Privacy notice · Kwantil

Kwantil is the independent practice of Matthew Tanti, based in Malta. I am the controller of the personal data described here. Contact: matthew@mtanti.com.

This notice covers people I email about research or about Kwantil's services, survey participants, clients and their staff, and visitors to this site.

What I collect, and where it comes from

For research invitations and business emails: your name, work email address, employer and role. I take these from public sources: company websites, regulatory announcements, press articles, conference programmes and public professional profiles. Where I built an address from a company's published format, the email says so.
If you reply or take part in a survey: what you write to me, and your answers.
If you become a client: contact and billing details, and the data you send for an audit.
On this site: the pages are served by Cloudflare, which receives your IP address and browser details with each request in order to deliver them, and an error report from your browser if a page fails to load. The site runs no analytics scripts. The site sets no cookies. The only thing it keeps in your browser is your scroll position, in session storage, so that the back button returns you to the same place; it is cleared when you close the tab.

Why, and on what legal basis

Research invitations and running the survey: my legitimate interest in conducting and publishing practitioner research (GDPR article 6(1)(f)).
Emails about Kwantil's services to people whose work they concern: my legitimate interest in offering relevant services to businesses (article 6(1)(f)). I send these only where the law allows unsolicited business email, and each one offers a one-word opt-out.
If you tick the box asking to hear about Kwantil's research and services: your consent (article 6(1)(a)), which you can withdraw at any time by replying to any message.
Client work: the contract (article 6(1)(b)), and keeping the records the law requires (article 6(1)(c)).
Running this site: my legitimate interest in delivering it securely (article 6(1)(f)).

Your right to object

You can object at any time to emails about Kwantil's services, and I will stop. Reply "no" to any email, or write to matthew@mtanti.com. You can also object to any other use that relies on legitimate interest.

Survey answers

Results are reported only in aggregate, with at least five respondents behind any figure, no company named and no quotes attributed. Raw answers are deleted once the results are published.

Client data

Data sent for an audit is used only for that audit, under a mutual NDA, and deleted when the report is delivered.

The band checker

Files you open in the band checker are processed in your browser. They are not uploaded, and I never see them. The page's security policy blocks it from connecting to any server, which you can check in your browser's developer tools.

How long I keep it

No reply to an invitation and its reminder: deleted within three months of the last email.
If you say no or opt out: only your address, on a do-not-contact list, so that the request holds.
Other correspondence: deleted two years after the last exchange, unless you ask me to delete it sooner.
Survey answers: deleted when the results are published.
Audit data: deleted on delivery. Contracts and invoices: as long as Maltese tax and accounting law requires.
Website data: held by Cloudflare under its own retention periods. I see only aggregate figures, never individual visits.

Who else handles it

Nothing is sold. These providers process data on my behalf: email hosting (Google Workspace) and website hosting (Cloudflare). Where a provider stores data outside the European Economic Area, it does so under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Automated decisions

None. I don't profile anyone.

Your rights

You can ask to see, correct or delete what I hold, restrict how it's used, get a copy in a portable format where that applies, or object to its use. Write to matthew@mtanti.com; I reply within one month. You can also complain to Malta's Information and Data Protection Commissioner (idpc.org.mt) or to the data protection authority where you live or work.

Changes

When this notice changes, the date at the top changes too.