Privacy Policy

01 Introduction

Quantum Spectrum Ledger Ltd ("QSL", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Services").

This policy applies to all users of quantspectrumledger.com, the QSL mobile application, and our API services. By accessing our Services, you acknowledge you have read and understood this policy.

02 Data We Collect

We collect data in three primary ways: data you provide directly, data we collect automatically, and data received from third parties.

Identity & Account Data:

• Full legal name, date of birth, nationality
• Government-issued identity documents (passport, driving licence) for KYC/AML compliance
• Email address, phone number, residential address
• Selfie/liveness check images for identity verification

Financial Data:

• Wallet addresses, transaction history, portfolio balances
• Bank account details (for fiat on/off ramp)
• Source of funds declarations
• Tax identification numbers where required by law

Technical Data:

• IP addresses, device identifiers, browser type and version
• Login timestamps, session durations, feature usage patterns
• Cookies and local storage data (see Section 8)

03 How We Use Your Data

We never sell your personal data to third parties for commercial purposes.

04 Data Sharing & Disclosure

We share your data only when necessary for the operation of our Services or as required by law:

• KYC/AML Providers: Onfido, Sum & Substance for identity verification
• Blockchain Networks: Transaction data is inherently public on-chain
• Regulatory Authorities: FCA, HMRC, and equivalent bodies as required by law
• Custodians & Vaults: For gold and physical asset-backed products
• Cloud Infrastructure: AWS (EU-West-2), with appropriate data processing agreements

05 Data Retention

We retain personal data for as long as necessary to provide the Services and fulfil our legal obligations:

• Account data: Duration of account + 7 years (AML record-keeping requirements)
• KYC/identity documents: 5 years post account closure
• Transaction records: 7 years (UK Money Laundering Regulations)
• Marketing preferences: Until withdrawal of consent
• Technical logs: 13 months rolling

06 Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of Access — Request a copy of all personal data we hold on you
• Right to Rectification — Correct inaccurate or incomplete data
• Right to Erasure — Request deletion ("right to be forgotten") subject to legal obligations
• Right to Restriction — Limit processing in certain circumstances
• Right to Data Portability — Receive your data in a machine-readable format
• Right to Object — Object to processing based on legitimate interests
• Rights re: Automated Decisions — Not be subject to solely automated decisions with significant effects

To exercise any right, contact privacy@quantspectrumledger.com. We will respond within 30 days.

07 Security Measures

We implement industry-leading security measures including:

• AES-256 encryption for all data at rest
• TLS 1.3 for all data in transit
• Post-quantum cryptographic key management
• ISO 27001-aligned information security management
• Penetration testing by independent firms (quarterly)
• Multi-factor authentication on all internal systems

08 Cookies & Tracking

We use the following categories of cookies:

• Essential: Required for platform functionality (session management, authentication)
• Analytics: Anonymous usage statistics via Plausible Analytics (privacy-preserving, no cross-site tracking)
• Preference: Remembering your settings and language preferences

We do not use third-party advertising cookies or behavioural tracking cookies. You can manage cookie preferences via our Cookie Banner.

09 International Data Transfers

Your data is primarily processed within the UK and EEA. Where transfers occur to third countries, we ensure adequate protection via Standard Contractual Clauses (SCCs) or equivalent mechanisms approved by the ICO.

10 Children's Privacy

Our Services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided data, please contact us immediately at privacy@quantspectrumledger.com.

11 Policy Changes

We may update this policy from time to time. Material changes will be communicated via email notification and a prominent notice on our platform at least 30 days prior to taking effect. Continued use after the effective date constitutes acceptance.

12 Contact & DPO