Privacy & confidentiality

Scope of this Privacy Notice

This Privacy Notice applies when you:

• visit the QSP website;
• contact QSP by email, telephone or through an online form;
• submit a Free Intake request;
• upload documents or other information for review;
• request or receive a quotation;
• act as a contact person for a client, supplier or other business partner;
• or engage QSP to provide professional services.

QSP provides services to businesses and professionals. The website and services are not intended for children or private consumer use.

Data controller

QSP, Quality Support Partner is responsible for the processing described in this Privacy Notice. The registered controller identity will be completed after the KvK registration.

Trading name

QSP, Quality Support Partner

Registered legal name

Pending KvK registration

Legal form

Pending KvK registration

Registered address

Pending KvK registration

KVK number

Pending KvK registration

VAT identification number

Pending registration with the Dutch Tax Administration

Contact

info@qsp-food.eu

The registered details will be added when the KvK and tax registrations are completed.

Personal data we may process

Depending on your interaction with QSP, we may process:

Contact and business information

Your name, job title, employer, business address, country, email address, telephone number and preferred method of contact.

Enquiry and intake information

The information you provide about a product, supplier, facility, process, compliance question or intended assignment.

Submitted documents and files

Specifications, labels, certificates, reports, correspondence, photographs, packaging artwork, supplier files and other supporting information.

These materials may contain personal data relating to employees, supplier contacts, auditors or other individuals. Please only submit personal data that is relevant to the question and that you are lawfully permitted to share.

Do not submit passwords, payment-card details, identity documents, medical information or other sensitive personal data unless QSP has specifically requested it and an appropriate secure transfer method has been agreed.

Assignment and administration data

Quotations, engagement details, instructions, correspondence, reports, invoicing information, payment status and information required for business and tax administration.

Technical website data

IP address, browser type, device information, date and time of access, requested pages, security events and server log information.

Why and on what basis we process personal data

QSP may process personal data for the following purposes:

Responding to enquiries and defining a possible assignment

We use the information provided to understand your question, determine whether QSP can assist and prepare a quotation or proposed scope.

The legal basis is QSP's legitimate interest in responding to business enquiries and managing prospective business relationships. Where you personally enter into a contract, processing may also be necessary to take steps at your request before entering into that contract.

Performing an accepted assignment

We process relevant information to provide agreed checks, assessments, audits, advice, reports and practical support.

Where the contracting party is an individual business owner, the legal basis may be performance of the contract. Where information concerns employees or other business contacts, we generally rely on the legitimate interests of QSP and the client in performing and managing the assignment.

Business and financial administration

We process quotations, invoices, payment records and other administrative information to comply with accounting, tax and other legal obligations.

Protecting QSP and its clients

We may retain and use information where reasonably necessary to maintain information security, prevent misuse, manage complaints, establish facts or defend legal claims. This is based on our legitimate interests in operating and protecting the business.

Consent

Where consent is legally required, for example, for certain future marketing activities or non-essential cookies, we will ask for it separately. Consent can be withdrawn at any time.

Free Intake and document uploads

A Free Intake helps QSP understand the situation and determine a sensible scope or next step. Submitting an intake form or uploading documents does not create an assignment and does not constitute a professional assessment or compliance conclusion.

Uploaded files are:

• checked against permitted file types and size limits;
• stored temporarily outside the publicly accessible part of the website;
• not assigned a public download URL;
• forwarded to QSP through an authenticated business email service;
• and removed from temporary website storage after successful delivery.

If delivery is unsuccessful or an upload is abandoned, the temporary files are deleted no later than 30 days after the unsuccessful delivery or abandoned upload.

Once delivered, the email and attachments become part of the relevant enquiry or project file and are retained in accordance with the retention section below.

These measures reduce risk but cannot make internet transmission completely risk-free. Contact QSP before uploading particularly confidential or sensitive material if a different transfer method may be appropriate.

Where personal data comes from

We normally receive personal data directly from you. We may also receive business contact information from:

• your employer or organisation;
• a QSP client, your supplier or producer;
• another party involved in the supply chain;
• submitted correspondence or supporting documents;
• professional advisers;
• or publicly available business sources.

Who may receive personal data?

QSP does not sell personal data.

Where necessary, information may be shared with:

• website hosting and technical service providers;
• business email, document-storage and office-software providers;
• accounting and administrative service providers;
• IT security and support providers;
• professional advisers, such as accountants, insurers or legal advisers;
• laboratories, auditors, specialists or subcontractors involved in an agreed assignment;
• and competent authorities where disclosure is required by law.

Service providers acting on QSP's behalf may only process information for the agreed purpose and under appropriate contractual and security arrangements.

Current core providers

Website hosting

mijn.host B.V., the Netherlands

Business email

Hostnet B.V., the Netherlands

AI-assisted tools

QSP uses the ChatGPT Pro service provided by OpenAI Ireland Limited for general research, drafting and analysis.

Under the current individual account arrangement, QSP does not intentionally submit personal data relating to clients, suppliers or other third parties, or unredacted confidential client or supplier documents, to this service. Information is anonymised or appropriately redacted before use.

AI-generated output is subject to professional review and is not used as the sole basis for compliance conclusions or decisions concerning products or suppliers.

International transfers

QSP's website hosting is provided by mijn.host B.V. in the Netherlands and its business email service is provided by Hostnet B.V. in the Netherlands.

QSP does not currently use ChatGPT Pro to transfer or process personal data covered by this Privacy Notice outside the European Economic Area.

If QSP introduces AI-assisted processing of client or supplier personal data in the future, appropriate contractual arrangements and international-transfer safeguards will be put in place before that processing begins. This Privacy Notice will then be updated accordingly.

Automated decisions and profiling

QSP does not use solely automated decision-making or profiling that produces legal or similarly significant effects.

Any technological assistance used during an assignment remains subject to professional review. Conclusions and recommendations are not issued solely by an automated system.

How long we retain information

QSP retains personal data only for as long as reasonably necessary for the relevant purpose.

Unless a longer period is required by law or necessary for a legal claim, the intended periods are:

• temporary website uploads: deleted following successful delivery or no later than 30 days after an unsuccessful or abandoned upload;
• intake requests that do not become assignments: 30 days;
• quotations and related correspondence: 7 years;
• assignment files, reports and supporting evidence: 7 years;
• financial and tax administration: generally at least 7 years in accordance with Dutch tax requirements;
• security and server logs: 30 days;
• backup copies: removed through the normal backup cycle within 1 year.

Selected information may be retained longer when necessary to establish, exercise or defend a legal claim or comply with a specific legal obligation.

Security

QSP uses reasonable technical and organisational measures appropriate to the nature of the information and the risks involved.

These may include access controls, account security, protected storage, restricted sharing, software updates, backups and secure configuration of website and email services.

No online or electronic system can be guaranteed to be completely secure.

Your rights

Depending on the circumstances and applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• and withdraw consent where processing is based on consent.

These rights are not absolute. QSP may need to retain or continue processing certain information where there is a legal obligation or another valid legal basis.

Requests can be sent to info@qsp-food.eu. QSP may request additional information where reasonably necessary to verify your identity.

You may also submit a complaint to the Dutch Data Protection Authority or another competent supervisory authority.

Cookies and similar technologies

At the effective date of this notice, QSP does not use advertising cookies, behavioural profiling or non-essential analytics cookies.

The website may use strictly necessary technologies required for security, form processing and technical operation. If QSP introduces non-essential cookies or tracking technologies, the website will request consent where required and this notice will be updated before those technologies are activated.

Changes to this Privacy Notice

QSP may update this Privacy Notice when its services, systems, providers or legal obligations change.

The current version will be published on the website with its effective date. Material changes will not be applied retrospectively where this would be unlawful.