1. Controller
KandaQuantum Inc. is the controller of personal data described in this Policy. Where AIQCAT processes personal data on behalf of an enterprise customer, it acts as a processor under the applicable Data Processing Addendum.
2. What we collect
- Identity data: name, email, and professional identifiers tied to an enterprise account.
- Examination data: submitted artifacts, grading outputs, and evaluation reports.
- Usage data: pages visited, session events, device and browser metadata.
- Communications: emails, support tickets, and call notes.
3. Why we process
- To deliver the assessment Services and issue credentials.
- To operate the AIQCAT Credential Registry and respond to verification requests.
- To calibrate evaluator engines against a held-out reference set.
- To meet legal, audit, and accreditation obligations.
4. Legal bases
Where the GDPR or UK GDPR applies, AIQCAT relies on (a) performance of a contract; (b) compliance with a legal obligation; (c) legitimate interests; and (d) consent, as applicable. Where Japan's APPI applies, processing is conducted under its requirements.
5. Retention
Examinee submissions are retained for the period set out in the enterprise agreement (default 24 months). Credential records are retained as part of the Credential Registry unless revoked. Operational logs are retained for 12 months.
6. Sharing
AIQCAT does not sell personal data. It shares personal data only with (a) the enterprise account under which the examinee was enrolled; (b) sub-processors under contractual safeguards; and (c) authorities where legally required.
7. International transfers
Cross-border transfers are made under EU Standard Contractual Clauses, the UK IDTA, or an equivalent mechanism. Data-residency options (EU, UK, US, JP) are available on Standard and Enterprise plans.
8. Your rights
Subject to applicable law, you may access, rectify, erase, restrict, and port your personal data, and object to certain processing. To exercise these rights, contact privacy@aiqcat.org.
9. Security
AIQCAT operates an information security management system (ISMS) aligned with ISO/IEC 27001; certification is being pursued. Submissions are encrypted in transit and at rest, isolated per tenant, and are not used to train third-party models.
10. Cookies
AIQCAT uses strictly necessary cookies to operate the Services and limited analytics cookies subject to consent. Marketing cookies are not used.
11. Changes
AIQCAT may update this Policy. Material changes will be communicated with at least 30 days' notice. The current version is always available at this URL.
12. Contact
Privacy enquiries: privacy@aiqcat.org. Operating entity: KandaQuantum Inc., Bancho-Kojimachi Building, 6-6-2 Kojimachi, Chiyoda-ku, Tokyo, Japan.