01Who we are
QUORIX CONSULTING LTD is the data controller for personal data submitted through this website. We are a company registered in England and Wales under company number 16087333, whose registered office is at 33 Bedford Road, Northampton, NN7 1DR, United Kingdom. Our studio is at 34 Great Titchfield Street, London W1W 8BQ. You can reach us at hello@quorixdigital.com.
We also have a registered office in the Kingdom of Saudi Arabia, at King Fahd Road, Al Fayha District, Jeddah 22241. Our Saudi Commercial Registration number is 7053540790 and our National Address code is JAFB8745. We are not established or registered in any other country.
If you are contracting with our Saudi entity rather than our UK one, tell us at the point of enquiry. The data controller for your engagement may be the Saudi entity rather than the UK one, and that changes which privacy law applies to your project data as well as who you should approach with a request.
02Which data protection laws may apply to you
Because we work across six markets, more than one regime can apply depending on where you are. We list them because a notice that named only the UK law would be misleading, not because we claim compliance with all of them — whether a given law applies to you depends on facts we cannot know, such as your sector, the volume of data involved and whether you meet a statutory threshold.
- United Kingdom — UK GDPR and the Data Protection Act 2018, enforced by the Information Commissioner's Office (ico.org.uk)
- European Economic Area — the GDPR, where a client's own obligations bring EEA personal data into scope
- United States — no single federal law. The California Consumer Privacy Act as amended by the CPRA, plus a growing set of state laws including Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Illinois' Biometric Information Privacy Act applies to biometric data, and Washington's My Health My Data Act applies to consumer health data
- Canada — PIPEDA federally, with provincial private-sector laws in Quebec, Alberta and British Columbia. Quebec's Law 25 is the most demanding, adding privacy by design, impact assessments, a privacy officer role and stricter cross-border transfer rules
- Australia — the Privacy Act 1988 and the Australian Privacy Principles, enforced by the Office of the Australian Information Commissioner. The 2024 amendments raise penalties substantially and introduce a statutory tort for serious interference with privacy, with a transitional start in December 2026
- United Arab Emirates — Federal Decree-Law No. 45 of 2021, enforced by the UAE Data Office, including its conditions on transferring personal data outside the Emirates
- Saudi Arabia — the Personal Data Protection Law issued and enforced by the Saudi Data & AI Authority (SDAIA), which is a separate regime from the UAE's with its own implementing regulations
03What we collect
When you submit the contact form we collect whatever you type into it. That is:
- Your first name and last name
- Your email address
- Your phone number, if you provide one
- Your company name, if you provide one
- The service you are interested in, and optionally a budget range and timeline
- The message you write
- The page on this website that the form was submitted from
- The country you selected in the phone field, which we use to compose the international number correctly
- Basic technical information about the request, such as an IP address, held only for rate limiting and abuse prevention
04Why we collect it, and on what basis
We use your details to respond to your enquiry and, if you go on to work with us, to prepare a proposal. Under UK GDPR our lawful bases are:
- Legitimate interests — responding to a business enquiry you sent us, and keeping our own record of it
- Contract — once you become a client, so we can deliver the work
- Legal obligation — where we are required by law to hold or disclose it
- Consent — where you have asked us to contact you about something specific, and you can withdraw it at any time
Other regimes frame the basis differently. Quebec's Law 25 and the Australian Privacy Principles do not use the GDPR's six-basis structure, and the Gulf regimes place more weight on consent. In practice we do the same thing regardless of which applies: we collect your enquiry because you asked us to respond to it, and we do not reuse it for marketing.
If you are in a jurisdiction where consent is the required basis, the act of sending us an enquiry requesting a reply is that consent, and you can withdraw it at any time by asking us to delete your details.
05How long we keep it
Enquiries that do not become projects are deleted within 12 months. Where you become a client, records are retained for the duration of the engagement and then for 6 years, because UK company law requires it.
The Notifiable Data Breaches scheme in Australia has its own assessment and notification duties. We align our own breach process to that clock so we do not become the bottleneck in your 30-day assessment window.
06Who we share it with
We do not sell your data and we do not share it for marketing. We use three processors, all needed to run the site:
- Formspree (https://formspree.io), which receives your enquiry from this website — including one submitted from the website assistant — stores it so we can read and reply to it, and sends us a notification email. Submissions are transmitted from our server rather than directly from your browser, and are stored on infrastructure that may be located outside the UK under a UK adequacy arrangement or standard contractual clauses.
- Google, through the Gemini API, if you use the website assistant. The text you type into the assistant is sent to Google to generate a reply. It is sent from our server, not from your browser, and we do not use it to train our own models or send you marketing. If you would rather not send messages to the assistant, use the contact form, WhatsApp or the phone number and the same conversation happens without that processor involved.
- Our web host and any CDN, which process requests in order to serve the page.
The website assistant. It answers questions using only the content published on this site, and every answer carries a note saying so. It is a language model, so it can be wrong, and it is not a substitute for a conversation with a person — anything involving scope, price or a commitment should go to a human. If you leave your email address or phone number in the assistant, that goes to us through the same route as the contact form, with the same retention and the same rights below.
We do not retain the conversation history on our servers. The assistant is rate-limited per visitor to keep the service available, and the transcript stays in your browser unless you choose to send us your details.
If you are in the UAE or Saudi Arabia, note that we are a UK processor and your data will be processed from the United Kingdom. The UAE PDPL and the Saudi PDPL both place conditions on transfers of personal data outside the country — an adequate level of protection in the destination, or informed consent, with additional conditions for special categories, and in some sectors additional local-storage requirements.
We document what we process and where, and we will tell you before routing any client data outside a jurisdiction you have specified. If your regulatory position requires a different arrangement, say so during scoping and we will treat it as a requirement rather than a preference.
07Cookies and analytics
This site itself sets no advertising cookies and runs no cross-site tracking. It does not use Google Analytics or any advertising pixel.
Formspree may operate a CAPTCHA on submissions it receives, operated by Google, which can set cookies. Because enquiries are submitted from our server rather than directly from your browser, this is not normally triggered; if it is, we will add a consent banner and update this notice. We have not enabled any advertising or cross-site tracking cookies.
08Your rights
Under UK GDPR you have the right to request access to your data, to have it corrected, erased or restricted, to object to our processing it, and to data portability. You also have the right to complain to the Information Commissioner's Office at ico.org.uk. To exercise any of these, email us and we will respond within 30 days.
Other regimes give broadly similar rights under different names, and we honour them all on the same terms:
- United States — access, deletion, correction, portability, and the right to opt out of sale or sharing of your personal information. We do not sell personal information as that term is defined by the CCPA, and we have not done so in the preceding 12 months. Colorado and Connecticut additionally grant the right to opt out of targeted advertising and of profiling with legal effects; we do not engage in either
- Canada — access and correction under PIPEDA, and the additional rights Law 25 provides in Quebec, including the right to withdraw consent and to be informed of any disclosure to a third party
- Australia — access and correction, the right to complain to the OAIC, and the right to have personal information de-identified
- United Arab Emirates and Saudi Arabia — the right to access, correct and delete your data, and to withdraw consent. You also have the right to lodge a complaint with the UAE Data Office or the SDAIA
09Security
Data is transmitted over HTTPS. Access to the systems holding your enquiry is limited to the people at Quorix Digital who need it in order to reply to you.
This site is operated from the United Kingdom. We do not hold copies of your enquiry in the region where you are based unless you ask us to, and if a client's regulatory position requires data to remain in a particular jurisdiction, that becomes a stated project requirement rather than something we assume.
10Getting your own advice
This notice describes what we actually do and names the regimes that may apply to you. It is not legal advice, and it is not a claim that we comply with every regime listed — whether a law applies to you depends on your sector, your volumes and whether you meet a threshold we cannot assess.
If you handle personal data in a regulated way, take your own advice before we process it for you. We will give your counsel the technical detail they need — data flows, retention, sub-processors, cross-border positions — because that is our side of the work and it is what makes advice possible.