Legal centre

Clear policies, plainly written.

The documents below govern use of the Q Compliance application. They are published so institutions and their advisers can review our commitments without needing to ask.

Company & contact details for:

Terms of Service

These terms apply to your use of the Q Compliance application and related AnswerQuay services. Where a signed order form, data processing agreement or master services agreement is in place with your organisation, that agreement takes precedence for the services it covers.

1. Who we are

The services are provided by AnswerQuay Limited. Company and contact details — for both the Irish company and its UK establishment — are set out in the Company & contact section below. Browsing this site, sending an enquiry or registering an organisation does not by itself create a paid service contract or activate workspace access.

2. Accounts and eligibility

You must be at least 18 and authorised to act for your organisation. Organisation accounts are issued to named individuals following verification and must not be shared. Keep your credentials secure; enable two-factor authentication where offered. Tell us promptly if you suspect unauthorised use.

3. Organisation verification

Organisation registration creates a pending application only. Access to workspaces, evidence annexes and assessment tools is granted solely after verification by the AnswerQuay platform team. Submitting an application is not a guarantee of access.

4. Your content and instructions

You keep your rights in the content you upload, including evidence documents. You must have authority to share it and must not submit unlawful, stolen or highly sensitive personal data. Access is limited to authorised personnel and service providers for stated purposes.

5. Outputs and professional judgement

Q Compliance outputs are analytical records for institutional decision-makers. They are not regulated advice, credit ratings, lending decisions or offers of finance, and must not be relied on as the sole basis for any decision. Your organisation remains responsible for its own regulatory compliance.

6. Availability, suspension and termination

We may restrict harmful or unauthorised activity proportionately and will explain why where lawful. Ending a service does not remove rights already accrued. Statutory consumer and business rights are preserved.

7. Governing law and complaints

For users in Ireland and the EU/EEA these terms are governed by the laws of Ireland. UK users keep the mandatory protections of the country where they normally live. To complain, contact us using the details below and include your account or organisation reference.

Privacy Policy

This policy explains how AnswerQuay Limited uses personal data in the Q Compliance application. It is designed around the GDPR, the Irish Data Protection Act 2018 and, for UK users, the UK GDPR and Data Protection Act 2018.

1. Who is responsible

AnswerQuay Limited is the controller for website enquiries, organisation registrations, accounts, billing and our own business records. Where an institutional client stores records inside a workspace — assessments, evidence documents and audit trails — that client is the controller and we process those records on its documented instructions.

2. What we collect

Details you submit through our forms — name, work email, organisation, job title and the product details you choose to give. For accounts: account identifier, email address, sign-in and security records (including MFA enrolment status). For workspaces: the organisation details, membership and role records, assessments you save, documents you upload and the audit events they generate. We do not collect payment-card details in this application.

3. Why we use it and our lawful bases

To respond to enquiries and take steps you request before a contract (pre-contractual steps); to perform our contract with you or your organisation; to verify the identity and standing of institutional applicants and meet legal, sanctions and record-keeping obligations (legal obligation); and, on the basis of legitimate interests balanced against your rights, to keep the service secure, prevent fraud and maintain audit trails. Optional analytics or marketing measurement would rely only on consent and stays off unless you opt in.

4. Data minimisation

Optional fields can be left blank. Please do not send passwords, authentication codes, payment-card details, identity documents, health information or other highly sensitive information through forms or document uploads.

5. Who we share it with

Contracted hosting, authentication, email and support providers, and authorised personnel, only as needed for the purposes above. We do not sell personal data and we do not use client records to train external AI models.

6. International transfers

Where a provider processes data outside Ireland, the UK or the European Economic Area, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

7. How long we keep it

Enquiries are kept for as long as needed to deal with them and follow-up. Account records are kept for the life of the relationship and then for statutory periods. Workspace records — assessments, documents and audit trails — are kept for the period agreed in the client's data schedule, then securely deleted or returned.

8. Your rights

Subject to legal conditions, you can ask to access, correct, erase, restrict or receive a portable copy of your data, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Signed-in users can export their personal data and request erasure from the workspace; requests about records held inside an organisation's workspace are handled by that organisation as controller. Erasure requests are completed within one month unless a legal exemption applies.

9. Complaints

You can complain to the Irish Data Protection Commission (dataprotection.ie) or, in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.

10. Automated decisions and changes

This application does not make automated decisions with legal or similarly significant effects about individuals. Material changes to this policy will be dated and communicated where required.

Cookie Policy

Irish and UK ePrivacy rules require consent before information is stored on or read from your device, unless it is strictly necessary for a service you request.

1. What this application uses today

This application uses only strictly necessary storage: technology required to load pages securely and, for signed-in areas, to keep you signed in and protect against cross-site request forgery. These cannot be switched off without stopping sign-in from working.

2. Optional analytics and marketing

We do not currently use analytics, advertising, session-replay or partner-tracking cookies. If we introduce any, they will stay off until you consent, a cookie choice will offer Accept all, Reject optional and Customise options of equal prominence, and this policy will list each cookie by name, provider, purpose and duration.

3. Your choices

You can block or clear cookies in your browser settings. Blocking strictly necessary storage may prevent sign-in. Any consent banner choice is remembered on your device and can be changed by clearing site data.

Acceptable Use Policy

Access to Q Compliance is conditional on lawful, responsible use consistent with your own regulatory obligations.

1. Use responsibly

Use the service only for lawful purposes and only with information and systems you are entitled to access. Respect the rights, privacy, confidentiality and intellectual property of others.

2. Prohibited activity

Do not use Q Compliance for fraud, impersonation, harassment, discriminatory abuse, unlawful surveillance, malware, credential theft, security bypasses, unsolicited bulk messages or to facilitate illegal activity. Do not submit stolen or confidential data, or personal data you have no authority to share.

3. Access and actions

Do not grant broader access than an agreed workflow needs. Never put passwords, secret keys, payment-card data or authentication codes into forms. Do not attempt to access another organisation's records or to circumvent role permissions, approval rules or audit controls.

4. Evidence integrity

Documents submitted as evidence must be authentic and complete. Records must not be altered to change an outcome; corrections go through the audit-preserving amendment process.

5. Human review

Check outputs before relying on them, particularly where they affect credit, legal rights or safety. Q Compliance must not be used as an emergency response system or represented as a licensed professional service.

6. Responding to misuse

Suspected misuse may lead to proportionate restriction while it is reviewed. Where lawful, we will explain the issue and give you an opportunity to correct or challenge it. Statutory rights are preserved.

Security & Data Protection

Security is built into how the platform behaves, not only into policy.

Tenant isolation

Each organisation operates in its own workspace. Access to another organisation's records is prevented in the application and enforced by database row-level security policies.

Access control

Roles limit each person to the functions their role allows — organisation admins manage their own workspace; platform review is restricted to authorised staff. Privileged actions are attributed to a named user.

Audit trail

Significant workspace activity — invitations, document uploads and deletions — is recorded in an append-only audit log that organisation admins can review and export.

Encryption and secrets

Data is encrypted in transit (TLS) and at rest by the hosting provider. Credentials and secret keys are handled server-side and never exposed to the browser.

Account protection

Two-factor authentication (TOTP) is available to every account and recommended for all users, particularly organisation admins.

Processing for clients

Where we process personal data for an institutional client, a data processing agreement sets out instructions, sub-processors, transfers, retention and deletion before any records are loaded.

Reporting a concern

If you believe you have found a security issue, email us using the details below. Please do not access, change or delete data that is not yours.

Company & contact

Details shown for Irish and EU/EEA visitors. Switch the toggle above to see the other establishment.

Legal entity: AnswerQuay Limited
Place of establishment: Ireland — Irish company — registered in Ireland
Data protection regulator: Irish Data Protection Commission (www.dataprotection.ie)
Applicable data protection law: GDPR and the Irish Data Protection Act 2018
Business email: admin.centraloffice@answerquay.ie
Telephone & WhatsApp: +353 85 160 9901
Markets served: Ireland, the United Kingdom and the EU/EEA
Privacy & complaints: Email admin.centraloffice@answerquay.ie; you may also complain to the Irish Data Protection Commission.

EU/EEA customers are served under EU GDPR; the Irish DPC is the lead supervisory authority.

Owner

AnswerQuay Limited

Review cycle

Annual, and on material change

Effective

7 November 2026