Legal

Privacy Policy

Last updated: 1 June 2026

Version: 1.1.0

1. Who We Are

Quorate is provided by Zero Drift Ltd (company number 17202217, registered office The Glass House, Rhododendron Avenue, Meopham, Gravesend, England, DA13 0TT). We are the data controller for your account information and a data processor for the data your organisation holds in Quorate.

2. What We Collect

  • Account data: Name, email address, password (hashed)
  • Organisation data: Meeting records, minutes, decisions, documents — processed on behalf of your organisation
  • Usage data: Login times, pages visited, feature usage (no PII)
  • Payment data: Processed by Stripe — we do not store card details

3. Legal Basis

  • Contract: Processing necessary to provide the Platform
  • Legitimate interest: Usage analytics, platform improvement
  • Consent: Marketing communications (opt-in)
  • Legal obligation: Financial records retention

4. Data Sharing

We share data only with the sub-processors listed on our Sub-processor List, and only for the purposes listed there.

4a. International Transfers

Organisation data and account data are stored and processed in the United Kingdom (AWS, London region, eu-west-2). Requests reach Quorate through Amazon CloudFront edge locations in North America, Europe and Israel, and static files we serve may be cached there. Payment details are processed by Stripe, which may transfer them to the United States and other countries. Where personal data leaves the UK, the transfer relies on UK adequacy regulations where they apply (including the UK Extension to the EU–US Data Privacy Framework for certified recipients), or otherwise on the International Data Transfer Addendum to the EU Standard Contractual Clauses in the recipient's data processing terms. If your organisation turns on an optional integration listed on our Sub-processor List, that provider's transfer terms apply as described there.

5. Data Retention

  • Active accounts: data retained while subscription is active
  • Cancelled accounts: data deleted 90 days after cancellation
  • Financial records: retained for 7 years (legal requirement)

6. Your Rights

Under UK GDPR, you have the right to:

  • Access your data
  • Rectify inaccurate data
  • Erase your data (right to be forgotten)
  • Data portability
  • Object to processing
  • Lodge a complaint with the ICO

7. Contact

Data protection enquiries: privacy@quorate.app