Last modified August 18, 2020
ZenQMS Privacy & Security Policy
Please review this policy in conjunction with our Terms of Service.
When we refer to “ZenQMS”, we mean the ZenQMS entity that acts as the processor of your information, as explained in more detail in the “Identifying the Data Controller and Processor” section below. When we refer to "Members" we mean our clients who are directly in control of the Customer Data they enter into the system, including any personally identifiable data.
Applicability Of This Policy
Information We Collect & Receive
ZenQMS may collect and receive Customer Data and other information and data (“Other Information”) in a variety of ways:
- Customer Data. Customers or individuals granted access to a Member Account by a Member (“Authorized Users”) routinely submit Customer Data to ZenQMS when using the Services.
- Other Information. ZenQMS also collects, generates and/or receives Other Information:
- Member Account and Account Information. To create or update a Member Account, you or your Member (e.g., your employer) supply ZenQMS with an email address, phone number, password, domain and/or similar account details. In addition, Members provide ZenQMS (or its payment processors) with billing details such as credit card information, banking information and/or a billing address.
- Usage Information.
- Services Metadata. When an Authorized User interacts with the Services, metadata is generated that provides additional context about the way Authorized Users work. For example, ZenQMS logs the features, content and links you interact with.
- Log data. As with most websites and technology services delivered over the Internet, our servers automatically collect information when you access or use our Websites or Services and record it in log files. This log data may include the Internet Protocol (IP) address, the address of the web page visited before using the Website or Services, browser type and settings, the date and time the Services were used, information about browser configuration and plugins, language preferences and cookie data.
- Device information. ZenQMS collects information about devices accessing the Services, including type of device, what operating system is used, device settings, application IDs, unique device identifiers and crash data. Whether we collect some or all of this Other Information often depends on the type of device used and its settings.
- Location information. We receive information from you, your Member and other third-parties that helps us approximate your location. We may, for example, use a business address submitted by your employer, or an IP address received from your browser or device to determine approximate location. ZenQMS may also collect location information from devices in accordance with the consent process provided by your device.
Additional Information Provided to ZenQMS. We receive Other Information when submitted to our Websites or if you participate in a focus group, contest, activity or event, apply for a job, request support, interact with our social media accounts or otherwise communicate with ZenQMS.
- A cookie is a small amount of data, which often includes an anonymous unique identifier, that is sent to your browser from a web site's computers and stored on your computer's hard drive.
- We use both session-based and persistent cookies. ZenQMS sets and accesses our own cookies on the domains in our Services. In addition, we use third party cookies, like Google Analytics.
Generally, no one is under a statutory or contractual obligation to provide any Customer Data or Other Information (collectively, “Information”). However, certain Information is collected automatically and, if some Information, such as Member Account setup details, is not provided, we may be unable to provide the Services.
How We Use Information
Customer Data will be used by ZenQMS in accordance with Member’s instructions, including any applicable terms in the Customer Agreement and Member’s use of Services functionality, and as required by applicable law. ZenQMS is a processor of Customer Data and Member is the controller. Member may, for example, use the Services to grant and remove access to a Member Account, assign roles and configure settings, access, modify, export, share and remove Customer Data and otherwise apply its policies to the Services. ZenQMS uses Other Information in furtherance of our legitimate interests in operating our Services, Websites and business. More specifically, ZenQMS uses Other Information:
- To provide, update, maintain and protect our Services, Websites and business. This includes use of Other Information to support delivery of the Services under a Customer Agreement, prevent or address service errors, security or technical issues, analyze and monitor usage, trends and other activities or at an Authorized User’s request.
- As required by applicable law, legal process or regulation.
- To communicate with you by responding to your requests, comments and questions. If you contact us, we may use your Other Information to respond.
- To develop and provide search, learning and productivity tools and additional features. ZenQMS tries to make the Services as useful as possible for specific Member Accounts and Authorized Users. For example, we may look for OS/Browser information relative to common errors to identify possible issues.
- To send emails and other communications. We may send you service, technical and other administrative emails, messages and other types of communications. We may also contact you to inform you about changes in our Services, our Services offerings, and important Services-related notices, such as security and fraud notices. These communications are considered part of the Services and you may not opt out of them. In addition, we sometimes send emails about new product features or other news about ZenQMS. These are marketing messages so you can control whether you receive them.
- For billing, account management and other administrative matters. ZenQMS may need to contact you for invoicing, account management and similar reasons and we use account data to administer accounts and keep track of billing and payments.
- To investigate and help prevent security issues and abuse.
How We Share And Disclose Information
This section describes how ZenQMS may share and disclose Information. Members determine their own policies and practices for the sharing and disclosure of Information, and ZenQMS does not control how they or any other third parties choose to share or disclose Information. As a general rule, disclosure here is also governed by any in force confidentiality agreements between us and the Customer.
- Member’s Instructions. ZenQMS will solely share and disclose Customer Data in accordance with a Member’s instructions, including any applicable terms in the Customer Agreement and Member’s use of Services functionality, and in compliance with applicable law and legal process.
- Displaying the Services. When an Authorized User submits Other Information, it may be displayed to other Authorized Users in the same Member Account. For example, an Authorized User’s email address may be displayed with their Member Account profile.
- Collaborating with Others. The Services provide different ways for Authorized Users collaborate. Other Information, such as an Authorized User’s profile Information, may be shared internally, subject to the policies and practices of the other Member Account(s).
- Member Access. Owners, administrators, Authorized Users and other Member representatives and personnel may be able to access and modify Other Information.
- Third Party Service Providers and Partners. We may engage third party companies or individuals as service providers or business partners to process Other Information and support our business. These third parties may, for example, provide virtual computing and storage services (e.g. Amazon Web Services). Regulatory compliance with policies (e.g. GDPR) may be reviewed during the Quality Risk Assessment of these service providers or business partners.
- Third Party Services through API. Member may enable or permit Authorized Users to enable Third Party Services to access information in ZenQMS through it's API. When enabled, ZenQMS may share Other Information with Third Party Services. Third Party Services are not owned or controlled by ZenQMS and third parties that have been granted access to Other Information may have their own policies and practices for its collection and use. Please check the privacy settings and notices in these Third Party Services or contact the provider for any questions.
- During a Change to ZenQMS' Business. If ZenQMS engages in a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of ZenQMS' assets or stock, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities (e.g. due diligence), some or all Other Information may be shared or transferred, subject to standard confidentiality arrangements.
- To Comply with Laws. If we receive a request for information, we may disclose Other Information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation or legal process. In certain situations, we may also be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
- To enforce our rights, prevent fraud, and for safety. To protect and defend the rights, property or safety of ZenQMS or third parties, including enforcing contracts or policies, or in connection with investigating and preventing fraud or security issues.
ZenQMS takes security of data very seriously. ZenQMS works hard to protect Other Information you provide from loss, misuse, and unauthorized access or disclosure. These steps take into account the sensitivity of the Other Information we collect, process and store, and the current state of technology. Given the nature of communications and information processing technology, ZenQMS cannot guarantee that Information, during transmission through the Internet or while stored on our systems or otherwise in our care, will be absolutely safe from intrusion by others.
While not an exhaustive list, please note the following overview of Our approach to security:
- System Architecture. The service is designed with robust, industrial security and performance in mind, using .NET/ASP.NET and MS SQL Server. It is a closed environment, requiring member users to log into a secure environment with unique credentials and enforced time outs. Member administrators can apply several security restrictions to login IDs and passwords, including 2-factor authentication. Password and/or user ID changes generate automatic email alerts to the affected users, and multiple failed login attempts will result first in notification to the affected user and then a mandatory lock out. All data in transmission is secured using SSL (https) protocol. Data ‘at rest’ in the database is secured using industry-leading AES 256-bit encryption algorithms. All data is regularly backed up, with back ups stored in alternate, secure locations and services. Access to the production database is strictly managed and monitored, with access provided only to trusted employees. Finally, GMP/p.11 compliant database audit trail logs provide an added level of security/monitoring.
- Service Infrastructure. The infrastructure hosting the Service is robust, scalable, and secure. It is certified for SOC 1 (formerly SAS70), SOC 2 & SOC 3, ISO 27001, PCI DSS Level 1 & HIPPA. The Company's strategy includes the ability to use and deploy within multiple geographic sites to prevent service interruptions. The data/software running the Service are managed in a discrete, segregated server instance. Access to the hosting environment is strictly managed and monitored, and access is provided only to trusted employees.
- General Systems Security. All ZenQMS employees must make security logins active for their workstations/notebooks, and access to the shared data servers and email systems requires two-factor authentication. Member Confidential Information sent to ZenQMS outside the Service may be stored locally in a ZenQMS User’s workstation. The Company recommends secure avenues for receiving Confidential Information from members, such as SFTP, though We will receive data through email and related cloud-based data sharing services (e.g., Sharepoint, Dropbox, etc.) at the member’s request.
- ZenQMS Employee Legal Commitment. ZenQMS employees are required to sign an employment agreement that includes a commitment to acknowledging their responsibilities for protecting any member Confidential Information and general security issues and commitments.
- Technical Support Access Log. Select ZenQMS employees acting in a support capacity may be required to log in and access parts of the service that may display a Member’s Confidential Information based on a Member’s or Authorized User’s explicit request. Any such access is documented with a mandatory reason. Member administrators can review this log in the Administration > Member Account > ZenQMS Access History section.
- Destruction of Confidential Information. If a Member elects to fully terminate its use of the Service for any reason, or is terminated by the Company, all confidential data owned by that Member will be permanently deleted from the Service, ZenQMS’ possession or otherwise in the Company's control. Please see “VI. TERM & TERMINATION – Section 5” of Our Terms of Service for additional details.
To the extent prohibited by applicable law, ZenQMS does not allow use of our Services and Websites by anyone younger than 16 years old. If you learn that anyone younger than 16 has unlawfully provided us with personal data, please contact us and we will take steps to delete such information.
Data Protection Officer
To communicate with our Data Protection Officer, please email email@example.com or firstname.lastname@example.org.
Identifying The Data Controller And Processor
Data protection law in certain jurisdictions differentiates between the “controller” and “processor” of information. In general, the Member is the controller of Customer Data. In general, ZenQMS is the processor of Customer Data and the controller of Other Information.
- Authorized Users have the right to access and edit their personal information by logging into the application's administration / mySettings pages.
- Authorized Users have the right to not volunteer personal information and/or to correct or delete their personal data from our closed system. Authorized Users can alter/delete most all information directly from within the application's personal settings page, can request this change from their employer's ZenQMS administrator directly, and/or email email@example.com.
- To the extent that ZenQMS' processing of your Personal Data is subject to the General Data Protection Regulation, ZenQMS relies on its legitimate interests, described above, to process your data. ZenQMS may also process Other Information that constitutes your Personal Data for direct marketing purposes and you have a right to object to ZenQMS' use of your Personal Data for this purpose at any time.
Privacy Shield Frameworks
ZenQMS may transfer your Personal Data to countries other than the one in which you live. To safeguard transfers of Personal Data originating from the European Union or Switzerland to other countries not deemed adequate under applicable data protection law ZenQMS participates in the Privacy Shield Frameworks.
With respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, ZenQMS is subject to the regulatory and enforcement powers of the U.S. Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks, EU and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also may correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under Privacy Shield, should direct their query to firstname.lastname@example.org. If requested to remove data, we will respond within a reasonable timeframe.
We will provide an individual opt-out choice for sensitive data; this choice will also fully restrict access to the application.
In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
ZenQMS’ accountability for personal data that it receives in the United States under the Privacy Shield and subsequently transfers to a third party is described in the Privacy Shield Principles. In particular, ZenQMS remains responsible and liable under the Privacy Shield Principles if third-party agents that it engages to process the personal data on its behalf do so in a manner inconsistent with the Principles, unless ZenQMS proves that it is not responsible for the event giving rise to the damage.
In compliance with the Privacy Shield Principles, ZenQMS commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union and Swiss individuals with Privacy Shield inquiries or complaints should first contact ZenQMS at:
Phone: +1 267 670 8999
Mail: 140 Coulter Ave Suite 265 Ardmore, PA 19003 USA
ZenQMS has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction
40 Coulter Ave Suite 265
Ardmore, PA 19003