfers
Some of our subprocessors are based outside the UK (notably in the US). Where data is transferred internationally, we rely on UK-approved safeguards including the UK International Data Transfer Agreement, the EU-US Data Privacy Framework, or Standard Contractual Clauses.
7. How long we keep data
- Enquiry data: up to 24 months from last contact, then deleted or anonymised.
- Client account data: for the life of the contract plus 7 years (UK statutory retention for financial records).
- Client CRM data (leads, messages): in line with the client's own retention policy. On termination, 30 days' grace period then permanent deletion.
- Analytics: aggregated data retained indefinitely in de-identified form.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Ask us to correct inaccurate data
- Ask us to delete your data ("right to erasure")
- Object to or restrict certain processing
- Request data portability
- Withdraw consent where processing is based on consent
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk)
To exercise any of these rights, email quantisticsystems@gmail.com. We will respond within one month.
9. Security
We take reasonable technical and organisational measures to protect personal data, including encryption in transit (TLS), access controls, API key rotation, and regular backups. No system is 100% secure — if we discover a breach that risks your rights and freedoms, we will notify you and the ICO within 72 hours as required.
10. Children
Our services are not directed at children under 16 and we do not knowingly collect their data.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email to clients and flagged at the top of this page.
12. Contact
Privacy questions: quantisticsystems@gmail.com. General contact: contact page.