Privacy notice.
Last updated 2 October 2026. Written under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act of 6 January 1978 as amended (Loi Informatique et Libertés).
We collect as little as we can, keep it no longer than we must, and never sell it. This page says what we hold, why, for how long, and what you can do about it.
1. Who is responsible
The data controller for this website and for our commercial relationships is The Quality Bridge, France. You can reach our data protection contact at privacy@thequalitybridge.com.
2. Two different roles
We act in two capacities, and it matters which one applies to you.
As controller for visitors to this website, people who contact us, and the named contacts at companies we do business with. Sections 3 to 7 cover this.
As processor for the personal data that appears inside the platform: the names, roles, email addresses and actions of the people who use The Quality Bridge on behalf of a CMO, an intermediary or a MAH. That data is processed on the instructions of the licensee — the company that holds the licence and invited the others onto it — which is the controller, under a data processing agreement that complies with Article 28 GDPR. Section 8 covers this.
3. What we collect as controller, and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, company, role, work email and message sent through the contact form or by email | To reply to you, arrange a walkthrough and send the material you asked for | Steps at your request before entering a contract (Art. 6(1)(b)); our legitimate interest in answering enquiries (Art. 6(1)(f)) | Three years from our last exchange, then deleted |
| Business contact details of people at customer and partner companies | To manage the contract, invoicing, support and required notices | Performance of the contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) | For the life of the contract, then the statutory limitation periods (up to ten years for accounting records under Article L.123-22 of the French Commercial Code) |
| Server logs: IP address, browser, pages requested, time | To keep the site secure and diagnose faults | Our legitimate interest in security (Art. 6(1)(f)); Article 6-II LCEN | Twelve months |
We do not collect special-category data on this website and we ask you not to send any. We do not make automated decisions about you.
4. Cookies
This website sets no advertising, analytics or tracking cookies and loads no third-party trackers. The only cookies it may set are strictly necessary for the site to work, which under Article 82 of the French Data Protection Act do not require consent. The platform, once you sign in, uses a session cookie for authentication only.
5. Who sees your data
Our own staff, on a need-to-know basis. Processors who host our website and email and who are bound by contract to act only on our instructions; the current list is available on request. Public authorities where the law requires it. We never sell or rent personal data and never share it with advertisers.
6. Where your data is kept
Our website and platform are hosted in the European Union. If a processor we use has to access data from outside the European Economic Area, we rely on an adequacy decision of the European Commission or on the Commission's Standard Contractual Clauses, with supplementary measures where needed. You can ask us for a copy of the safeguards in place.
7. Your rights
You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where consent is the basis. Under Article 85 of the French Data Protection Act you may also give us instructions on what happens to your data after your death. To exercise any of these rights write to privacy@thequalitybridge.com; we may ask you to confirm your identity, and we reply within one month. If you are not satisfied with our answer you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
8. Personal data inside the platform
When you use The Quality Bridge as a CMO, intermediary or MAH user, the platform records your name, company, role, email address and the actions you take in a workspace: uploads, confirmations, questions, answers, decisions and acknowledgements, each with a time stamp. This is what makes the audit trail attributable, which is the point of the platform and a requirement of good manufacturing practice (EU GMP Annex 11).
For this data the controller is the licensee. We process it only on that licensee's documented instructions, under a data processing agreement, and we retain it for as long as their contract and its quality agreements require, after which it is returned or deleted. One company's users never see another company's thread. If you want to exercise your rights over data held inside the platform, contact the licensee that invited you; we will assist them in responding.
Invited users pay nothing to use the platform. Their data is never used for any purpose other than operating the platform for the licensee that invited them.
9. Security
The measures we apply are listed item by item on Trust and security. If a personal-data breach occurs we notify the CNIL within 72 hours where required and inform the people affected without undue delay when the breach is likely to result in a high risk to them (Articles 33 and 34 GDPR).
10. Changes
If we change this notice we will update the date at the top and, where the change is material, tell our customers directly.