Privacy Policy

Who we are and how to contact us

This website is run by Maicol Rulent and Graziano Zinnai, co-founders of Off Quantum Studios, based in Turin (Italy): two individuals who develop this professional project together. Off Quantum Studios is not currently a registered company: it is the name of our project.

We decide together why and how personal data collected through the website, the forms and by email is processed, and we handle it together: both of us have access to the same information. This makes us joint controllers under Article 26 of Regulation (EU) 2016/679 (GDPR).

For questions about this policy or your data, write to support@offquantumstudios.com: it is the single point of contact for both of us.

What this policy covers

This policy covers the offquantumstudios.com website, the enquiries you send us through the form on the Contact page or by email, and the applications you send us through the form on the Careers page or by email.

It does not cover the apps and games we publish, such as Cat Logistics, which have their own privacy policies, or third-party websites reached through links. If an enquiry becomes a project, the processing of data related to it will be described in the documents that govern it; the same applies to a collaboration that starts from an application.

What data we process

Technical browsing data

To show you our pages, your browser automatically sends some technical information: IP address, address of the requested page, browser and operating system type, and referring page. The date and time of the request and the server’s response code are added to this information.

This data is processed by the provider that hosts the website, to deliver the pages and protect them from abuse and cyberattacks. We don’t use it to identify you, to analyse how you browse or for marketing. The website does not use profiling cookies or advertising tracking tools: see the Cookie Policy for details.

Spam check on the forms

On the Contact and Careers pages we use Cloudflare Turnstile to tell people apart from automated programs. Turnstile starts when you first interact with the form, for example when you select a field, and analyses some technical signals from your browser and connection, such as IP address, TLS fingerprint, user agent and the referring website, even if you then don’t send the form. When you send it, our server asks Cloudflare for the result of the check.

Contact form data

The form on the Contact page collects:

• required data: full name, email address, project type and project description;
• optional data: phone number, company, indicative budget and timeline;
• technical data for the form’s security: the form’s language, the time elapsed since the page was opened, a hidden field that helps detect automated submissions, the result of the anti-spam check and your IP address, used for the check and to limit repeated submissions.

The form’s content reaches us as an email in the support@offquantumstudios.com mailbox, with your address set as the reply address. The email contains the data you entered and the form’s language; your IP address, the time taken and the check data are not included. We don’t store enquiries in a database.

Data from applications

If you apply to work with us, through the form on the Careers page or by sending us your CV by email, including on your own initiative, we receive:

• through the form: full name, email address, phone number, area of operation, a short introduction and your CV in PDF format (required, up to 5 MB), as well as the same technical data for the form’s security as the Contact form;
• by email: the data and documents you choose to send us.

A CV sent through the form reaches us as an email attachment, with a file name based on your name; our server only keeps it in memory while sending it and does not store it. We only use this data to assess your application and, where needed, to contact you. Please don’t include in your CV data that the application doesn’t need, such as health information, or other people’s data.

Data you send us by email

When you write to support@offquantumstudios.com, the only address we use for contacts, enquiries and applications, we receive your email address, the name you introduce yourself with and any information you choose to include, attachments included.

Please only share what your enquiry needs, and avoid sending us special categories of data, such as health information, or other people’s data unless necessary.

Why we process data and on what legal basis

We don’t ask for your consent to reply to your enquiries: each processing activity relies on one of the conditions in Article 6 GDPR.

• Replying to requests for information or quotes and preparing a proposal: processing is necessary to take steps at your request prior to entering into a contract (Art. 6(1)(b)).
• Assessing the applications we receive, including unsolicited ones: processing is necessary to take steps at your request prior to entering into a contract (Art. 6(1)(b)); for CVs sent on your own initiative, consent is not required (Article 111-bis of the Italian Personal Data Protection Code).
• Replying to other messages not related to a possible project: our legitimate interest in following up on the messages we receive (Art. 6(1)(f)).
• Protecting the website and the forms from spam, abuse and cyberattacks: our legitimate interest in the website’s security (Art. 6(1)(f)).
• Complying with legal obligations or requests from authorities, where applicable (Art. 6(1)(c)).
• Establishing, exercising or defending legal claims: our legitimate interest (Art. 6(1)(f)).

Providing your data is optional, but the fields marked as required are needed to send the form: without them, we cannot reply to your enquiry or assess your application.

We don’t use your data for promotional messages and we don’t sell it. The anti-spam check, the form checks and the limit on repeated submissions are automatic: if a submission fails, you can always write to us by email. We don’t make decisions based solely on automated processing that produce legal effects or similarly significant effects on you.

Who receives the data

Your data is processed by the two of us. To run the website, the forms and our email, we rely on these providers:

• hosting, protection and spam check: Cloudflare, Inc. (United States), which hosts the website, runs the code that receives the forms, protects it from attacks and provides Turnstile. It acts as a processor (Art. 28 GDPR) under its data processing agreement; to improve bot detection, it also processes some Turnstile data as an independent controller, as explained in its Turnstile privacy addendum;
• sending the form emails: Resend (Plus Five Five, Inc., United States), a processor under its data processing agreement, which receives the message generated by the form, including any CV, and delivers it to our mailbox;
• email: Porkbun, LLC (United States), which hosts the support@offquantumstudios.com mailbox through its Email Hosting service. It acts as a processor (Art. 28 GDPR) under its own data processing addendum, which covers Email Hosting. For this service Porkbun lists Amazon Web Services (United States) as its sub-processor, including for backup copies, which it describes as daily without stating how long they are kept.

Both of us read the mailbox, including from our own devices with email apps, among them the Gmail app for Android, set up with direct IMAP/SMTP access to the Porkbun mailbox: messages are not imported into the Google account or automatically forwarded to personal mailboxes.

We only disclose data to authorities when the law requires it, and we never pass it on to third parties for marketing.

Transfers outside the European Economic Area

Cloudflare and Resend are based in the United States and may process data outside the European Economic Area (EEA); Resend stores data in the United States. These transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, in which both providers participate; their data processing agreements also include the Standard Contractual Clauses approved by the Commission.

Porkbun, LLC is based in the United States and does not participate in the Data Privacy Framework: the transfer of the mailbox’s messages relies on the Standard Contractual Clauses approved by the European Commission, included in its data processing addendum.

You can ask us for more information about these safeguards at support@offquantumstudios.com.

How long we keep data

Data we manage ourselves

Enquiries and applications reach our support@offquantumstudios.com mailbox, which we also read with the email apps on our devices, where we may download their attachments. We delete them ourselves, manually, through a periodic check: there is no automatic deletion.

• Enquiries received through the form or by email: for as long as needed to handle the enquiry and any follow-up. If the enquiry isn’t followed up, we keep the messages, attachments included, for up to 12 months from the last contact about it.
• If the enquiry becomes a project: the data needed to manage it is kept for the duration of the project and, once it ends, for as long as required by the applicable civil-law and tax obligations; the documents governing the project may set more specific periods.
• Applications: if they are not selected, we keep the data, CV included, for up to 6 months from the end of the selection. If an application leads to a collaboration, the data needed to manage it is handled under the documents that govern it.
• Monthly check: every month we review the mailbox, attachments and copies on our devices, downloaded files included, and delete data that no longer needs to be kept, without exceeding the periods above.

We only keep data for longer when this is needed to comply with a legal obligation or to establish, exercise or defend legal claims: in those cases we record the reason and keep only the data needed, for as long as needed.

Data kept by our providers

Some data is kept directly by our providers, which delete it under their own terms, regardless of our monthly check:

• Form messages at Resend: the provider keeps sent messages and delivery logs for 30 days; during that period any attached CVs can also be downloaded from our Resend account.
• Technical browsing data: Cloudflare processes it for as long as needed to deliver the pages and protect the website, according to the criteria in its data processing agreement. We do not copy it into our own records.
• Technical logs of the forms: they only record the outcome of each submission, without personal data, and are deleted after 3 days; automatic logs of individual requests are disabled.

How we protect data

We take technical and organisational measures appropriate to the risk, including:

• an encrypted connection (HTTPS) across the whole website;
• protection of the forms with an anti-spam check, a limit on repeated submissions and checks on the data and on the CV format;
• no database: enquiries and applications from the forms only reach us by email, and the email-sending provider keeps a copy for 30 days;
• technical logs that only record the outcome of each submission, without personal data;
• service access keys kept outside the website’s code;
• access to the support@offquantumstudios.com mailbox and to the website’s service accounts restricted to the two of us, with two-step verification on our provider accounts.

Your rights

At any time, you can ask us:

• to access your data and receive a copy (Art. 15 GDPR);
• to correct or update it (Art. 16);
• to erase it (Art. 17);
• to restrict its processing (Art. 18);
• to receive it in a structured, commonly used and machine-readable format (portability, Art. 20), for the data you provided to us as part of pre-contractual steps;
• to object to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21).

To exercise your rights, write to support@offquantumstudios.com. We reply without undue delay and in any case within one month, which may be extended by two further months for complex requests (Art. 12 GDPR); we may ask for information to verify your identity. Exercising your rights is free of charge, and you can do so in respect of each of us (Art. 26(3) GDPR).

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the country where you live or work (Art. 77 GDPR).

Joint controllership at a glance

As required by Article 26 GDPR, this is how we share our responsibilities as joint controllers:

• we decide together the purposes and means of processing the data collected through the website, the forms and by email;
• we handle the enquiries and applications we receive together, and both of us have access to them;
• either of us can receive and handle requests to exercise your rights: whoever takes on a request informs the other, coordinates what is needed and makes sure the reply is given within the applicable deadlines;
• we choose together the providers that process data on our behalf and work together on any personal data breach, including notifying the supervisory authority and the people concerned when required;
• support@offquantumstudios.com is the common point of contact for anyone who wants to exercise their rights;
• you can exercise your rights in respect of each of us.

Changes to this policy

We will update this policy when the processing described here changes, for example if our providers, forms or statistics tools change. The date of the version in effect is shown at the top of the page and, for significant changes, we will also flag them on the website.