Privacy Policy

Effective date: 2026-04-30; §1.2, §3.5, §5 and §5.1 as updated, 2026-10-15 Last updated: 2026-10-15 Version: 2.1

The 2026-10-15 update (§1.2, §3.5, §5, §5.1) concerns visitors to our public website who accept advertising cookies. It does not change how we process customer data in the QMS Nordic application, and it takes effect on 2026-10-15.

This Privacy Policy describes how Aitech International ApS — the Danish company that owns, develops, and copyright-protects the QMS Nordic platform ("QMS Nordic", "we", "us") — collects, uses, and discloses information when you visit our website (qmsnordic.com), sign up for our service, or use the QMS Nordic platform.

If you are a customer of a company that uses QMS Nordic (an end-user of your employer's tenant), this policy applies to the data we collect about you in our role as processor acting on your employer's instructions. For those purposes the controller is your employer, and you should also consult their privacy notice. Where QMS Nordic acts as a controller (for our marketing site, our own employees, our sales contacts), this policy applies in full.

---

1. Information we collect

1.1 Information you give us

• Account information — name, business email, job title, work phone, company name, country, business registration number, billing address.
• Authentication information — password (stored as bcrypt hash), WebAuthn public credentials, IdP-issued user identifier.
• Customer-uploaded content — anything you choose to put into QMS Nordic: controlled documents, complaints, CAPA records, training records, supplier records, helpdesk tickets, etc. As processor, we store this on your tenant's behalf.
• Communications — emails, support tickets, chat messages you send us.

1.2 Information we collect automatically

• Usage data — pages visited, actions taken, timestamps, audit-log events, feature usage. QMS Nordic's internal audit log captures this in detail because that is the product.
• Device data — IP address, browser type and version, operating system, screen size, language preference.
• Cookies and similar technologies — session cookies for authentication; on our public pages, and only if you accept, the LinkedIn Insight Tag's advertising cookies. Both are described in section 5.

1.3 Information we receive from third parties

• Identity providers — when you sign in via Google Workspace, Microsoft Entra ID, or Okta, we receive your name, email, and IdP-issued user id.
• Stripe — when you pay, we receive billing-name, billing-email, billing-address, and a customer/subscription id. We never see your card number.

2. How we use information

We use the information for the following purposes:

We do not use your customer-uploaded content to train AI models. Training-on-inputs is contractually disabled with our AI sub-processors.

3. Disclosures

We share information only as set out in this section.

3.1 With sub-processors

We use a small set of carefully-selected vendors to operate the service. The current list, with role and location, is at qmsnordic.com/legal/sub-processors. Each sub-processor is bound by a written agreement with data-protection obligations substantially equivalent to ours.

3.2 With your employer (if you are an end-user)

If we hold information about you because your employer uses QMS Nordic, we share it with your employer per their tenant configuration. They are the controller of that data.

3.3 In a corporate transaction

If Aitech is involved in a merger, acquisition, financing, or sale of all or substantially all of its assets, the personal data we hold may be transferred to the acquiring entity, subject to the same protections.

3.4 To comply with law

We may disclose personal data when we believe in good faith that disclosure is required by law, court order, or legal process. We will challenge overbroad requests where appropriate and notify the affected customer where legally permitted.

3.5 Selling and sharing personal data

We do not sell personal data. If you accept advertising cookies on our public pages, we share data with LinkedIn to measure our LinkedIn ads and to show them to people who have visited our site (section 5.1). Under California law (CCPA / CPRA) that may count as "sharing" for cross-context behavioural advertising. To opt out, click "Decline" in the cookie bar, or withdraw at any time under "Cookie settings" at the bottom of our pages. Without your consent nothing is shared with LinkedIn. We never share data from inside the QMS Nordic application for advertising.

4. International transfers

We are based in Denmark and store EU customer data in the EU by default. Some sub-processors operate in the United States; we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant) to provide an appropriate transfer mechanism. The full list of sub-processors, their location, and their applicable transfer mechanism is at qmsnordic.com/legal/sub-processors.

5. Cookies and similar technologies

Inside the QMS Nordic application we use only the cookies needed to run the service. On our public pages, and only if you accept, we also use LinkedIn's advertising cookies:

Cookies that are not strictly necessary are set only after you accept them in the cookie bar. You can change your choice at any time with "Cookie settings", which is on every page that shows the bar.

5.1 LinkedIn Insight Tag

On the public pages of qmsnordic.com, and only if you click "Accept" in the cookie bar, we load the LinkedIn Insight Tag. It is a script provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"). The public pages are the home page, the demo-request page, the free tools' index and these legal pages. We do not load it:

• inside the QMS Nordic application;
• on the sign-in pages or the support desk;
• on any page reached by a link that carries a token;
• on the MDR classification tool, because what you click there are your answers about your device.

What it collects. When the tag runs, your browser sends LinkedIn:

• the address and title of the page you are viewing (not the address of the page you came from: our site does not pass that on to other sites);
• which links and buttons you click on it (their label and position on the page);
• your IP address;
• information about your device and browser, for example browser type and screen size;
• the time of the visit;
• the identifiers LinkedIn keeps in the cookies listed above.

If you are signed in to LinkedIn, LinkedIn may link this to your LinkedIn account. Before the tag can read a page's address, we remove everything in it after the "?" except advertising-campaign tags (utm_…, li_fat_id). If you request a demo, we also tell LinkedIn that a demo request was made (a "conversion"). We do not send LinkedIn your name, e-mail address, company or anything else you type into our forms. Clicks on "Decline" and "Cookie settings" are not sent.

Why. For two purposes:

1. To measure how many demo requests come from our LinkedIn ads.
2. To show our ads on LinkedIn to people who have visited our website ("retargeting").

LinkedIn gives us only aggregated reports. We cannot see which LinkedIn members visited our site.

Legal basis. Your consent, under Article 6(1)(a) GDPR. Storing and reading cookies on your device is based on your consent under the ePrivacy rules (in Denmark, bekendtgørelse nr. 1148 af 9. december 2011). If you click "Decline", or make no choice, the tag is not loaded and nothing is sent to LinkedIn.

How long your choice lasts. We keep your answer in your browser for 12 months, and then ask again. We also ask again if what we ask your consent for changes.

Withdrawing consent. You can withdraw your consent at any time, as easily as you gave it. Click "Cookie settings" on any page that shows the cookie bar, then click "Decline". The tag stops at once, the page reloads without it, and we delete the cookies and browser storage it set on qmsnordic.com (li_adsId, li_giant, li_fat_id, li_hem). If you have other qmsnordic.com tabs open, the tag stops there too. LinkedIn's own cookies on linkedin.com cannot be removed by our site. You can delete them in your browser's settings, or manage them in LinkedIn's settings. Withdrawing does not affect anything done before it.

Recipient and our relationship with LinkedIn. LinkedIn receives this data. For collecting it on our website and sending it to LinkedIn, LinkedIn and Aitech International ApS are joint controllers under Article 26 GDPR, as set out in LinkedIn's Joint Controller Addendum. In essence: we are responsible for asking your consent, for telling you about the tag (this section), and for loading it only after you accept. LinkedIn is responsible for keeping the data it receives secure and for its own processing of it, and it answers requests about that processing. You may exercise your rights with either of us, and we pass on to LinkedIn any request that concerns its part. LinkedIn's own processing after that (for example, linking the data to a LinkedIn account) is governed by LinkedIn's privacy policy: linkedin.com/legal/privacy-policy. You may exercise your rights with us or with LinkedIn.

International transfer. LinkedIn may transfer the data to LinkedIn Corporation in the United States. That transfer relies on the EU–US Data Privacy Framework, to which LinkedIn Corporation is certified, and on the European Commission's Standard Contractual Clauses.

How long LinkedIn keeps it. LinkedIn states that it pseudonymises the direct identifiers within 7 days, and deletes the remaining data after 180 days.

6. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy
• Rectification — correct inaccurate data
• Erasure — request deletion (subject to retention obligations)
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — where consent is the legal basis
• Lodge a complaint — with your supervisory authority

If you are an end-user of a customer's tenant, please direct your request to your employer in the first instance; we will assist them in responding. If you ask us directly, we will route your request to your employer where they are the controller.

To exercise any of these rights, email info@qmsnordic.com. We will respond within one month and may extend by two further months where the request is complex.

7. Security

We protect personal data using technical and organisational measures including encryption at rest (AES-256) and in transit (TLS 1.2+), Postgres Row-Level Security with FORCE ROW LEVEL SECURITY for tenant isolation, hash-chained immutable audit logs, WebAuthn step-up for electronic signatures, bcrypt password hashing, and least-privilege access for our personnel. Our full security posture is summarised at qmsnordic.com/legal/security.

8. Retention

We retain personal data:

• For your tenant — for the duration of your employer's subscription, plus a 90-day grace period after termination during which the tenant administrator may export. After that, primary records are deleted; backup media containing personal data is overwritten within the underlying database's point-in-time recovery window, which is 7 days (confirmed 2026-09-09).
• For your employer's regulatory retention — if your employer configures a retention statement (e.g., lifetime of the device + 10 years per ISO 13485 §4.2.5), we retain accordingly until expiry.
• For our own controller-purposes (sales contacts, billing records, support correspondence) — for as long as we have a legitimate purpose plus statutory retention periods (typically 7 years for accounting).
• Anonymised, aggregated data — indefinitely; no individual is identifiable.

9. Children

The service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Automated decision-making

We do not engage in automated decision-making that produces legal or similarly significant effects on individuals. AI features inside the product (drafting, suggestions) always require human review and e-signature before any decision is made.

11. Changes to this policy

We may update this policy from time to time. If a change is material, we will notify customers via email at least 30 days before it takes effect. The "Last updated" date at the top of this page reflects the most recent revision. Past versions are retrievable from our public Git repository.

12. Contact

Data controller Aitech International ApS (operator and copyright holder of QMS Nordic) Nydamsvej 43, 8362 Hørning Denmark · CVR 46545354 Email: info@qmsnordic.com

Data Protection Officer A formal DPO is not appointed under Article 37 GDPR (we do not meet the mandatory thresholds), but info@qmsnordic.com is monitored by our Privacy Lead.

Lead Supervisory Authority (for EU complaints) The Danish Data Protection Authority (Datatilsynet) Carl Jacobsens Vej 35, 2500 Valby Denmark https://www.datatilsynet.dk