Quentic

GDPR overview

GDPR is applied in detail, although the site never explicitly claims to be GDPR compliant. Quentic GmbH, Gürtelstraße 30, 10247 Berlin, is named as controller, with an in-house data protection officer reachable at privacy@quentic.com and on a dedicated phone line. The privacy policy cites Articles 5, 6 and 32 GDPR alongside the German BDSG, the TMG and the ePrivacy Directive 2002/58/EC, and sets out free rights of access, rectification, blocking, erasure and restriction at any time (Articles 16 et seq.), plus the right to complain to the competent supervisory authority. As a subsidiary of AMCS HoldCo Limited, Quentic declares joint controllership under Article 26(1) with affiliated AMCS companies in certain areas, notably customer support, and publishes the essence of that arrangement. Technical and organisational measures under Article 32 are committed to in §11.2 of the SaaS terms.

Who owns the data?

Under the Quentic SaaS terms of use (§11.4), the customer alone holds the right of disposal over, and ownership of, all customer-specific data: data entered, processed, stored and returned. Quentic states that it exercises no control over the lawfulness of the content stored on the customer's behalf, and §11.3 places responsibility for being entitled to process any personal data introduced on the customer. Technically, each customer receives its own tenant with a separate database and storage area that only that customer can access, and the vendor states that customer data is shared neither with other customers nor with third parties.

Reuse rights

Because §11.4 of the SaaS terms of use gives the customer sole right of disposal over and ownership of all customer-specific data, reuse of that data does not depend on the vendor's permission, and §12.6 a organises its return within four weeks of contract end. On the vendor's side, Quentic's AI governance sets a binding rule that identifiable customer data, prompts and outputs are not used to train or fine-tune AI models; where third-party AI infrastructure is involved, that exclusion is stated to be guaranteed contractually and technically. AI processing takes place solely inside the Quentic hosting environment, on Azure AI infrastructure with control over deployment regions and processing locations, and is shared with neither other customers nor third parties. Aggregated or anonymised use for service improvement remains reserved. Separately, the marketing website's privacy policy names third-party tools including Google Analytics, Facebook Pixel, Lead Tools, Salesforce Pardot, Salesloft, Wistia, Hotjar, Oktopost, Demoboost, Qualified and GoToWebinar, with possible transfers to third countries, notably the United States, under Articles 44 et seq. GDPR.

Data retention & training

Hosting summary

Hosting is entrusted to an established service provider operating high-security data centres certified to ISO 27001, BSI-C5 and others; that provider is not named. Server location depends on the region: customers in EMEA are hosted on servers in Germany, customers in the Americas on servers in the United States, and hosting exclusively within the EU is available on request. The site carries a Software Hosted in Germany badge. Each customer receives a dedicated tenant with its own database and its own storage area. Storage and transmission are encrypted with AES, and the measures listed include redundant power supply and network connections, fire protection, regular security patches, separately held backups, a web application firewall, DDoS protection, strict access control and on-site staff around the clock. Servers are backed up regularly and, in the event of data loss, data is retransferred free of charge under §2.7 of the SaaS terms. The infrastructure behind the AI functions runs on Azure AI, with control over deployment regions and processing locations; data residency is documented and can be communicated to the customer at contract stage.