Privacy Policy

1. About this policy

This Privacy Policy is maintained by Quality Evolution Services ("QES", "we", "us") to explain how we handle personal data collected through qualityevolutionservices.com and our related services. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and where applicable, the EU GDPR.

2. Data controller

Quality Evolution Services is the data controller for personal data submitted via this website. For any privacy questions or to exercise your rights, contact us at enquiries@evoservices.co.uk.

3. What personal data we collect

• Inquiry forms: name, email address, phone number (optional), company, country, and the message you send us.
• Affiliate registrations: name, email, optional phone, years of MRI Evolution experience, the capabilities you tell us you can confidently deliver, and a short free-text background. The updated registration also records your interest as a CAFM candidate, QES delivery associate or both, and evidence of your affirmative consent: the registration it relates to, exact notice/version, privacy notice version and snapshot, UTC receipt time and web-form checkbox method. Receipt does not verify ownership of your email address. QES does not collect or store CVs at registration — a current CV is only requested directly from you if a specific client opportunity reaches shortlist stage.
• Technical data: IP address, device and browser information, referring URL, and marketing attribution parameters (e.g. UTM tags) used to understand which channels brought you to us.
• Cookies: as described in our Cookie Policy.

4. Lawful bases and purposes

5. How we share your data

We do not sell your personal data. We share it only with trusted processors that help us run the website and our services, including:

Affiliate registration does not authorise sharing identifiable details or CVs with a named client: permission is sought separately for the specific role. It does not enrol you in newsletters or the QES Community Network. You may withdraw consent to retaining and contacting you about opportunities at any time by emailing enquiries@evoservices.co.uk, without affecting prior lawful processing.

Withdrawal requests sent to this email are handled manually. On receipt, QES promptly pauses consent-based opportunity contact and matching, proportionately verifies the request and records the action with a server UTC time. Any request received time supplied by an administrator is identified separately. Original consent evidence remains unchanged. A minimum protected suppression record is retained to prevent accidental re-contact through duplicate, corrected or re-imported registrations; its necessity and any erasure request are reviewed periodically. Already-exported lists and external email or Teams copies require separate manual handling. This does not automatically suppress unrelated service communications. A new registration does not by itself reactivate opportunity contact.

• Lovable Cloud / Supabase (database, authentication, file storage)
• Lovable Email (transactional email delivery)
• Google (Search Console, optional Google Analytics 4, optional Google Ads conversion measurement, optional Google Translate)

Cookie consent on this site is managed by our own first-party consent banner — we do not use an external consent management platform. We do not use the Meta / Facebook pixel.

The site serves its fonts directly. Anonymous public browsing does not initialise admin authentication storage. Public forms contact Lovable Cloud only when submitted; admin session storage is created only when the sign-in area is used.

We also maintain an internal conversion ledger that records that a form submission or calendar-invite download occurred. This ledger stores only a form type, an optional campaign identifier, the page path (query-free), a random submission ID and a timestamp. It never contains your name, email, phone number, message, IP address or any tracking click identifiers.

Where data is transferred outside the UK or EEA, we rely on adequacy decisions or Standard Contractual Clauses to ensure equivalent protection.

6. Retention

We keep inquiry data for up to 24 months after our last interaction, affiliate applications for up to 36 months (or until you ask us to delete them), and accounting records for the period required by UK law (typically 6 years). Analytics data is kept in aggregated form.

7. Your rights under the GDPR

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure ("right to be forgotten") where applicable
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time (without affecting prior lawful processing)
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email enquiries@evoservices.co.uk. We will respond within one month.

8. Security

We use HTTPS across the site, row-level security on our database, and limit access to personal data to authorised personnel only. Historical CV files uploaded before we removed CV collection from the affiliate registration form remain in a private, access-controlled storage bucket and are covered by the retention schedule above.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent change.

10. Contact

Questions about this policy or your data? enquiries@evoservices.co.uk