1. Introduction

Quantum Business Dynamics Ltd, trading as Hybrandr (“we”, “us”, “our”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal information, the circumstances in which we may share it, and your rights under UK data protection law.

It applies to personal information collected through:

• our websites;
• enquiries made to us;
• email, telephone, SMS and other communications;
• consultations and meetings;
• our marketing activities;
• our CRM and business systems;
• contracts with clients and suppliers; and
• our delivery of marketing, technology, automation and consultancy services.

It should be read alongside our Cookie Policy and Terms and Conditions.

This Privacy Policy is intended to reflect the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with other applicable UK privacy and electronic communications legislation.

2. Who We Are

The organisation responsible for this Privacy Policy is:

Quantum Business Dynamics Ltd
Trading as: Hybrandr
Company number: 04782213
Registered office: 126 Shirley street, Hove, BN3 3WG, UK
Website: https://hybrandr.media
Privacy enquiries: info@qbdynamics.co.uk

For personal information that we collect for our own business purposes, Quantum Business Dynamics Ltd will generally act as the data controller.

In some circumstances, particularly where we operate or configure marketing, CRM, communications or automation systems on behalf of a client, we may instead act as a data processor on that client’s instructions.

The respective responsibilities of the parties may be further defined in a Data Processing Agreement or other contractual documentation.

3. The Information We May Collect

Depending upon how you interact with us, we may collect and process the following categories of personal information.

Identity and contact information

This may include:

• name;
• job title;
• organisation;
• business address;
• email address;
• telephone number; and
• other contact information you provide.

Enquiry and communication information

This may include:

• enquiries submitted through our website;
• emails and correspondence;
• telephone enquiries;
• SMS or messaging communications;
• meeting notes;
• consultation information; and
• records of our communications with you.

Client information

Where you become a client, we may process information including:

• contact and account information;
• contractual information;
• project information;
• invoices and payment records;
• service preferences;
• correspondence;
• information necessary to provide our services; and
• records concerning the services we provide.

Website and technical information

Depending upon your cookie preferences and our website configuration, we may collect information such as:

• IP address;
• browser type;
• device information;
• operating system;
• pages visited;
• referral source;
• approximate geographic information;
• website interactions; and
• cookie or similar technology identifiers.

Where consent is legally required for a particular cookie or tracking technology, we will seek that consent before using it.

Marketing information

We may process information concerning:

• your marketing preferences;
• your interaction with our emails or communications;
• services in which you have expressed an interest;
• previous enquiries;
• event or content registrations; and
• consent or objection records.

4. Special Category and Health Information

Our business provides marketing, technology, automation and consultancy services to organisations that may include therapists, counsellors, psychologists, healthcare organisations and other professional practices.

As a result, systems we configure or support may potentially interact with information concerning patients, prospective patients, therapy clients or other individuals.

Information concerning a person’s physical or mental health can constitute special category personal data and requires additional protection under UK data protection law.

Our operating principle is that marketing and administrative systems should, wherever reasonably practicable, be separated from clinical record systems.

We do not require prospective patients or therapy clients to provide detailed clinical information to us for marketing purposes.

Where we design enquiry systems for a client practice, they should be configured to collect only the information reasonably necessary for the relevant administrative purpose.

Clinical notes, diagnoses, treatment records and other information required for the delivery of healthcare or therapeutic services should ordinarily remain within the client’s approved clinical or practice-management environment rather than our marketing systems.

Where special category information is processed through systems operated or supported by us, this should occur only where:

• there is an identified purpose;
• an appropriate lawful basis under Article 6 UK GDPR has been established;
• an appropriate condition under Article 9 UK GDPR has been established where required;
• appropriate security measures are in place; and
• the respective responsibilities of the organisations involved have been established.

Where we act solely on the instructions of a client organisation, that client will normally determine the purpose and lawful basis for the processing.

5. How We Obtain Personal Information

We may obtain information:

Directly from you, for example when you complete a form, contact us, book a consultation, enter into a contract or communicate with us.

From your organisation, where you are an employee, contractor, director or representative of one of our clients, suppliers or business contacts.

Through our websites and systems, including through cookies and similar technologies where permitted.

From publicly available business sources, such as company websites, professional directories, Companies House, professional profiles and other legitimate publicly accessible sources.

From business partners or service providers, where the disclosure is lawful.

From our clients, where they instruct us to process information on their behalf.

6. Why We Process Personal Information

We may use personal information to:

• respond to enquiries;
• arrange consultations or meetings;
• provide quotations and proposals;
• enter into and administer contracts;
• provide our services;
• communicate with clients;
• operate our websites;
• maintain our CRM and business systems;
• manage telephone, SMS, email and digital communications;
• administer payments and accounting;
• provide customer support;
• improve our services;
• measure website and marketing performance;
• protect our systems and prevent misuse;
• establish, exercise or defend legal claims;
• comply with legal and regulatory obligations; and
• conduct appropriate business-to-business marketing.

We will not use personal information for purposes that are incompatible with the purposes for which it was collected unless permitted by law.

7. Our Lawful Bases

UK data protection law requires us to have a lawful basis for processing personal information.

Depending upon the circumstances, we may rely upon:

Contract

Processing may be necessary to enter into or perform a contract with you.

For example, we may need your contact information to provide a service you have purchased.

Legitimate interests

We may process information where necessary for our legitimate business interests or those of another organisation, provided those interests are not overridden by your rights and interests.

These interests may include:

• operating and developing our business;
• responding to business enquiries;
• maintaining client relationships;
• protecting our systems;
• preventing fraud;
• understanding the effectiveness of our services; and
• appropriate business-to-business marketing.

Where required, we will consider the impact of such processing upon the individuals concerned.

Consent

We will rely upon consent where consent is required by law or where we have chosen consent as the appropriate basis.

Where processing relies upon consent, you may withdraw that consent at any time.

Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

Legal obligation

We may process information where necessary to comply with a legal obligation.

Other lawful bases

In limited circumstances, another lawful basis permitted under UK GDPR may apply.

Where special category personal data is processed, we will also identify an appropriate Article 9 condition where required.

8. Marketing Communications

We may communicate with existing and prospective business contacts about services we reasonably believe may be relevant to them, where permitted by law.

Our marketing activities are intended primarily for businesses and professionals.

Depending upon the recipient, method of communication and circumstances, our marketing may rely upon consent or another lawful basis permitted under applicable data protection and electronic communications legislation.

Where required, we will obtain consent before sending electronic direct marketing.

You may ask us to stop sending marketing communications at any time by:

• using an unsubscribe facility provided in the communication; or
• contacting us at info@qbdynamics.co.uk

We may retain a minimal suppression record after an opt-out so that we can respect your preference and avoid contacting you again inadvertently.

Opting out of marketing does not prevent us sending administrative or service communications where these are necessary.

9. Cookies and Similar Technologies

Our website may use cookies, pixels, tags and similar technologies.

Some technologies are necessary for the website to operate. Others may be used for analytics, functionality, personalisation or marketing.

Where UK law requires consent before a technology is stored or accessed on your device, we will seek that consent.

Non-essential cookies and similar technologies requiring consent should not be activated until the appropriate consent has been obtained.

You can change your preferences through our cookie management system.

Further details should be provided in our Cookie Policy.

10. CRM, Automation, Telephone and Messaging Systems

We may use CRM, telephone, SMS, email, scheduling and automation systems to manage communications with clients and prospective clients.

We may also configure or manage such systems for our clients.

These systems may process information such as:

• names;
• contact details;
• enquiry details;
• appointment requests;
• communication history;
• communication preferences; and
• administrative information required to respond to an enquiry.

Where we operate these systems on behalf of a client, our role will depend upon the circumstances and contractual arrangements.

Where we act as processor, we will process the relevant personal information only in accordance with the client’s documented instructions, subject to applicable law.

11. AI-Assisted Systems

We may use artificial intelligence and AI-assisted technology for appropriate business purposes.

Depending upon the service, this may include:

• assisting with administrative enquiries;
• routing communications;
• generating or assisting with draft content;
• analysing non-clinical business information;
• supporting marketing activities;
• assisting with scheduling or enquiry management; and
• improving business processes.

We do not regard AI systems as a substitute for clinical judgement or professional healthcare decision-making.

Where we configure AI-assisted reception or enquiry systems for healthcare or therapy clients, those systems should be designed around clearly defined administrative functions and appropriate escalation boundaries.

Individuals should not deliberately provide detailed medical, therapeutic or other sensitive information to a general marketing or administrative AI system unless the system has specifically been approved and configured for that purpose.

Where legally required, we will provide appropriate information concerning significant automated decision-making.

12. Automated Decision-Making

We do not intend to use solely automated decision-making that produces legal effects, or similarly significant effects, concerning individuals unless appropriate legal requirements have been addressed.

Marketing automation, enquiry routing, appointment administration and similar processes do not necessarily constitute such automated decision-making.

Where we introduce processing that falls within the relevant UK GDPR provisions concerning significant automated decisions, this Privacy Policy and our procedures will be updated accordingly.

13. Sharing Personal Information

We may share personal information with trusted service providers where reasonably necessary to operate our business or provide our services.

Depending upon the services we use, these may include providers of:

• website hosting;
• CRM systems;
• telecommunications;
• email;
• SMS;
• appointment scheduling;
• cloud storage;
• accounting;
• payment processing;
• analytics;
• marketing technology;
• automation;
• artificial intelligence;
• IT support;
• professional advisory services; and
• cybersecurity.

We may also disclose information where required by law, regulatory authority, court order or for the establishment, exercise or defence of legal rights.

Service providers are only given access to information reasonably necessary for their role.

Where appropriate, contractual and data-protection arrangements are put in place with processors.

14. International Transfers

Some technology providers we use may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps required by UK data protection law.

Depending upon the circumstances, these may include reliance upon:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses; or
• another lawful transfer mechanism.

Where appropriate, we will also consider whether supplementary safeguards are necessary.

15. Data Security

We take appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• inappropriate disclosure;
• alteration;
• destruction; and
• other unlawful processing.

Measures may include, where appropriate:

• access controls;
• password management;
• multi-factor authentication;
• encryption;
• restricted user permissions;
• staff procedures;
• secure cloud services;
• system monitoring;
• backups; and
• supplier due diligence.

No internet or information system can be guaranteed to be completely secure. We therefore regularly review the safeguards appropriate to the nature of the information being processed.

16. Data Minimisation

We aim to collect only personal information reasonably necessary for the purpose for which it is being processed.

This principle is particularly important where our systems interact with enquiries to healthcare, counselling or therapy practices.

Marketing and administrative systems should not become repositories for clinical records merely because an individual volunteers clinical information during an enquiry.

Where appropriate, workflows should direct individuals towards the client’s approved clinical or practice-management system.

17. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, contractual and regulatory requirements.

Retention periods depend upon the nature of the information and why we hold it.

For example, we may retain:

• contractual and financial records for periods required by law;
• client correspondence for an appropriate period following the end of an engagement;
• enquiry information for a reasonable period to manage follow-up;
• marketing information until you opt out or the information is no longer relevant, subject to appropriate review; and
• suppression records for as long as reasonably necessary to ensure that marketing objections continue to be respected.

A more detailed internal retention schedule may apply.

Personal information processed solely on behalf of a client will normally be retained or deleted in accordance with the client’s instructions and the applicable Data Processing Agreement.

18. Your Data Protection Rights

Depending upon the circumstances, UK data protection law may give you rights including:

The right to be informed about how your personal information is used.

The right of access to personal information we hold about you.

The right to rectification of inaccurate or incomplete information.

The right to erasure in circumstances where the law provides that right.

The right to restrict processing in certain circumstances.

The right to data portability where the relevant legal requirements apply.

The right to object to certain processing, including direct marketing.

Rights concerning automated decision-making where applicable.

The right to withdraw consent where processing is based upon consent.

These rights are not absolute and may be subject to exemptions or conditions under applicable law.

19. Exercising Your Rights

To exercise a data protection right, contact:

info@qbdynamics.co.uk

We may need to verify your identity before responding.

We will normally respond within the period required by applicable data protection law.

We do not ordinarily charge a fee for exercising data protection rights, although the law permits fees or refusal in certain circumstances involving manifestly unfounded or excessive requests.

20. Complaints

If you have concerns about how we process your personal information, please contact us first so that we have an opportunity to investigate.

You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Further information is available from the Information Commissioner’s Office.

You are not required to contact us before exercising your right to complain to the ICO.

21. Data Breaches

We maintain procedures for identifying, assessing and responding to personal data breaches.

Where a breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the ICO where required by law.

Where a breach is likely to result in a high risk to affected individuals, we will also communicate with those individuals where legally required.

Where we act as a processor for a client, we will notify the relevant controller of a personal data breach in accordance with our contractual and legal obligations.

22. Children’s Information

Our business services are not directed at children.

We do not intentionally use our website to collect personal information directly from children for marketing purposes.

Some of our client organisations may provide professional services to children or families. Where we process information relating to those services solely on behalf of a client, the client remains responsible for determining the purposes and lawful basis of that processing where it acts as controller.

23. Links to Other Websites

Our website may contain links to websites operated by other organisations.

Those organisations are responsible for their own privacy practices. We recommend reviewing their privacy information before providing personal information.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• our services;
• our technology;
• our suppliers;
• our processing activities; or
• applicable law and regulatory guidance.

The date at the top of this Policy indicates when it was last updated.

Material changes may be communicated through our website or by another appropriate method where necessary.

25. Contact Details

Questions about this Privacy Policy or our use of personal information should be sent to:

Quantum Business Dynamics Ltd
Trading as: Hybrandr
Registered office: 126 Shirley Street, Hove BN3 3WG, UK