Privacy Policy

1. Controller

Osteam Software B.V. (the Netherlands) develops and operates QMOS. For any privacy question: info@osteamsoftware.nl.

2. Scope

This policy covers the qmos.app website (including its alternative addresses qmos.ai and qmos.osteam.nl), the blog, the demo/quote form and signing in to the QMOS portal.

For content that customer companies enter in the portal (documents, form records, employee and supplier details, etc.) the customer company is the controller; Osteam processes that data only on the company's instructions under our data processing agreement. Please send requests about that content to your own company's QMOS administrator first.

The QMOS mobile app (iOS and Android) is also covered by this policy.

3. Visitor statistics

To understand how the site is used we run Umami on our own server. Umami uses no cookies, stores nothing on your device and does not record your IP address. Only aggregate information is produced: page visited, referring site, browser and device type, country. If "Do Not Track" is enabled in your browser you are not counted at all. There is no statistics script inside the portal.

Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — improving the site.

4. Demo and quote form

The form collects name, company, email, phone (optional), number of users, standards of interest, your message and the page language. We use it to answer your request and prepare a quote; it is forwarded by email to our sales team.

Legal basis: steps prior to a contract (Art. 6(1)(b)). Retention: requests that do not lead to a customer relationship are deleted after at most 24 months.

5. Portal account and use

• Account: name, email, language preference, password (only as an irreversible hash), two-step verification key (encrypted).
• When signing in with Microsoft or Google: account identifier, email and organisation (Microsoft tenant ID or Google Workspace domain). We never receive your password from these providers.
• Session: a session record linked to your browser (at most 12 hours).
• Audit trail: who created, approved or changed which record and when. Kept tamper-evident because it serves as ISO evidence.
• Mobile app (QMOS for iOS/Android): device name, platform and app version; session tokens (stored on the server only as an irreversible hash, and on the device in the operating system's secure storage); if you allow notifications, the notification address (push token). Photos you add to forms are uploaded only when you add them. You can sign out a device in the web portal under My account → My mobile devices.

Legal basis: performance of the contract (Art. 6(1)(b)) and legitimate interest in security and audit evidence (Art. 6(1)(f)). Retention: the account for the duration of the contract; audit trail and approved records for the retention period set by your company.

6. Payments and invoices

Card payments are handled by Mollie B.V. (the Netherlands); your card details never reach us. Invoice and payment records are kept for 7 years as required by Dutch tax law (Art. 6(1)(c)).

7. Cookies

• qmos_session — keeps you signed in (at most 12 hours).
• qmos_locale — your language preference (1 year).
• qmos_sso — completes Microsoft/Google sign-in securely (10 minutes).

We only use cookies that are strictly necessary for the site to work, so no consent banner is shown:

8. Security

To prevent abuse of sign-in and form attempts, your IP address is kept in a short-lived counter that expires automatically within one hour. Uploaded files are virus-scanned on our own server and are not sent to third parties. Connections are encrypted (HTTPS) and each company's data is separated in the database.

9. Location and service providers

• Hetzner Online GmbH (Germany) — server, database, file storage and backups.
• Microsoft Ireland Operations Ltd. — sending system emails; sign-in if you choose Microsoft.
• Google Ireland Ltd. — sign-in only if you choose Google.
• Mollie B.V. (the Netherlands) — payments.
• Expo (650 Industries, Inc., USA), Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) — delivery of notifications if you allow them in the mobile app. Notifications carry no content (only “you have a new notification”); the data transmitted is the notification address and a technical identifier.

The application, database, files and backups are hosted in Germany. We share data only with these providers, and only as far as needed:

10. Transfers outside Europe

Microsoft and Google may process data outside the EU (USA) during sign-in and email delivery. These transfers rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. All other data stays within the EU.

If you allow notifications in the mobile app, Expo, Apple and Google may process your notification address and the content-free generic notification text outside the EU (USA) to deliver it; the same safeguards apply.

11. Backups

The database is backed up every night to object storage in Germany. Backups are used only to restore after a failure and are deleted after 35 days.

12. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. Send your request to info@osteamsoftware.nl; we reply within one month. For portal content, contact your company's QMOS administrator first.

Right to complain: the Dutch Data Protection Authority, Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the supervisory authority in your country.

13. Automated decisions and changes

No automated decisions or profiling take place. When we update this policy, we publish the new version on this page with its date.