Privacy Policy
Privacy policy
This Privacy Policy explains how NAQ Systems Limited (Q•NAQ, we, us, or our) collects, uses, shares, retains, protects, and otherwise processes personal data in connection with qnaq.com and related applications, communications, events, and services that link to this Policy (the Platform).
Controller: NAQ Systems Limited, company number 812051, 18 Mallow Street, Limerick, V94 N12Y, Ireland.
Privacy contact: legal@qnaq.pro
Website: qnaq.com
Telephone: +353 1 912 8188
Contact and correspondence address: 18 Mallow Street Upper, Limerick, V94 N12Y, Ireland
This Policy applies to Q•NAQ’s processing for users worldwide. NAQ Systems Limited is established in Ireland; Regulation (EU) 2016/679 (GDPR) applies to processing in the context of that establishment irrespective of the individual’s residence. Other privacy laws apply within their own scope. The official English (United Kingdom) version, marked UK, and its faithful translations explain the same processing. The language provisions in Section 1.5 of the Terms of Service apply; language choice does not limit statutory rights. Read this Policy together with the Cookie Policy.
1. Scope and roles
1.1 Q•NAQ as controller
Q•NAQ generally acts as a controller, “business,” or equivalent responsible organisation for Account administration, Platform operation, payment records, security, fraud prevention, product analytics, support, moderation, Q•NAQ’s own marketing, and AI Features whose purposes and essential means Q•NAQ determines.
1.2 Employers and other users as independent controllers
An Employer, recruiter, or other user that obtains personal data through the Platform and independently determines the purposes and means of further processing acts, where applicable law so provides, as an independent controller or equivalent responsible organisation for that processing. Its own privacy notice and legal duties apply. For example, an Employer independently decides how to evaluate, contact, and retain Candidate data and how to make recruitment decisions. Merely being able to view a Publication does not authorise a user to collect or use personal data for an unrelated purpose. If Q•NAQ and another party jointly determine the purposes and means of a processing operation, Q•NAQ will identify and allocate their respective responsibilities as required by applicable law.
Q•NAQ does not control an independent user’s off-platform processing and is not responsible for it merely because initial contact occurred on the Platform. Q•NAQ will, however, enforce applicable Platform rules and comply with duties imposed directly on Q•NAQ.
1.3 Q•NAQ as processor
Q•NAQ acts as a processor or service provider only for processing that it carries out on behalf of a customer, in accordance with that customer’s documented instructions, and without determining that customer’s purposes or essential means. That processing must be governed by the applicable enterprise agreement and data-processing addendum. The parties’ factual roles and applicable law, not the agreement’s label alone, determine whether Q•NAQ acts as a controller, joint controller, processor, or service provider.
1.4 User roles and visibility
An Employer Account is available only to a legal entity of any legal or organisational form duly formed or registered under applicable law, or to a natural person lawfully registered or formally recognised as a sole trader, sole proprietor, private or individual entrepreneur, or equivalent. An unregistered natural person and an organisation that is neither a legal entity nor a lawfully registered business are not eligible for Employer status. A Candidate Account is available only to the natural person it concerns. Authorised personnel may administer an Employer Account on the Employer’s behalf.
Once activated and while active, Job Listings and Candidate Profiles are intended to be viewable through the ordinary Platform interface by every authenticated registered user, without any Employer-versus-Candidate role restriction, subject only to Account status, moderation, geographic or legal restrictions, and technical availability. Restricted contact fields, private messages, application materials, billing data, verification data, and other restricted information are not part of that general visibility. Access without an Account or external indexing occurs only if Q•NAQ actually enables it and clearly informs the publishing user.
2. Personal data we collect
The exact data depends on the user, feature, settings, country, and interaction.
2.1 Account and identity data
Q•NAQ may collect a user's name, username, email address, telephone number, password hash, language, time zone, and Account identifiers.
Q•NAQ may collect age or date-of-birth confirmation and legal-capacity information.
Q•NAQ may collect an organisation name, title, role, work contact details, company number, tax number, authority information, and administrator permissions. Where needed for Employer package eligibility or pricing, this includes the declared employee headcount or size category and proportionate supporting information.
Q•NAQ may collect identity, corporate, authority, sanctions, fraud, or verification records.
Q•NAQ may collect a profile image, avatar, electronic signature, and communication preferences.
2.2 Candidate and professional data
Q•NAQ may collect a Candidate's identity and confirmation that the profile concerns the natural person operating the Candidate Account.
Q•NAQ may collect employment history, education, skills, qualifications, certifications, portfolio information, languages, availability, and professional interests.
Q•NAQ may collect a preferred role, location, remote-work status, compensation expectations, notice period, and work-authorisation information.
Q•NAQ may collect a résumé, CV, Candidate Profile, cover letter, application materials, references, links, and uploaded files.
Q•NAQ may collect nationality or citizenship information only where it is lawfully supplied for work-authorisation purposes.
Q•NAQ may generate or infer information from profile content, such as skills categories, relevance signals, and suggested matches.
2.3 Employer and Job Listing data
Q•NAQ may collect the identity, legal form, registration or equivalent status, hiring entity, industry, size, website, location, contact personnel, and verification status of a legal person or registered entrepreneur.
Q•NAQ may collect a role title, description, qualifications, workplace, compensation, benefits, screening questions, and publication settings.
Q•NAQ may collect candidate searches, filters, saved results, contacts, application status, notes, and workflow activity.
Q•NAQ may collect records showing authority to represent an organisation or advertise a role.
2.4 Content and communications
Q•NAQ may collect User Content, forms, prompts, AI inputs and outputs, translations, feedback, reports, appeals, and moderation submissions.
Q•NAQ may collect Platform messages and related metadata, such as the sender, recipient, time, status, and abuse signals.
Q•NAQ may collect support emails, chat records, survey responses, event information, complaints, cancellation or withdrawal statements and acknowledgements, and dispute records.
Q•NAQ may collect call metadata and recordings where a call is recorded after Q•NAQ has provided any notice and obtained any consent required by applicable law.
2.5 Transaction and billing data
Q•NAQ processes records of free Candidate publication, the three-activation free Employer allowance, optional visibility purchases, Employer Publication Packages, eligible credits, controlled contact functions and other disclosed orders. Relevant records include the product, quantity, applicable headcount category, price, currency, tax, billing details, invoice, activation, refund and payment-dispute data. Candidate payment records relate to optional purchases, not a requirement to pay for basic registration or publication.
Q•NAQ may collect payment-provider customer, payment-method, transaction, authorisation, and fraud identifiers.
Q•NAQ may collect the last four digits of a payment card, card brand, expiry information, or tokenised details made available by the payment provider.
Q•NAQ processes acceptance, checkbox, legal-document version, payment, activation, consumption, availability, expiry, cancellation and acknowledgement records. They distinguish free activations, optional paid enhancements and each Employer package batch’s 90-day activation window from the separate 30-day period of an activated Publication. Limited verified-Employer and allowance-use records help prevent duplicate Accounts resetting the three free activations. Retention follows Section 9 and does not permit indefinite storage of unnecessary verification documents.
Under the current architecture, Q•NAQ does not receive or store the complete payment-card number or card security code. Those details are handled by the payment provider.
2.6 Device, network, and usage data
Q•NAQ may collect an IP address, device and advertising identifiers where permitted, browser type, operating system, application version, language, time zone, screen characteristics, and device characteristics.
Q•NAQ may collect login, clickstream, search, filter, page, feature, session, referral, campaign, and interaction data.
Q•NAQ may collect an approximate location inferred from an IP address or payment evidence and a precise location only if a feature requests it with the required permission.
Q•NAQ may collect cookie, SDK, pixel, local-storage, consent, and preference data.
Q•NAQ may collect diagnostic, crash, performance, security, bot, abuse, and fraud signals.
2.7 Moderation, safety, and legal data
For moderation and safety, Q•NAQ processes reported or detected Content, relevant evidence, reporter and subject identifiers, AI or other automated risk flags, reviewer notes, legal or contractual grounds, decisions, reasons, restrictions, appeals and repeat-abuse records. A risk flag is an indicator for the relevant safety process, not a verified finding that a person committed an offence or is unsuitable for employment.
Q•NAQ may collect identity-misuse, spam, fraud, sanctions, security, and payment-risk signals.
Q•NAQ may collect government, court, regulator, rights-holder, and law-enforcement requests and responses.
Q•NAQ may collect information necessary to establish, exercise, or defend legal claims.
2.8 Sensitive data
User Content may reveal health or disability information, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, sex-life or sexual-orientation information, genetic data, biometric data used for unique identification, criminal-conviction or offence data, or other sensitive data. Q•NAQ does not require such data in an ordinary Publication, and users should not provide it unless the disclosure is necessary, lawful, and appropriately protected.
Q•NAQ does not use sensitive data to infer protected traits or target advertising. Where EU or UK data-protection law applies, Q•NAQ processes special-category data only when both an Article 6 basis and an applicable Article 9(2) condition exist, and it processes criminal-conviction or offence data only under official authority or applicable law providing appropriate safeguards as required by Article 10. Q•NAQ does not rely on contract or legitimate interests alone for those categories. If a feature requires sensitive data, Q•NAQ provides a specific notice and obtains explicit consent or satisfies another applicable statutory condition before the processing begins.
3. Sources of data
Q•NAQ obtains personal data from the sources described below.
Q•NAQ may obtain personal data directly from users, organisation administrators, and authorised representatives.
Q•NAQ may obtain personal data from a user's device and interaction with the Platform.
Q•NAQ may obtain personal data from other users, such as when an employer contacts a candidate or a reporter submits evidence.
Q•NAQ may obtain personal data from payment, identity, fraud, communications, hosting, analytics, AI, security, and support providers.
Q•NAQ may obtain personal data from publicly available professional, corporate, sanctions, regulatory, and website sources where lawful. Q•NAQ does not populate Candidate Profiles or Job Listings by scraping profiles or listings from third-party websites; users register and submit that Content themselves.
Q•NAQ may obtain personal data from integrations that a user chooses to connect.
Q•NAQ may obtain personal data from authorities, courts, rights holders, advisers, insurers, and dispute-resolution bodies.
If a person provides data about another individual, that person must have authority and provide any legally required notice. Q•NAQ will provide the individual with its own notice where applicable law requires it and no exception applies.
4. Purposes and legal bases
The applicable legal basis depends on the purpose and the law governing the processing. Where GDPR applies, including to processing in the context of Q•NAQ’s Irish establishment regardless of the individual’s residence, the table below identifies the Article 6 basis for each purpose. The corresponding UK GDPR bases apply where that law is in scope. Special-category processing also requires an applicable Article 9 condition, and criminal-conviction or offence data must satisfy Article 10 and applicable national law. Additional laws may require consent or other lawful authority for the particular processing. An individual’s location outside the EU/EEA or United Kingdom does not by itself displace GDPR duties arising from the Irish establishment.
| Purpose | Main data | EU/UK legal basis, where applicable |
| Create and administer Accounts; authenticate users; apply settings and permissions | Account, identity, device, verification | Article 6(1)(b) for requested Account creation, authentication, settings, and permissions; Article 6(1)(f) for secure administration and fraud prevention; Article 6(1)(c) only where a specific legal obligation requires verification |
| Publish, host, search, display, and expire Publications | Candidate, Employer, Content, usage | Article 6(1)(b) for requested publication and display; Article 6(1)(f) for search, safety, and Platform integrity; Article 6(1)(a) only for an optional operation expressly based on consent. An applicable Article 9 condition or Article 10 authorisation is also required for covered data |
| Administer free allowances, optional Paid Features and Employer packages; apply disclosed headcount-based package categories; handle payments, invoices, tax, cancellation, refunds and disputes | Account and verified-Employer details, headcount category, free-allowance usage, transaction and billing data, activation and cancellation logs | Article 6(1)(b) for orders and Paid Features; Article 6(1)(c) for applicable tax, accounting, consumer-law, and other statutory duties; Article 6(1)(f) for fraud prevention and the establishment, exercise, or defence of legal claims |
| Enable messages, contacts, support, and service notices | Contact, communications, Account | Article 6(1)(b) for requested messages, contacts, and support; Article 6(1)(f) for service operation, safety, and support; Article 6(1)(c) where a specific law requires a notice or response |
| Rank, recommend, match, translate, draft, and provide AI Features | Profile, Listing, searches, usage, prompts, outputs | Article 6(1)(b) for requested AI Features; Article 6(1)(f) for relevant ranking, safety, and service-improvement operations; Article 6(1)(a) only for optional processing expressly based on consent. An applicable Article 9 condition or Article 10 authorisation is also required for covered data |
| Moderate Content; detect potentially fake or misleading submissions, fraud, spam, abuse, security incidents and unlawful activity using automated, AI-assisted and human processes | Relevant Content, reports, Account, device, network, activity and payment-risk signals, automated flags and review records | Article 6(1)(f) for safety, abuse prevention, security, and enforcement; Article 6(1)(c) where a specific law requires processing. Article 9(2)(f) may additionally apply where special-category data is necessary for legal claims; Article 10 data is processed only where law authorises it |
| Analyse performance and improve the Platform | Usage, diagnostic, de-identified or aggregated data | Article 6(1)(f) for necessary first-party analytics and Platform improvement; Article 6(1)(a) for non-essential cookies or SDKs where consent is required. Data falls outside the GDPR only after genuine anonymisation |
| Send marketing and measure campaigns | Contact, preferences, campaign, optional device data | Consent where required; legitimate interests where direct marketing is lawfully permitted |
| Comply with law, lawful requests, audits, records, and claims | Relevant Account, Content, transaction, legal data | Article 6(1)(c) for specific legal obligations; Article 6(1)(f) for the establishment, exercise, or defence of legal claims. Article 9(2)(f) is an additional condition for special-category data needed for claims; Article 10 data requires applicable legal authorisation |
| Corporate transactions and business continuity | Relevant business, Account, contract, and security data | Article 6(1)(f) for transaction planning, due diligence, business continuity, and completion; Article 6(1)(c) for applicable legal duties |
4.1 Contract necessity
Q•NAQ relies on contractual necessity only where processing is objectively necessary to perform a contract with the individual concerned or to take steps at that individual’s request before entering into a contract. An Employer’s contract does not by itself make all processing concerning its personnel or Candidates contractually necessary. If information is necessary to create an Account, publish a selected item, process an order, or provide a requested feature, failure to provide it may prevent that service.
4.2 Legitimate interests
Q•NAQ’s legitimate interests include operating and improving a professional Platform, preventing fraud and abuse, protecting users and systems, communicating about services, enforcing agreements, defending claims, and understanding service performance. Q•NAQ assesses the specific interest, whether the processing is necessary, and its impact on affected people, including their reasonable expectations. It limits processing and applies safeguards where needed. A person may object on grounds relating to their particular situation as described in Section 12; Q•NAQ must then stop the relevant processing unless it demonstrates compelling legitimate grounds that override that person’s interests, rights and freedoms, or the processing is needed for legal claims. Direct-marketing objections are respected without that balancing exception.
4.3 Consent
Where processing depends on consent, consent may be withdrawn prospectively through the relevant control or by contacting Q•NAQ. Withdrawal does not affect prior lawful processing. Acceptance of the Terms is not consent to optional cookies, marketing, or sensitive-data processing where separate consent is required.
4.4 Legal obligations and claims
Q•NAQ processes personal data where necessary to comply with a specific legal obligation applicable to it, or on an appropriate legal basis to establish, exercise or defend legal claims. For processing governed by GDPR or UK GDPR, a condition under Article 9 for special-category data is additional to a valid Article 6 legal basis. Article 9(2)(f) applies only where the data is necessary for legal claims; it does not make all recruitment processing lawful. Criminal-conviction and offence data must satisfy Article 10 and the applicable national-law requirements.
5. Publications, registered users, and user disclosures
5.1 Visibility
Once activated and while active, the Platform displays Job Listings and Candidate Profiles through the ordinary Platform interface to every authenticated registered user, without any Employer-versus-Candidate role restriction, subject only to moderation, Account status, technical availability, geographic restrictions, and law. General Publication visibility does not include restricted contact fields, private messages, application materials, billing data, verification data, or other information identified as restricted.
5.2 Indexing and caching
Q•NAQ will permit access without an Account or external search-engine indexing only if that form of visibility is actually enabled and the publishing user is clearly informed. Where external indexing is enabled, search engines and archival services may copy or cache a Publication. Q•NAQ may use technical measures to request deindexing after deletion or expiry, but does not control third-party refresh schedules.
5.3 Other users
Registered users may view Publications through the ordinary interface. A user may download, copy, message, or retain personal data only for a genuine recruiting or work-opportunity purpose, another purpose deliberately authorised by the person concerned, or another lawful purpose clearly identified by Q•NAQ. That user becomes independently responsible for further processing. Users must not scrape, resell, enrich, republish, build a database, or use data for unrelated marketing.
5.4 Private communications
Private messages are not displayed publicly. Q•NAQ personnel and providers may access them only where needed for delivery, support, security, abuse investigation, legal compliance, or another disclosed purpose, subject to role-based controls.
6. AI, matching, and automated processing
6.1 AI Features
Q•NAQ uses AI-assisted checks of Content, suspected fake or misleading Accounts and Publications, and relevant behaviour on the Platform to detect possible fraud, spam, abuse and security risks and to support moderation. These checks are directed at those purposes and do not constitute unrestricted monitoring of every aspect of a person’s behaviour. Other AI Features may assist with drafting, formatting, translation, summarisation, recommendation, matching and categorisation, as described for the relevant feature. Inputs, outputs and context necessary for the disclosed function may be processed by Q•NAQ’s own AI systems and computing infrastructure, the AI providers identified in Section 7.2, or both, under the applicable contractual and security arrangements. A risk indicator or AI output is not conclusive proof of misconduct and may be inaccurate.
6.2 No final hiring decision by Q•NAQ
Q•NAQ supplies self-service advertising, discovery and communication functions; users decide whom to contact, assess or engage. Q•NAQ does not source, shortlist, select or place candidates on a user’s behalf and does not make an Employer’s hiring, rejection, promotion, termination or compensation decision. Search ordering, relevance suggestions and paid visibility concern the presentation of Content and are not Q•NAQ’s assessment that a person should be employed. Any legal classification nevertheless follows actual functionality and use.
6.3 Meaningful information
Main ranking and matching inputs may include search terms, filters, location, skills, stated preferences, qualifications, recency, completeness, availability, quality and safety signals, aggregate engagement, and clearly identified paid promotion. The relative weight varies by feature and context.
6.4 Legal or similarly significant decisions
AI-assisted checks and other automated processing may identify risks, prioritise review or contribute to a moderation decision. Whether a decision falls within the restrictions on solely automated decision-making depends on its actual operation and effect, including whether human involvement is meaningful. Q•NAQ may make a decision based solely on automated processing that has legal or similarly significant effects on a person only where applicable law permits it and the required safeguards are in place. Where Article 22 GDPR applies, Q•NAQ must identify the applicable exception, provide the required information about the logic, significance and envisaged consequences, and provide the required opportunity for human intervention, to express a point of view and to contest the decision. Special-category data is subject to the additional restrictions in Article 22(4). A person may challenge a Platform restriction through the appeal route described in the Terms or contact legal@qnaq.pro. This provision does not replace any mandatory right to reasons, review or a remedy.
Under Regulation (EU) 2024/1689 (AI Act), Article 5(1)(c) and (d), prohibited social scoring and prohibited prediction of criminal offending based solely on profiling or personal characteristics are not permitted. These prohibitions do not classify every assessment of specific fraud indicators as criminal-risk prediction.
6.5 Training and improvement
Q•NAQ may use limited data to evaluate, secure, debug, and improve its own services. Q•NAQ will not use, or authorise a provider to use, identifiable Candidate Profile content or private prompts to train a general-purpose model unless Q•NAQ has a valid legal basis and provides any separate notice, consent, or choice required by law. Deidentified or aggregated data may be used where it cannot reasonably be linked back to a person. Q•NAQ will not attempt to re-identify de-identified data and, where applicable law requires it, will contractually prohibit recipients from doing so.
6.6 User responsibility
Employers using automated tools remain responsible for applicable employment notices, human review, accessibility, bias audits, impact assessments, retention, explanation, appeal, and anti-discrimination duties. Q•NAQ remains responsible for obligations imposed directly on Q•NAQ.
7. How we disclose personal data
Q•NAQ discloses personal data only as described below, subject to contracts and law.
7.1 Other users and access without an Account
Active Publication Content is disclosed to every authenticated registered user without an Employer-versus-Candidate role restriction. Contact fields are disclosed only through the relevant contact setting, direct contact unlock, accepted Contact Request, or another expressly identified lawful workflow. Access without an Account or disclosure to search engines occurs only if enabled and disclosed as described in Section 5.
7.2 Service providers
Providers may process data for hosting, content delivery, storage, databases, payment, tax, fraud, identity, communications, customer support, call services, email, analytics, consent management, security, error monitoring, AI, translation, and professional advice.
Q•NAQ uses or may use the providers below as specified for each service. Recipients act as processors or service providers, or as independent controllers for specified payment, fraud-prevention, security or legal-compliance purposes, depending on their role and applicable law. Hosting may use Q•NAQ’s own servers and data centres, third-party infrastructure, or both; current hosting providers include Microsoft Azure.
Q•NAQ currently uses Stripe for payment processing, payment authentication, fraud prevention and transaction records. A payment provider’s risk indicator is one source of information, not conclusive proof that a user or transaction is fraudulent. The provider may have its own legal obligations and privacy notice for processing it carries out as an independent controller.
Q•NAQ uses OpenAI for disclosed AI-assisted generation and other AI Features. Q•NAQ may also use Z.ai, operated by JINGSHENG HENGXING TECHNOLOGY PTE.LTD (Singapore), for disclosed AI-assisted drafting, translation or summarisation permitted by the applicable service terms, subject to Sections 6, 7.2 and 8.
Q•NAQ uses Google Analytics and Google Tag Manager for analytics and tag management only according to the user’s consent and the deployed configuration.
Q•NAQ uses Sentry for error, performance, and security diagnostics.
Q•NAQ uses CloudTalk for telephone or support communications when that channel is used.
Q•NAQ may add or replace providers, migrate to or between its own or third-party servers and data centres, or introduce its own payment functionality. Before a change results in processing that requires new or updated information, Q•NAQ will identify the relevant purposes, data, recipients and any international-transfer safeguards in this Policy or a specific notice, and obtain any consent or take any other step required by law. Introducing Q•NAQ payment functionality does not dispense with applicable payment-services, authorisation, safeguarding, security or data-protection requirements. Cookie Settings describe Technologies actually deployed in the user’s browser or device and do not replace this provider disclosure.
7.3 Professional and commercial recipients
Q•NAQ may disclose necessary data to lawyers, accountants, auditors, insurers, banks, card networks, collection providers, corporate advisers, and transaction counterparties subject to confidentiality and lawful purpose.
7.4 Authorities and rights holders
Q•NAQ discloses personal data to competent authorities where a binding legal obligation or valid enforceable order requires it. It may also disclose specified information where another applicable legal basis permits disclosure and the disclosure is necessary and proportionate, for example to address a serious safety threat, report suspected criminal conduct or establish, exercise or defend legal claims. A request described as being for public order does not by itself authorise unrestricted disclosure. Q•NAQ checks the requesting authority, legal basis, scope and necessity, and limits disclosure to relevant information; it may seek clarification or challenge an improper or excessive request. Specific duties can require prompt reporting, including the Digital Services Act duty concerning suspected criminal offences involving a threat to life or safety. Special-category and criminal-offence data require the additional legal conditions applicable to those data. Requests from authorities outside the EEA are also assessed under the GDPR international-transfer rules, including Article 48; a foreign request or order alone is not a sufficient transfer basis. Q•NAQ gives information to affected people where required, subject to restrictions authorised by law. A request does not automatically extend retention of all Account data.
Relevant rules include GDPR Articles 6, 9, 10, 23 and 48; the Irish Data Protection Act 2018, sections 41, 55 and 60; and Regulation (EU) 2022/2065 (Digital Services Act), Articles 9, 10 and 18. Their application depends on the particular request, data and legal duty.
7.5 Corporate events
Data may be disclosed in connection with financing, due diligence, a merger, reorganisation, insolvency, or a sale or transfer of all or part of the business. Q•NAQ will use confidentiality and purpose controls and provide notice where law requires.
7.6 No unrestricted sale
Q•NAQ does not offer personal data as an unrestricted standalone data product or permit Candidate data to be resold or used for unrelated advertising. It charges for Platform functionality, including controlled direct contact-access events. A statutory sale, sharing, targeted-advertising or data-broker classification depends on the actual disclosures, relationships, consideration and applicable definitions; this Policy does not establish an exemption. A deliberate, informed consumer-directed interaction or other exception is relied on only where its legal conditions are met. Applicable notice, opt-out, consent, registration and other duties remain effective.
Before enabling a paid contact disclosure for a person covered by such a law, Q•NAQ will ensure that the person deliberately selected the relevant contact or visibility setting or otherwise authorised the interaction, or that another valid legal basis permits the disclosure and all applicable notice requirements have been met. Q•NAQ will provide any required notice, opt-in or opt-out, Global Privacy Control recognition, and risk assessment, or will disable the affected disclosure. Payment by another user is never treated by itself as the person’s consent or as a legal basis for disclosure or further processing.
8. International data transfers
Q•NAQ is established in Ireland and may combine its own servers with third-party infrastructure, currently including Microsoft Azure. Core production data is currently hosted in the United States, so personal data originating in the EEA, the United Kingdom, Switzerland or elsewhere may be processed there. Data may also be processed in Ireland, the EEA, the United Kingdom, Singapore where Z.ai is used, and other countries where Q•NAQ, users or providers operate. Protection may differ between countries; applicable data-protection duties continue wherever processing takes place.
NAQ Systems Limited uses Microsoft Azure under Microsoft's standard contractual arrangements. For personal data processed on our behalf within that Azure hosting environment, the applicable Microsoft Products and Services Data Protection Addendum provides the European Commission's Standard Contractual Clauses as the contractual safeguards under Article 46 GDPR for covered restricted transfers, including the current United States production hosting described above. These safeguards apply within the contractual scope of that Addendum. Before making any restricted transfer to a separate overseas recipient, Q•NAQ must establish and document the lawful mechanism applicable to the actual recipient, destination and data. The following requirements continue to apply.
Q•NAQ may rely on an applicable adequacy decision, including a data-privacy framework, only where it covers the destination, recipient and data and any required recipient participation or certification remains valid.
An EEA transfer without adequacy requires an applicable safeguard under Article 46 GDPR, such as the European Commission’s Standard Contractual Clauses, unless a narrowly applicable statutory derogation permits the transfer.
Restricted UK transfers must meet the corresponding UK rules, including, where applicable, the UK International Data Transfer Agreement or UK Addendum and the required assessment; EU safeguards alone do not establish UK compliance.
Another contractual, certification or statutory mechanism may be relied on only where legally recognised for the particular transfer and all applicable commitments and conditions are satisfied.
Q•NAQ may rely on a statutory derogation only for a specific, non-repetitive transfer satisfying its legal conditions, not as a routine substitute for safeguards.
Any required transfer assessment and necessary supplementary technical, organisational or contractual measures must precede the transfer. Transfers must be suspended if the required protection cannot be maintained.
Microsoft's published Data Protection Addendum and available editions can be accessed at https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Microsoft's explanation of its Standard Contractual Clauses-based enterprise-service transfers is available at https://learn.microsoft.com/en-us/compliance/regulatory/gdpr. You may request further information about the safeguards applicable to our Azure processing and, where required, a copy by contacting legal@qnaq.pro. For all actual restricted transfers, Q•NAQ must provide the information required by law at the prescribed time, identifying the applicable mechanism and how to obtain further information or applicable safeguards. Lawful confidentiality redactions must not obscure required information. A request does not replace information Q•NAQ must provide proactively. Mere use of the Platform is not consent to a restricted transfer.
9. Retention
Q•NAQ retains personal data by category and purpose, using the periods and criteria below. Deleting an Account ends its ordinary use and visibility; it does not require deletion of a specific record that Q•NAQ must lawfully retain. Conversely, neither Account deletion nor a possible future authority request creates a general right or legal duty to keep all data for three years. Retained records are limited to what the continuing purpose requires and are not reused for an unrelated purpose without a valid basis and the required information. When the applicable purpose and retention period end, Q•NAQ deletes or irreversibly anonymises the data. Pseudonymised data remains personal data where a person can still be identified.
For ordinary backup, log and support records, the three-year post-deletion ceiling runs from the user's successful submission of deletion of the relevant Account or Content, or Q•NAQ's receipt of a valid erasure request, whichever is first. An item-level deletion affects only that item and related records. Later Account closure, copying, restoration, review or repeated requests do not restart the clock. The ceiling neither postpones required erasure nor authorises retaining unnecessary records before deletion. Specific financial, incident-evidence and preservation records follow their separate rules below; their periods are not extended by adding this ceiling.
| Data or record | Typical retention approach |
| Active Account and current profile | While needed to provide the Account and the services requested by the user. On closure or a valid erasure request, the deletion rule below applies. For an Employer that has used a free publication allowance, Q•NAQ may retain only the minimum Employer identifier and allowance-use count needed to apply that total allowance. This limited record may remain after Account closure while the same non-renewing allowance programme operates and retention remains necessary and proportionate. Q•NAQ reviews that necessity periodically and removes the record when the purpose ends or a valid erasure or objection requires it. Full verification documents and the closed profile are not retained solely for this purpose. |
| Expired Publications | Removed from registered-user and any separately enabled public display when the Publication expires. A copy may remain in the user’s Account where the user keeps it for a requested reuse or reactivation function. After deletion, only a limited record necessary for a separate purpose in this table may be retained. |
| Deleted Account or Content in active systems | Deleted or irreversibly anonymised without undue delay once the erasure request is verified or the data is no longer needed. Q•NAQ identifies any specific retained records and their continuing purpose rather than keeping the entire Account by default. Copies in other users’ messages or records are assessed separately where they remain necessary for those users’ lawful service or legal needs; the deleting user’s profile is not kept active for that reason. Applicable erasure and response deadlines remain effective. |
| Backups | Deleted data is removed from backups through the documented rotation or overwrite cycle, as soon as it is no longer necessary for recovery and security and no later than three years after the user-deletion date defined above. The three-year period is an outer ceiling, not the ordinary duration of every backup cycle or a requirement to preserve a complete Account. Pending removal, deleted data in backups is isolated from ordinary use. Where a backup is restored, applicable deletions must be reapplied; restoration does not restart the retention ceiling. Q•NAQ does not preserve complete backups merely in case an authority might request information. A specific preservation duty may require a separate restricted evidential copy; it does not automatically justify retaining every backup. |
| Orders, invoices, tax and accounting records | Accounting records required by Irish company law: at least six years after the end of the financial year containing the latest date to which the record relates. Tax records and linking documents: generally six years after completion of the relevant transaction, act or operation, subject to the different or extended periods required for late returns, particular tax claims or an ongoing tax inquiry or proceeding. Where a transaction is reported under the Union VAT One Stop Shop scheme, the required scheme records are kept for ten years after the end of the year of that transaction. These obligations apply to the required financial records, not to every profile, message or AI input. Where French Consumer Code Articles L. 213-1, D. 213-1 and D. 213-2 apply to an electronic consumer contract of EUR 120 or more, we retain the contract document and provide access on request. The period is ten years from conclusion for immediate performance; otherwise the document is retained from conclusion until performance and for ten years from performance. This duty concerns the contract record, not every item of Account or profile data. |
| Acceptance, consent, cancellation, and withdrawal evidence | A minimal record of the terms accepted, the order, performance, cancellation or withdrawal and relevant communications is retained while needed for the relationship and, where necessary to establish, exercise or defend a reasonably foreseeable claim, for the applicable claim period. A simple-contract claim under Irish law is generally subject to six years from accrual of the cause of action, not automatically from Account deletion. Evidence of consent is retained while the processing relies on it and thereafter only as necessary to demonstrate past compliance or address a relevant claim. A consent record does not justify retaining all data originally processed under that consent. Where section 116(5)–(6) of Slovak Act No. 452/2021 applies, proof of direct-marketing consent and confirmation of its withdrawal or an objection to direct-marketing calls are retained on a durable medium for at least four years after the relevant withdrawal or objection. This limited evidential retention does not authorise further marketing or retention of the full Account. |
| Payment fraud, chargeback, and security evidence | Limited evidence relating to a substantiated or credibly suspected material fraud, chargeback or security incident may be retained for up to three years after final determination of the incident and any related restriction or timely appeal, where continued retention is necessary and proportionate to prevent recurrence or address the incident. Q•NAQ reviews that necessity at least annually and deletes the evidence earlier when it is no longer needed. A routine review, Account deletion or administrative delay in recording that determination does not restart or extend this period. A longer period applies only to the specific records needed for an active or reasonably foreseeable legal claim, a binding preservation requirement or another identified legal obligation. A provider’s commercial retention rule does not by itself override data-protection law. This three-year period is Q•NAQ’s limited retention policy, not a statutory requirement for all user data. |
| Security, login, device, and technical logs | Ordinary security, login, device and technical logs are retained only for the shortest documented period needed for the security function for which they were collected or an identified investigation, and are deleted or irreversibly anonymised when that need ends. Relevant records concerning an Account or Content deleted by the user are subject to an outer ceiling of three years after the user-deletion date defined above; that ceiling does not justify retaining the entire log history for three years or until Account deletion. Relevant extracts identified during a material incident may be moved to the limited evidence record described above, where its separate trigger, annual review and deletion rules apply; unrelated log history is not retained with them, and the two three-year periods are not added together. Where Brazil’s Marco Civil da Internet Articles 11 and 15 apply, application-access records are retained for six months; the covered date, time, IP address and legally required source-port information are kept confidentially and securely. Where India’s CERT-In Directions apply, relevant ICT-system logs are maintained for a rolling 180 days within Indian jurisdiction. A specific statutory minimum remains applicable. Longer preservation requires a lawful specific basis and is limited to the records concerned. A possible future law-enforcement or other authority request does not by itself justify retaining ordinary logs; actual requests and preservation duties are assessed under Section 7.4. |
| Support and complaint records | While needed to handle the support matter or complaint. After Q•NAQ has given its substantive response, follow-up retention is limited to verifying completion of the particular remedy or resolving a related challenge that has been raised; the routine record and attachments are deleted when those steps are complete and no separate lawful purpose requires the relevant information. A matter is not kept open merely because a future challenge or authority request is possible. These purpose-based endpoints also apply to correspondence from a person without an Account. Where the user deletes the relevant Account or Content, or makes a valid erasure request concerning the correspondence, any necessary surviving routine support record is additionally subject to the three-year outer ceiling measured from the user-deletion date defined above. It is deleted earlier when the purpose ends or erasure is otherwise required. Material evidence needed for a particular claim or legal obligation is retained under the relevant rule above; routine support records and attachments are not automatically retained for a full limitation period. Where section 17/A(7) of Hungarian Act CLV of 1997 applies, the complaint record and a copy of the substantive response are retained for three years. This specific obligation does not establish a three-year retention period for all personal data. |
| Call recordings | Only with the notice and lawful basis, including consent where required, applicable to the recording. Retained until the notified support matter, specified quality review or identified security investigation is completed and then deleted, unless a specific extract is necessary for an identified legal obligation or claim. |
| Moderation and repeat-abuse records | A minimal decision record and the relevant evidence are retained for the applicable restriction and appeal period and until a pending appeal is resolved. Where Article 20 of the EU Digital Services Act applies, the internal complaint route remains available for at least six months from the day the recipient is informed of the decision. Limited evidence of material or repeated abuse may then be retained under the three-year evidence rule above only where the continued risk and lawful basis justify it. Cleared allegations and irrelevant information are corrected or removed; the fact that a tool flagged an item is not itself a finding of misconduct. |
| Optional analytics identifiers | According to Cookie Settings and the applicable consent, with the item-level expiry and deletion controls stated there |
The periods in this table are category-specific limits or legal minimums, as stated; they do not require retention of every item for the longest period. Where several purposes apply, Q•NAQ retains only the fields necessary for the purpose that remains. A legal hold is limited to relevant records, reviewed while the matter continues and lifted when no longer justified. A deletion, objection or restriction request is assessed on its facts; a record may be retained only while a lawful ground or exception applies. Irreversibly anonymous statistics may be retained without identifying a person.
Legal framework: Regulation (EU) 2016/679 (GDPR), Articles 5, 6, 9, 10, 17 and 21; Irish Companies Act 2014, section 285; Taxes Consolidation Act 1997, section 886(4); and Statute of Limitations 1957, section 11(1)(a). For applicable Union VAT OSS transactions, Council Directive 2006/112/EC, Article 369k(2), and Council Implementing Regulation (EU) No 282/2011, Article 63c, govern the scheme records. Criminal-offence information, including allegations, is also subject to the Irish Data Protection Act 2018, section 55.
10. Security and incident response
Q•NAQ uses risk-based technical and organisational measures designed to protect personal data, including access controls, authentication, encryption in transit, provider review, logging, backup, vulnerability management, least-privilege practices, and incident response. No system is completely secure, and users must protect their credentials and devices.
Q•NAQ investigates suspected incidents and will notify affected persons, regulators, customers, or other parties when and within the time required by applicable law. Notice may be delayed or limited where law enforcement or another lawful restriction requires it.
11. Marketing, communications, and preferences
Q•NAQ sends necessary service, legal, billing, security, and Account messages based on contract, legal obligation, or legitimate interests. These messages are not optional while relevant to an active Account or order.
Marketing email, SMS, telephone, push, or similar communications are sent only where Q•NAQ has the permission or other lawful basis required in the recipient’s country. A recipient may unsubscribe through the message or Account settings. Q•NAQ may retain a suppression record to respect the opt-out.
Where Slovak Act No. 452/2021 section 116 applies, we confirm a withdrawal of marketing consent or an objection to direct-marketing calls in a provable form within 30 days. The customer-contact exception for electronic marketing of our own similar goods or services may be used only within its statutory conditions and for no more than one year after the contractual relationship ends. Where Hungarian Act XLVIII of 2008 section 6 requires a natural person’s prior express consent to direct marketing, an existing customer relationship alone does not replace that consent.
Cookie and SDK choices are controlled through Cookie Settings. Optional consent may be withdrawn as easily as it was given.
12. Rights and requests
Depending on the person’s location and applicable law, the rights described below may apply.
A person may ask Q•NAQ to confirm whether it processes that person’s personal data and to explain the processing.
A person may ask Q•NAQ to provide access to or a copy of that person’s personal data.
A person may ask Q•NAQ to correct inaccurate personal data or complete incomplete personal data.
A person may request erasure of personal data.
A person may request restriction of processing or object to processing, including objecting at any time to direct marketing.
A person may receive personal data that the person provided in a structured, commonly used, and machine-readable format and, where applicable, have it transmitted to another controller.
A person may withdraw consent at any time for future processing.
A person may opt out of covered sale, sharing, targeted advertising, or profiling.
A person may limit covered uses of sensitive personal data.
A person may have the right not to be subject to certain solely automated decisions and, where applicable, to obtain human intervention, express a point of view, and contest the decision.
A person may appeal a denied privacy request where local law provides that right.
A person may use an authorised agent where local law permits it.
A person may complain to a competent supervisory authority or seek a judicial remedy.
12.1 Submitting a request
To exercise a right, use an available Platform control or contact legal@qnaq.pro with the right you wish to exercise and enough information to locate the relevant records. Country, state, Account and identity information may be requested only where reasonably necessary and lawful for the particular right. Q•NAQ will use proportionate verification and will not require a new Account or unnecessary identity documentation. A legally recognised browser or device opt-out signal is handled without imposing the verification required for a disclosure or deletion request.
12.2 Response
Q•NAQ responds within the deadline and in the manner required by applicable law. Q•NAQ may extend a deadline, charge a permitted reasonable fee, or refuse to act only where applicable law allows it. Q•NAQ may protect another person’s rights or retain data under a lawful exception. Where required, Q•NAQ will explain the basis for its decision and any available appeal or complaint route. For requests governed by GDPR, Q•NAQ acts without undue delay and within one month, with up to two additional months where necessary because of complexity or number of requests; notice of the extension and reasons is given within the first month. Other statutory periods apply separately where they govern the request.
12.3 Authorised agents
An agent must provide legally sufficient proof of authority. Q•NAQ may verify the person’s identity or confirm authorisation directly except where law prohibits that step.
12.4 Non-discrimination
Q•NAQ will not unlawfully discriminate against a person for exercising a privacy right. A feature may be unavailable where the requested processing is objectively necessary to provide it.
13. Regional information
The following regional provisions supplement the general Policy. They identify principal frameworks, not every law or regulator. References include amendments, implementing regulations, binding guidance, replacement legislation, and local rules in force from time to time. Applicability depends on territorial scope, targeting, establishment, thresholds, data, and activity. A country not named remains covered by its mandatory law.
13.1 Ireland, European Union, and EEA
Q•NAQ is established in Ireland. Regulation (EU) 2016/679 (GDPR) applies to personal-data processing in the context of that establishment whether the individual is inside or outside the EU/EEA. The Irish Data Protection Commission is a competent authority in accordance with its statutory role; lead-supervisory authority status for cross-border processing depends on the GDPR main-establishment and competence rules and is not established by a registered address alone. Individuals may complain to the competent supervisory authority, including in the Member State of their habitual residence, work or the alleged infringement under Article 77. GDPR legal bases, rights, transparency, design, security, processor controls, breach notification, automated-decision protections and Chapter V transfers apply according to their scope. Directive 2002/58/EC and the applicable national ePrivacy rules separately govern cookies and electronic marketing.
Where Article 85 of French Law No. 78-17 applies, you may give, amend or revoke instructions concerning the retention, deletion and communication of your personal data after your death. Specific instructions concerning our processing may be sent to legal@qnaq.pro and require specific consent; acceptance of these Terms alone does not provide that consent.
Restricted transfers are governed by the mechanisms and safeguards described in Section 8. A person may request information about the mechanism applicable to that person’s data, subject to lawful protection of confidential and security-sensitive information.
Irish Data Protection Commission: dataprotection.ie
13.2 United Kingdom
Where in scope, UK GDPR, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR) govern the relevant processing, storage/access and communications. You may send a data-protection complaint to legal@qnaq.pro. Where the UK statutory complaint-handling requirements apply, Q•NAQ acknowledges receipt within 30 days, investigates appropriately and communicates the outcome without undue delay. You may also use the competent UK regulator’s current published complaint channels at ico.org.uk. Restricted transfers require an applicable UK adequacy regulation, the UK International Data Transfer Agreement or Addendum with any required assessment, or another valid mechanism.
If Article 27 UK GDPR requires Q•NAQ to appoint a UK representative, Q•NAQ must appoint one and publish the representative’s identity and contact details in the Platform’s representative directory and UK-facing notice before processing that requires the appointment.
13.3 Switzerland
Where the Swiss Federal Act on Data Protection and its Ordinance apply, Q•NAQ will provide required transparency, handle access, correction, deletion and related claims, evaluate high-risk processing and transfers, and notify the Federal Data Protection and Information Commissioner or individuals where required. Any Swiss representative or local contact must be appointed and published before the legal duty arises.
13.4 United States — California and other states
Where an applicable U.S. state privacy law covers Q•NAQ, residents receive the access, correction, deletion, portability, opt-out, sensitive-data, appeal, and non-discrimination rights provided by that law. Potentially relevant laws include the California Consumer Privacy Act as amended by the CPRA and regulations and comprehensive privacy statutes in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states as they become effective or are amended.
Q•NAQ does not sell personal data as an unrestricted standalone data product. Data-broker status is determined by the actual operations and applicable statute, not a contractual label. Controlled paid contact access and deployed advertising, analytics, disclosure or profiling configurations are assessed under the applicable definitions of sale, sharing, targeted advertising and covered profiling. Where no consumer-directed intentional disclosure or interaction, or other applicable statutory exception, applies and the law covers Q•NAQ, Q•NAQ must provide the required Do Not Sell or Share My Personal Information or equivalent control, honour a valid Global Privacy Control or other legally recognised signal, and complete any required risk assessment. Q•NAQ will not require Account creation or disproportionate identity verification for a browser-level opt-out when prohibited.
Where California law covers Q•NAQ, the notice identifies the categories of personal information collected, sold or shared, and disclosed for a business purpose during the preceding 12 months, the relevant purposes and recipient categories, or accurately states that no category was sold or shared. Requests to know, delete or correct may be sent to legal@qnaq.pro and receive a substantive response within 45 calendar days; a further 45 days is available only where law permits and the extension is explained in time. Shorter statutory periods for implementing an opt-out apply separately. Q•NAQ does not require Account creation or unnecessary identity verification for a legally recognised browser-level opt-out. A refusal includes the reasons and any applicable appeal or regulator route.
Where required for covered sensitive data, sale or sharing, targeted advertising, profiling or automated decision-making, Q•NAQ completes the applicable risk assessment and provides the required pre-use information, access, opt-out and appeal procedures. Employment-related AI or ranking is subject to the impact-assessment, audit, notice, accommodation and human-review duties applying to the actual activity and Q•NAQ’s role. Each requirement applies from its statutory compliance date and within its relevant business, processing and individual scope.
13.5 Canada
Where applicable, Q•NAQ will comply with PIPEDA and substantially similar provincial law, including Alberta and British Columbia private-sector privacy statutes and Québec’s private-sector privacy law as modernised by Law 25. Q•NAQ remains accountable for service providers, uses meaningful consent or another lawful authority, limits collection and retention, provides access and correction, manages breach records and notices, and identifies any required privacy contact. Electronic marketing also follows Canada’s Anti-Spam Legislation.
13.6 Mexico
Where Mexico’s Federal Law on Protection of Personal Data Held by Private Parties applies, NAQ Systems Limited is the controller identified in Section 1. This Policy, including the data, purposes and recipients in Sections 2–4, 7 and Appendix A, provides the corresponding privacy information. Purposes necessary for the relationship are distinguished from secondary purposes, including optional marketing, which may be rejected without affecting services that do not depend on it. Sensitive, financial or asset data requires the statutory form of consent unless a specific exception applies. The information and consent requirements for transfers apply separately; a recipient assumes the applicable obligations and receives the required notice. A simplified notice is also provided at collection where required.
For Mexican access, rectification, cancellation or opposition (ARCO), consent withdrawal or use/disclosure limitation, contact the legal department at legal@qnaq.pro. State your name, response channel and request, with the identity or representation evidence required by law and relevant correction documents. Identifying specific data is not required for an access request. Under LFPDPPP Articles 28–31, the ARCO decision is communicated within 20 business days of receipt and, if appropriate, implemented within 15 business days after the response; each period may be extended once for an equal period where justified. Cancellation may require lawful blocking and retention. You may use the statutory protection procedure before the Ministry of Anti-Corruption and Good Government. GDPR rights applicable through the Irish establishment remain available.
13.7 Brazil
Where Brazil’s Law No. 13,709/2018 (LGPD) applies, processing requires a basis under Article 7 or, for sensitive data, Article 11. Through legal@qnaq.pro you may exercise the applicable rights to confirmation and access, correction, anonymisation, blocking or deletion of unnecessary or unlawful data, regulated portability, deletion of consent-based data subject to lawful retention, recipient and consent information, withdrawal of consent, and opposition where processing without consent infringes the LGPD. Requests are free. Confirmation or access is supplied immediately in simplified form or by a complete clear statement within 15 days, subject to a valid special rule. You may request review of solely automated decisions affecting your interests and information about relevant criteria and procedures, subject to lawful trade-secret protection. Refusals are explained as required. You may petition the Agência Nacional de Proteção de Dados (ANPD), at gov.br/anpd, or use competent consumer or judicial channels. Transfers require an applicable Article 33 mechanism; European safeguards alone do not replace Brazilian requirements.
Where applicable law requires a designated data-protection contact or officer, Q•NAQ publishes the identity and contact details required for the covered processing. Such a designation does not replace the controller’s own responsibilities.
13.8 Other Latin American and Caribbean countries
Country-specific duties may arise under Argentina Law No. 25,326; Chile Law No. 19,628 and enacted reforms according to their effective dates; Colombia Law 1581 of 2012; Peru Law 29733 and its current Regulation; Uruguay Law 18,331; Ecuador’s Organic Personal Data Protection Law; Panama Law 81 of 2019; Costa Rica Law 8968; and privacy, habeas-data, telecommunications, consumer, and cybersecurity rules elsewhere in Latin America and the Caribbean.
For processing governed by Argentina’s Law No. 25,326, requests may be sent to legal@qnaq.pro with proportionate identity evidence. Article 14 access requests are answered within ten calendar days of a verifiable demand; access is free at intervals of at least six months, or earlier where a legitimate interest is demonstrated. Article 16 correction, updating or erasure is completed within five business days of receipt or detection of the error or falsity, subject to lawful exceptions. You may complain to the Agency for Access to Public Information at argentina.gob.ar/aaip or bring a habeas data action. Consent or a specific statutory exception, sensitive-data conditions and Article 12 transfer safeguards apply separately. Other countries in this region retain their applicable notice, rights, consent, transfer and regulatory procedures.
13.9 Australia and New Zealand
Where the Australian Privacy Act 1988 applies, Q•NAQ will follow the Australian Privacy Principles, including open management, notice, collection, use and disclosure, direct marketing, cross-border disclosure, security, access, and correction, and the Notifiable Data Breaches scheme. Complaints may be escalated to the Office of the Australian Information Commissioner. Marketing also follows the Spam Act 2003. Statutory coverage depends on the actual Australian link and applicable coverage rules or exemptions, rather than the country label. The Employer/Business User label does not determine a person’s privacy rights.
Where the New Zealand Privacy Act 2020 applies, Q•NAQ will follow the information privacy principles, offshore-disclosure requirements, access and correction rights, and notifiable privacy breach duties. If a New Zealand privacy officer or another local function is required, it must be operational before the covered activity. Complaints may be escalated to the Office of the Privacy Commissioner.
13.10 India and South Asia
Where applicable, Indian processing is governed by the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 while in force, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 as amended, and the Digital Personal Data Protection Act 2023 and Digital Personal Data Protection Rules 2025 according to their phased commencement notifications.
Indian DPDP duties apply from their respective notified commencement dates; rules still in force continue during the transition. Where the 2011 Sensitive Personal Data Rules apply, collection requires the specified lawful purpose, notice and legally required written consent. You may review supplied information, obtain feasible correction, decline to provide optional information and withdraw consent in writing; a service requiring the information may then be unavailable. Disclosure and overseas transfer must satisfy Rules 6 and 7, including the recipient’s required protection and the applicable permission, contract or legal conditions. Sensitive-data grievances are handled expeditiously and within one month of receipt. GDPR rights arising from the Irish establishment apply independently.
For Indian activities requiring a grievance officer, nodal contact, compliance officer, resident officer or other named function, Q•NAQ provides the responsible person’s name, designation and required address, telephone and email details on the Platform before the covered activity. Requests concerning personal information may also be sent to the legal department at legal@qnaq.pro. Applicable officer-specific complaint and appeal procedures remain available.
Users in Pakistan, Bangladesh, Sri Lanka, Nepal, Bhutan, and Maldives receive the rights provided by applicable constitutional, privacy, cybercrime, electronic-transactions, telecommunications, and sectoral laws. Q•NAQ may provide a country notice, registration, consent, localisation control, or local contact before making a feature available.
13.11 Japan and South Korea
Where Japan’s Act on the Protection of Personal Information (APPI) applies, Q•NAQ specifies utilisation purposes, maintains security and processor supervision, and observes the applicable consent or exception requirements for sensitive information and third-party provision. Through legal@qnaq.pro you may request purpose notification, disclosure of retained personal data and relevant third-party records, correction, addition, deletion, cessation of use or cessation of third-party provision, subject to the statutory conditions. Required disclosure follows your requested method unless a statutory exception applies. Q•NAQ gives required notices of refusal or other alteration and seeks to explain its reasons. Complaints may also be directed to the Personal Information Protection Commission at ppc.go.jp. Foreign provision under Article 28 requires an applicable consent, equivalent-country, safeguards-system or statutory-exception route; the required country, recipient-protection and rights information is supplied before consent or on request as law requires. Equivalent recipient safeguards are monitored and provision is suspended where they cannot be maintained. Required security information and request procedures are made accessible under the APPI.
Where South Korea’s Personal Information Protection Act and Enforcement Decree apply, Q•NAQ will provide granular Korean notice and consent where required, minimise collection, disclose retention, manage processors and overseas transfers, honour access, correction, deletion, suspension, and portability rights where applicable, and comply with incident, representative, and automated-decision requirements. Marketing and communications follow separate Korean rules.
13.12 Mainland China, Hong Kong, Macao, and Taiwan
Where mainland China’s Personal Information Protection Law (PIPL), Cybersecurity Law, Data Security Law and related measures apply, each operation requires a statutory basis and the specified information about its purposes, methods, categories and retention. GDPR legitimate interests alone are not a PIPL basis. Sensitive information, independent recipients, public disclosure and overseas provision require the applicable necessity, specific notice and separate consent safeguards. Required recipient identities, contacts and overseas rights procedures are disclosed before provision. Through legal@qnaq.pro you may exercise applicable access, copying, correction, completion, erasure, restriction or refusal, withdrawal, explanation and qualifying transfer rights; requests are handled promptly, with reasons for refusal and statutory authority or court remedies preserved. Solely automated decisions significantly affecting your rights are subject to explanation and refusal rights; personalised marketing provides the legally required non-personalised choice or easy refusal. Overseas transfers and localisation follow the relevant security assessment, standard-contract, certification or other lawful mechanism and its conditions.
Where PIPL Article 53 requires an institution or representative in mainland China, Q•NAQ establishes or appoints it and files the prescribed identity and contact details with the competent authority. Any further required officer or representative disclosures are provided for the covered processing. Applicable algorithmic-recommendation, deep-synthesis, generative-AI, content and human-resources rules govern the required notices, labels, filings, non-personalised choices, opt-outs and security safeguards according to the actual service.
Hong Kong’s Personal Data (Privacy) Ordinance, Macao’s Personal Data Protection Act, and Taiwan’s Personal Data Protection Act are distinct regimes. Q•NAQ will provide their required collection statements, use limitations, access and correction procedures, direct-marketing controls, security, cross-border safeguards, and local contacts according to scope.
13.13 Singapore and Southeast Asia
Where Singapore’s Personal Data Protection Act 2012 applies, Q•NAQ will maintain an accountable data-protection function, notify purposes, use consent or a permitted exception, provide access and correction, protect personal data and cease retaining it when retention is no longer necessary, assess overseas transfers, notify qualifying breaches, and follow the Do Not Call and Spam Control regimes where applicable.
Country-specific rules also include Indonesia Law No. 27 of 2022 on Personal Data Protection and electronic-system regulations; Malaysia’s Personal Data Protection Act 2010 as amended, including operative 2024 reforms and implementing measures; the Philippines Data Privacy Act of 2012 and implementing rules; Thailand’s Personal Data Protection Act B.E. 2562; and Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP effective from 1 January 2026.
Q•NAQ will separately assess local representative or data-protection-officer duties, electronic-system registration, breach deadlines, consent form, localisation, transfer filing, data-subject rights, language, and regulator contact in Indonesia, Malaysia, the Philippines, Thailand, Vietnam, Brunei, Cambodia, Laos, Myanmar, and Timor-Leste before covered processing.
13.14 Türkiye
Where Türkiye’s Law No. 6698 (KVKK) applies, the Article 10 information is provided separately from explicit consent, with the controller’s identity, collection method, purpose, Article 5 or 6 basis, recipient groups and transfer purposes. Under Article 11 you may learn whether your data are processed, obtain information about purposes and recipients, request correction or lawful erasure/destruction and notification to recipients, object to an adverse result arising exclusively from automated analysis, and seek compensation for unlawful processing. Submit requests through legally permitted methods; the legal contact is legal@qnaq.pro. Requests are resolved as soon as their nature permits and within 30 days. A fee is charged only under the Board’s lawful tariff and is refunded where the request results from Q•NAQ’s error. After first applying to Q•NAQ, you may complain to the Personal Data Protection Board following refusal, an inadequate response or no timely response, within 30 days of learning of the response and in any event within 60 days of your application. International transfers separately require an Article 9 mechanism; European clauses alone are insufficient. Required Turkish standard contracts are notified within five business days after completion of signatures. Controller registration and representation follow the applicable scope and exemptions.
13.15 Middle East and North Africa
Relevant regimes may include the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection and distinct DIFC or ADGM rules where applicable; Saudi Arabia’s Personal Data Protection Law and Implementing Regulations; Israel’s Privacy Protection Law 5741-1981 as amended, including Amendment 13 from its effective date; Qatar Law No. 13 of 2016; Bahrain Law No. 30 of 2018; and privacy or electronic-transactions rules in Kuwait, Oman, Jordan, Egypt, Morocco, Algeria, and Tunisia.
Q•NAQ will assess local controller or representative registration, Arabic, Hebrew or French notice, consent, data-protection officer, localisation, government access, security, marketing, child-data, sensitive-data, and transfer-approval requirements. Where local law requires prior approval or infrastructure that is not in place, Q•NAQ will restrict the affected processing rather than rely on this Policy alone.
13.16 Central Asia and the Caucasus
Applicable frameworks include Kazakhstan’s personal-data and informatisation laws, Uzbekistan’s Law on Personal Data and localisation measures, Georgia’s 2023 Law on Personal Data Protection, and privacy or personal-data rules in Kyrgyzstan, Tajikistan, Turkmenistan, Armenia, and Azerbaijan. Q•NAQ will implement required consent, notice, database registration, localisation, local contact, security, rights, and cross-border controls before covered processing.
13.17 Africa
Where South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA) applies, Q•NAQ will meet the processing conditions, provide notice, maintain security and operator contracts, handle access, correction, objection and deletion, comply with cross-border rules, direct-marketing restrictions, breach notification, and applicable Information Regulator registration or Information Officer duties.
Where Nigeria’s Data Protection Act 2023 applies, Q•NAQ will implement lawful basis, transparency, data-subject rights, security, incident, impact assessment, data-protection officer, registration, and transfer duties according to classification and guidance. Where Kenya’s Data Protection Act 2019 applies, Q•NAQ will assess controller or processor registration, rights, impact assessment, breach, sensitive-data, child-data, and transfer requirements.
Q•NAQ will also assess applicable privacy and data laws in Ghana, Rwanda, Uganda, Tanzania, Senegal, Côte d’Ivoire, and other African countries before targeted processing. A regional reference does not merge distinct national regimes.
13.18 Other jurisdictions and legal change
Q•NAQ will provide a country-specific notice, consent, representative, localisation, registration, assessment, language, or rights mechanism where required before the relevant processing. If a mandatory local rule conflicts with this Policy, it prevails for the covered person and processing. A future Policy update does not retroactively validate processing that lacked a required legal basis or control when it occurred.
Where Moldovan Law No. 195/2024 applies to offering services to, or monitoring the behaviour of, people in Moldova, its applicable rights and safeguards also apply. You may exercise the rights in Articles 12–22 and complain to the National Centre for Personal Data Protection at https://datepersonale.md under Article 72. We respond within the applicable statutory period, ordinarily one month, with an extension of up to two further months where the statutory conditions are met and notice is given within the first month. Under Article 44(2), transfers to the EEA are outside that Law’s Chapter V transfer restrictions; onward transfers outside the EEA require an applicable route under Articles 45–49. An EU–US transfer arrangement is not by itself a Moldovan adequacy decision.
14. Children
The Platform is intended for adults aged 18 or older and is not directed to children. Q•NAQ does not knowingly collect personal data from a child through an Account. If Q•NAQ learns that a child used the Platform contrary to this rule, Q•NAQ will take appropriate steps to restrict the Account and delete data unless retention is legally required.
A person who believes a child’s data has been submitted should contact legal@qnaq.pro.
15. Third-party links and integrations
A user may choose to follow a link or connect an independent service. The third party’s privacy notice controls its independent processing. Q•NAQ is not responsible for that processing, although Q•NAQ remains responsible for integrations and processors to the extent law imposes that responsibility.
16. Changes to this policy
Q•NAQ may update this Policy for legal, product, provider, security, or operational reasons. The effective date will change. Q•NAQ will provide reasonable notice of a material change and obtain new consent where law requires it. A change will not retroactively make previously unlawful processing lawful.
17. Contact and complaints
NAQ Systems Limited
Contact and correspondence address: 18 Mallow Street Upper, Limerick, V94 N12Y, Ireland
Company number: 812051
Email: legal@qnaq.pro
Website: qnaq.com
Telephone: +353 1 912 8188
Please write Privacy Request in the subject line. Q•NAQ will try to resolve a complaint directly. A person may also contact the competent regulator or court without first complaining to Q•NAQ where the law allows.
Appendix A — detailed processing record
This Appendix explains Q•NAQ’s standard processing activities. More specific information is provided with a feature where required.
| Activity | Data ordinarily involved | Purpose and expected result | Typical recipients | Typical retention reference |
| Account registration and login | Name, email, role, credentials, authentication and device signals | Create an Account, authenticate, prevent takeover, apply settings | Hosting, authentication, security, email providers | Account relationship; security logs under Section 9 |
| Employer verification | Legal-person or registered-entrepreneur identity, authority, domain, contacts, employee headcount or size category where relevant, and proportionate verification evidence | Confirm Employer eligibility and the applicable package category; administer the total free allowance; reduce impersonation, duplicate-allowance abuse, fraudulent Listings and payment abuse | Verification, fraud, support, professional advisers | While verification is needed; limited evidence thereafter under Section 9 |
| Candidate Profile | Natural-person identity, professional history, skills, education, location, preferences, uploaded Content, visibility | Publish and make the profile searchable through the registered-user interface | Registered users; public or search engines only if separately enabled and disclosed; hosting and search providers | Active period; archive and deletion under Section 9 |
| Job Listing | Employer identity, role, requirements, location, compensation if supplied, Content | Publish and make the Listing searchable and manageable | Registered users; public or search engines only if separately enabled and disclosed; hosting and search providers | Active period; archive and deletion under Section 9 |
| Contact unlock and Contact Request | User identifiers, contact fields, visibility or authorisation setting, credit or order, request, approval or rejection log | Deliver controlled paid access only where legally authorised, or transmit and administer a discretionary request | Relevant users, payment/support systems | Contract, authorisation, privacy-control and dispute evidence under Section 9 |
| Messaging and applications | Sender, recipient, message, attachment, timestamps, delivery and abuse signals | Deliver communications and maintain safety | Relevant users, hosting, communications, moderation providers | Account need, complaint or legal hold under Section 9 |
| Paid Features and credits | Product, free or paid activation, target Publication, free-allowance usage, Employer package and headcount category, price, currency, tax, provider reference, acceptance, activation, consumption and expiry | Form and perform the order; issue invoices; calculate and report tax; prevent fraud; and resolve or defend disputes | Stripe or payment provider, tax, accounting, fraud, advisers | Contract, tax, fraud and consent periods under Section 9 |
| Cancellation or withdrawal | Consumer name, order or service identifier, electronic confirmation channel, statement content, submission date and time, acknowledgement and outcome | Receive and prove a cancellation or withdrawal request; acknowledge it; stop or reverse affected performance and payment where required | Support, email, billing and payment providers; advisers or authorities where lawfully required | Contract, cancellation, tax, refund and claim periods under Section 9 |
| Premium, VIP, Highlight, Boost | Product status, target, start/end or event, ranking/display logs | Apply the selected visibility treatment and prove delivery | Search/ranking, hosting, analytics limited by consent | Order and dispute evidence under Section 9 |
| AI generation and assistance | Prompt, selected Content, output, safety and quality signals | Generate or improve requested text or other assistive output | AI provider, hosting, safety providers | Until the requested output is delivered and any user-requested history ends; safety or evaluation records until the identified incident is resolved or defined evaluation completed, subject to Section 9 |
| Matching and ranking | Search, filters, profile or Listing attributes, relevance, recency, quality, safety, promotion status | Order or recommend relevant Content and maintain Platform integrity | Search, analytics, safety providers | Operational logs under Section 9 |
| Moderation and notices | Relevant Content and activity, report, automated or AI risk flag, legal or contractual ground, reviewer notes, decision, restriction, appeal and repeat-abuse signals | Address unlawful or prohibited Content and provide redress | Affected users, moderators, advisers, authorities where lawful | Appeal, safety, legal and DSA periods under Section 9 |
| Customer support and calls | Account, correspondence, issue, recordings only after required notice or consent | Diagnose issues, respond, train support where lawfully disclosed | Support, communications, professional providers | Support and call periods under Section 9 |
| Analytics and cookies | Consent, device or browser ID, page, event, campaign, diagnostic data | Measure performance or campaigns only according to category and choice | Analytics, tag, error-monitoring providers | Cookie register and consent records |
| Security and fraud | IP, device, login, rate, payment and behaviour signals, alert, investigation | Detect and prevent attacks, bots, fake Accounts, fraudulent or misleading activity, unauthorised payments and misuse of free allowances, using relevant automated and AI-assisted checks and review | Security, payment, hosting, advisers, authorities where lawful | Risk-based log and investigation periods under Section 9 |
Appendix B — privacy request verification standard
Q•NAQ will verify a request proportionately to the sensitivity and risk of disclosure or deletion. Verification may include confirmation from the Account email, a logged-in control, order or Publication identifiers, and narrowly tailored additional evidence. Q•NAQ will not request an identity document merely because it is convenient, and will redact or delete verification evidence when no longer needed.
Q•NAQ will search systems reasonably likely to contain responsive data, coordinate with processors, protect another person’s rights, explain a full or partial refusal, and provide an appeal or regulator route where required. Removal from registered-user or separately enabled public display, deletion from active systems, expiry from isolated backups, and continued lawful retention of fraud, tax, or claim records may occur on different timelines. Q•NAQ will not represent that a backup was immediately overwritten if it was instead isolated from ordinary use pending scheduled rotation.