Privacy Notice
Effective Date: 22 September 2026
Website, Business Contacts, Customer Users and Platform Transparency - Ireland / EEA
Version 1.6 | Working Draft - Provider/transfer external verification reconciled; counsel review pending
This Privacy Notice explains how QuotaPulse LTD ("QuotaPulse", "we", "us" or "our") handles personal data in connection with our public website, business relationships, customer administration, support activities and the QuotaPulse platform. It also explains the important distinction between personal data that QuotaPulse controls for its own business purposes and personal data that QuotaPulse processes on behalf of customer companies.
QuotaPulse is a business-to-business field-sales management, performance, analytics and gamification service. In most cases, a customer company decides why its reps, managers and end-customer information is entered into or used through QuotaPulse. For that customer-controlled service data, the customer is normally the controller and QuotaPulse is normally its processor. QuotaPulse is separately a controller for personal data it uses for its own purposes, such as business enquiries, customer-account administration, support, service security and QuotaPulse business communications.
This notice is written for Ireland and EEA operations. A separate review is required before active UK launch or publication of UK-specific services.
1. Who We Are
QuotaPulse LTD is an Irish private company limited by shares, company number 820480.
Registered office: Spittle, Ballylanders, Limerick, V35 AP29, Ireland.
Website: quotapulse.com
Privacy and data-protection contact: [email protected]
Business / correspondence address: 51 Bracken Road, Sandyford, Dublin 18, D18 CV48, Ireland.
QuotaPulse has completed a documented assessment under Article 37 GDPR. QuotaPulse's core service involves regular and systematic monitoring, including performance profiling and optional geolocation, but at the present closed-beta scale the assessment does not establish that the monitoring is carried out on a "large scale" within Article 37(1)(b). QuotaPulse therefore currently uses the term "Data Protection Contact" rather than claiming a statutory DPO designation. The assessment is reviewed periodically and on material scale or processing changes.
2. When This Notice Applies and Our Role
This notice applies where QuotaPulse acts as a controller for personal data connected with website visitors, people who contact us or request a demo, customer-company contacts, billing or administrative contacts, support correspondents, prospective business contacts, and QuotaPulse account, security and service-administration activities.
If you use QuotaPulse because your employer, contractor or another customer organisation has provided it to you, that organisation normally determines the purposes of the workplace and performance processing. It is therefore normally the controller, while QuotaPulse processes that information on its behalf under the customer contract and Data Processing Agreement. The same principle generally applies where a customer uses QuotaPulse to store callback information about its own prospective or existing end customers.
Customer companies remain responsible for giving affected workers and other individuals the privacy information required for the customer's own purposes. QuotaPulse also provides platform-specific privacy information so users can understand how the service works, but that does not replace a customer's own workforce or customer privacy obligations.
3. Personal Data We Handle
Business, enquiry and demo data. Name, business email address, company, role, telephone number where supplied, enquiry or demo details, and message content.
Account and administration data. Name or display name, email address, phone where supplied, job title, role, company and assignment information, account identifiers, invitation status, authentication/session information, and account status.
Workforce and performance data processed for customers. Clock-in and clock-out records, timestamps, KPI activities, sales/activity values, campaign, team, site and territory attribution, targets, manager notes, callbacks, commission estimates, achievements, XP, streaks, challenges, league scores and rankings, analytics, reports and derived performance insights.
Callback and end-customer data processed for customers. Where a customer uses the callback feature, QuotaPulse can process an end-customer or prospect name, phone number, email address, Eircode, callback notes, priority, outcome and interaction history. This data is entered for the customer's follow-up purposes and is not ordinary anonymous KPI data.
Demographic data. For sales activities, an optional age bracket may be recorded using fixed ranges such as 18-25 through 71+. QuotaPulse does not collect date of birth through this feature. A bracket can nevertheless become more identifying when combined with precise time, Eircode and other contextual information, so it remains customer-controlled service data.
Location and mapping data. Eircodes, sites, territories, door coordinates, deliberate door-visit records, retained activity/map locations and, where enabled and explicitly activated by a rep, semi-live device location. Section 8 explains the distinction between current live location and historical door/activity records.
Free-text data. Information entered into notes, comments, callback logs, manager notes, target notes, site/contact fields, campaign descriptions and similar fields. Users should not enter unnecessary special-category, confidential or unrelated personal data.
Technical and device data. Authentication/session identifiers, browser storage used by the application, IP address and request/security information available through hosting or authentication infrastructure, device/browser information where generated by the relevant provider, and technical diagnostic information used to operate or secure the service.
Billing and commercial administration data. Customer billing contacts, order details, invoices, subscription records and related accounting information. QuotaPulse does not currently store full payment-card details in the application.
4. Where Personal Data Comes From
Depending on the context, QuotaPulse may receive personal data:
- directly from you, for example when you contact QuotaPulse, request a demo, use support or maintain your own account details;
- from a customer company or its authorised manager when an account is created, configured or administered;
- from reps, managers or other authorised customer users when they record activity, callbacks, notes, assignments or other service information;
- from your browser or device when authentication, security, browser-storage or optional location functionality is used;
- from publicly available business sources, referrals or another business contact where QuotaPulse lawfully obtains professional contact details for business development; and
- from service providers acting for QuotaPulse, for example authentication, hosting and support infrastructure, where those providers return service or security information to us.
Where QuotaPulse obtains controller-side personal data indirectly rather than from you, we will provide the information required by applicable data-protection law within the applicable timeframe unless an exemption applies or you already have the information.
5. What You Need to Provide and What Is Optional
Some information is necessary to provide a requested service. For example, an account requires sufficient identity and authentication information, and a demo request requires enough contact information for QuotaPulse to respond. If required information is not provided, QuotaPulse may be unable to provide that account, response or service.
Other information is optional. Optional age brackets are not required for ordinary account access. Device location is not collected through the semi-live location feature unless the relevant feature is enabled and the user grants browser permission and activates location. Free-text fields should contain only information that is reasonably necessary for the customer's operational purpose.
6. Why QuotaPulse Uses Controller-Side Personal Data
The table below describes the main purposes for which QuotaPulse acts as a controller. Customer-controlled service processing is addressed separately in Section 7.
| Purpose | Data involved | Lawful basis / legitimate interest |
|---|---|---|
| Respond to enquiries, demo requests and prospective-customer discussions | Business contact, enquiry/demo and correspondence data | Legitimate interests in responding to business enquiries and developing QuotaPulse. Contract or pre-contract steps may apply where the individual is personally a party to the contract. |
| Administer customer relationships and authorised accounts | Customer contacts, account/admin data, order and billing-contact data | Legitimate interests in providing and administering a B2B service; contractual necessity where the individual is personally party to the contract; legal obligations where applicable. |
| Authenticate users, protect accounts and operate service security | Account, authentication, session, IP/request and security data | Legitimate interests in providing a secure and reliable service; compliance with legal obligations where applicable. |
| Provide support and investigate technical issues | Account details, correspondence, diagnostic information and the minimum service data needed for the issue | Legitimate interests in supporting customers and maintaining the service; contractual necessity where applicable. |
| Maintain, test and improve QuotaPulse | Limited controller-side technical/service administration data and genuinely anonymised or aggregated service information | Legitimate interests in maintaining and improving the product. Customer-controlled personal data is used only within customer instructions/contractual scope or after genuine anonymisation where appropriate. |
| Accounting, tax, legal claims, fraud prevention and regulatory compliance | Commercial, billing, correspondence, security and relevant account records | Compliance with legal obligations and legitimate interests in protecting QuotaPulse's legal and commercial rights. |
| Business development and direct marketing where used | Professional contact details, company/role and communication preferences | Legitimate interests only where permitted by applicable direct-marketing/ePrivacy law, and consent where consent is required. You may object to direct marketing at any time. |
7. Customer-Controlled Service Data
For customer-controlled service data, QuotaPulse acts on the customer's documented instructions and uses the data to provide, secure, support and maintain the service agreed with that customer. The customer is responsible for establishing its own lawful basis, transparency and employment/workplace rules for the purposes it determines.
Rep live location, when enabled, is available company-wide to authorised manager accounts within the same customer company and is not exposed to peer reps. This visibility is an intentional operational design choice and customer organisations are responsible for ensuring manager access is appropriate for their workforce context.
If a data subject asks QuotaPulse to exercise rights over information that a customer controls, QuotaPulse will ordinarily direct or transmit the request to the relevant customer and assist that customer as required by the Data Processing Agreement.
8. Doors, Mapping and Location
Map centring. The Doors map can use a one-off device-location request to centre the map. This one-off map-centring position is kept in browser state and is not transmitted to QuotaPulse.
Semi-live rep location. Where a customer enables live rep location and a rep explicitly enables browser location while clocked in, the application can use the browser geolocation service to publish the rep's current latitude/longitude, accuracy and capture time. The location is sent in the request body and the server keeps only the latest live-location row for that rep, replacing the previous value rather than building a passive GPS breadcrumb history.
Who can see it. Manager accounts within the same customer company can view current rep location while the feature is enabled. Other reps cannot use the live-location endpoint to view another rep's current position.
When it stops and how long the current row remains. The live watch is torn down when the application is backgrounded or location permission is revoked, and the server-side current-location row is deleted as part of manual or automatic clock-out. If a clock-out does not occur, stale live-location rows are automatically removed after a maximum age of 24 hours. Closing or signing out without clocking out may therefore leave the last published server-side position until a later deletion condition or the stale-row limit is reached.
Historical Doors records. Separate from semi-live GPS, QuotaPulse retains deliberate Doors and door-visit records that associate a rep, timestamp and door/location with canvassing activity. These records are operational history, not a passive GPS trail. They are retained as customer-controlled service data under the customer's retention/offboarding instructions and are not automatically removed merely because a rep becomes inactive.
Customer companies are responsible for ensuring that their use of worker-location features is lawful, necessary, proportionate and appropriately explained to affected personnel.
9. Performance Analytics, Profiling and Automated Decisions
QuotaPulse calculates statistics and rule-based insights from customer-controlled activity and target data. Depending on the feature, this can include performance trends, conversion rates, pacing, comparisons, league rankings, strengths/weaknesses, best-performing times or contexts, alerts and Smart Planner or manager decision-support suggestions. These activities may constitute profiling because information about an identifiable rep is analysed to evaluate aspects of work performance.
QuotaPulse currently uses deterministic or rule-based calculations for these performance features rather than an AI/LLM provider, and QuotaPulse does not make decisions based solely on automated processing that produce legal or similarly significant effects for a rep. The system does not automatically dismiss, discipline, promote, recruit, set pay, pay commission, assign territory or impose performance sanctions. Customer managers remain responsible for reviewing information and making their own decisions.
QuotaPulse may create genuinely aggregated or irreversibly anonymised information for service analysis, benchmarking, product improvement and business reporting. Information is treated as anonymised only where an individual is no longer reasonably identifiable after considering singling-out, linkability and inference risk; removing a name or direct identifier alone is not enough.
10. Browser Storage, Cookies and Website Technologies
At the date of this version, QuotaPulse does not use Google Analytics, advertising pixels, behavioural analytics platforms or application-set tracking cookies. The authenticated application does use browser localStorage and sessionStorage for necessary or functional purposes, including Supabase authentication/session information, offline request queuing, clock-state information and user-interface preferences.
The offline queue can temporarily store the full body of a request that has not yet synchronised. Where a pending callback is created offline, that local device storage can therefore temporarily contain callback name, phone, email, Eircode or related notes until the request is successfully synchronised or otherwise removed.
QuotaPulse self-hosts its web fonts (Bebas Neue, DM Mono and Syne) from its own frontend infrastructure. QuotaPulse does not load Google Fonts, and normal use of the application does not make a network request to a Google font-delivery domain.
A separate Cookie and Local Storage Policy provides the current technology inventory. If QuotaPulse later enables non-essential analytics, advertising or similar tracking, the policy and consent controls will be updated before activation where consent is required.
11. Who Receives Personal Data
Depending on the processing, personal data may be available to:
- the relevant customer company and its authorised users, according to the permissions and visibility rules of the service;
- QuotaPulse personnel who require access for authorised support, security, administration or engineering purposes;
- technology providers used to operate the service, currently including Supabase Pte. Ltd. (a Singapore company) for database/authentication and transactional account email (primary project database region: Frankfurt, Germany); Cloudflare, Inc. for application/Worker/network delivery through global infrastructure; HERE Global B.V. for mapping/geocoding; OpenStreetMap Foundation for basemap map-tile delivery; and GitHub, Inc. for source/CI rather than Customer runtime data;
- professional advisers, insurers, auditors and other professional service providers where reasonably necessary;
- regulators, law-enforcement bodies, courts or other authorities where disclosure is required or lawfully necessary; and
- a purchaser, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
QuotaPulse keeps its provider list under review and updates its privacy and subprocessor documentation when a provider materially changes how personal data is handled.
12. International Data Transfers
Some technology providers operate infrastructure or support functions across multiple countries. Where QuotaPulse transfers personal data outside the EEA in a situation governed by the GDPR, QuotaPulse will use an applicable lawful transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, and any supplementary safeguards required by law.
Details of current providers, processing locations and applicable transfer safeguards are maintained in QuotaPulse's Provider and Subprocessor Register. Information about relevant safeguards, including how to obtain a copy where applicable, can be requested using the contact details in Section 20.
13. How Long We Keep Personal Data
QuotaPulse applies storage-limitation principles and retains personal data only for as long as reasonably necessary for the purpose, customer instructions, contractual obligations, legal requirements, security needs and provider backup cycles. Where a fixed period is not appropriate, the criteria below determine retention.
Customer-controlled service data. Retained while needed to provide the customer service and in accordance with the customer's lawful instructions and the customer contract. The current contract framework provides an ordinary 30-day retrieval/export period following termination before active-system deletion or agreed return/deletion, subject to legal holds and backup rotation.
Rep records after deactivation. A rep can be marked inactive/legacy while historical customer-controlled records remain available to the customer. The current application does not automatically anonymise a former rep when they are deactivated. Any later erasure, anonymisation or retention decision must follow the relevant controller instructions and legal requirements.
Current live location. Only the latest server-side live-location row is retained; it is deleted on clock-out and stale rows are automatically removed after 24 hours. This is separate from deliberate historical door/visit records.
Door visits, callbacks, activities and manager-entered service records. Identifiable Door-visit and Callback records are retained while the customer lawfully requires them for the operational purpose and subject to customer instructions, contract/offboarding and applicable law. When records are deleted or irreversibly anonymised, genuinely anonymised statistics that no longer relate to an identifiable person may be retained indefinitely for reporting and product/business analysis.
Business enquiries and demo requests. Retained only while reasonably necessary to respond, manage the prospective relationship, keep an appropriate business record and respect any objection to further contact.
Customer account, commercial and billing records. Retained for the customer relationship and afterwards where reasonably necessary for account closure, accounting, tax, security, legal claims and record-keeping obligations.
Support correspondence. Retained for a period appropriate to the nature of the issue, including troubleshooting history, security, contractual and legal needs.
Security and provider logs. Retained for periods appropriate to authentication, security, troubleshooting and service operation, taking account of the retention controls available from the relevant infrastructure provider.
Backups. Deleted information may persist temporarily in protected provider backups until normal backup rotation removes it. Backup copies are not intended for ordinary business use and remain subject to access controls.
14. Your Data Protection Rights
Where QuotaPulse is the controller, and subject to applicable conditions and exemptions, you may have the right to:
- obtain access to personal data and a copy of that data;
- correct inaccurate or incomplete personal data;
- request erasure in applicable circumstances;
- request restriction of processing in applicable circumstances;
- receive certain personal data in a portable format where the right to portability applies;
- object to processing based on legitimate interests, including the right to object at any time to direct marketing; and
- withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing.
To exercise rights over data for which QuotaPulse is the controller, contact [email protected]. We may request reasonable information to verify identity and scope the request. Under the GDPR, we will ordinarily respond within one month. Where a request is sufficiently complex or numerous, that period may be extended by up to two further months; if so, we will inform you within the first month and explain the reason for the extension.
For workplace, performance, callback or other data controlled by a QuotaPulse customer, you should normally contact that customer first. QuotaPulse will assist the customer as processor where required.
15. Direct Marketing Choices
Where QuotaPulse sends direct marketing, it will do so only where permitted by applicable data-protection and electronic-marketing rules. You may object to direct marketing at any time by using any unsubscribe mechanism provided or by contacting [email protected]. An objection to marketing does not prevent necessary operational, security, billing, contractual or service communications.
16. Security
QuotaPulse uses technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and disclosure. Measures include authenticated access, server-enforced company and role scoping, company-level data isolation controls, restricted backend write paths, protected secret handling and security controls provided through QuotaPulse's cloud infrastructure.
No internet or cloud service can guarantee absolute security. QuotaPulse reviews security measures as the service changes and will update public security statements where a material control changes.
17. Children
QuotaPulse user accounts are intended for adults aged 18 and over. Customer companies should not knowingly provision QuotaPulse workforce accounts to persons under 18 unless QuotaPulse and the customer have first addressed the applicable legal and product requirements.
The fixed age-bracket field used in sales activity begins at age 18 and does not create a QuotaPulse account for the end customer. Customers remain responsible for ensuring that any end-customer information they enter into callbacks or other fields is lawful and appropriate.
18. Questions and Complaints
If you have a privacy concern, contact [email protected] so that QuotaPulse can investigate it. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or, where applicable, another competent supervisory authority. Contacting QuotaPulse first is not a condition of exercising that right.
19. Changes to This Notice
QuotaPulse may update this notice when the product, processing activities, providers or legal requirements change. The current version and effective date will be published with the notice. Where a change is material for users, QuotaPulse will use an appropriate communication channel, which may include the website, authenticated application or email.
QuotaPulse will review this notice when a material new category of personal data, optional tracking technology, automated-analysis feature, location feature, provider or processing purpose is introduced.
20. Contact Us
QuotaPulse LTD - Company Number: 820480
Website: quotapulse.com
Privacy / Data Protection Contact: [email protected]
Registered office: Spittle, Ballylanders, Limerick, V35 AP29, Ireland
Business / correspondence address: 51 Bracken Road, Sandyford, Dublin 18, D18 CV48, Ireland
Internal Pre-Publication Verification Checklist
- Keep the CRO registered office (Spittle, Ballylanders, Limerick, V35 AP29, Ireland) and business/correspondence address (51 Bracken Road, Sandyford, Dublin 18, D18 CV48, Ireland) distinct in public and contractual documents unless the CRO record is formally changed.
- Maintain the documented Article 37 DPO assessment and reassess it at least annually and whenever monitoring scale, geographical reach, customer/rep population, sensitive-data processing or monitoring functionality materially expands. Continue using "Data Protection Contact" unless the statutory DPO threshold is met or QuotaPulse voluntarily appoints a DPO under the GDPR requirements.
- Maintain the Provider/Subprocessor Register against current provider contracts and subprocessor lists, including Supabase, Cloudflare, HERE and OpenStreetMap. Retain evidence that the applicable Supabase DPA/SCC terms form part of the QuotaPulse account/contract. Fonts are self-hosted by QuotaPulse; Google Fonts has been removed from the recipient inventory following deployment verification that no external font request remains.
- Supabase and Cloudflare console controls have been operationally reviewed. Record the verified settings in the security evidence register and repeat the review after material configuration changes.
- Nominatim has been removed from the production geocoding path; HERE is now the sole Eircode/address geocoding provider, so the personal-developer-email User-Agent issue no longer arises. OpenStreetMap map tiles remain in use for basemap rendering and are recorded separately in the Provider/Subprocessor Register.
- Apply the approved retention position consistently: identifiable door-visit and callback records are retained only while lawfully required for the customer purpose; after irreversible anonymisation, genuinely anonymised statistics may be retained indefinitely.
- Document and test the approved company-wide live-location visibility for authorised managers; peer reps must not receive live-location access.
- Publish working legal routes and implement the Rep first-login privacy disclosure/version acknowledgement and permanent Privacy & Legal links before beta onboarding.
- Implement the approved controller-identity/privacy-contact display in the Rep notice flow. QuotaPulse enquiries route to [email protected]; customer-controlled requests must identify or route to the relevant customer/controller.
- Fix raw Supabase error.message leakage identified in the technical audit before relying on final security wording.
- Document the manual DSAR/export and customer offboarding procedure, including how the contractual 30-day retrieval period is operationally tracked.
- Complete the separate UK privacy/cookie/data-protection review before active UK launch.
Document Status
Version: 1.6
Status: Working Draft - Pre-launch implementation and targeted legal review pending
Effective Date: 22 September 2026
This working draft incorporates the 15 September 2026 source-level technical audit, the 22 September 2026 provider/international-transfer external verification, and the product/operational decisions approved during the launch-compliance review. It should be published only when the linked legal routes and notice-delivery controls are live and the remaining targeted legal-review items are closed.