Implicit Consent Documentation
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document defines QA Touch’s criteria and rationale for determining when implicit (implied) consent is sufficient for the collection, use, retention, disclosure, and disposal of personal information, and when explicit consent is required instead. It supports SOC 2 Privacy criterion P2.1 and provides a documented legal basis under GDPR Article 6, CCPA, and PIPEDA.
QA Touch operates as a data processor for its B2B customers (customer workspaces) and as a data controller for its own users (QA team members who hold QA Touch accounts). This document addresses QA Touch’s consent obligations as a controller.
2. Legal and Regulatory Framework
| Regulation | Consent Framework | QA Touch Approach |
|---|---|---|
| GDPR (EU/EEA) | Requires a lawful basis under Art. 6 for each processing activity. Consent is one of six bases; contract performance and legitimate interests are also available. | QA Touch relies on contract performance (Art. 6(1)(b)) for service delivery, legitimate interests (Art. 6(1)(f)) for security/fraud prevention, and explicit consent for optional processing (marketing, optional analytics). |
| CCPA (California) | No consent required for most data collection; notice at collection required. Opt-out required if ‘selling’ personal data. | Notice provided in Privacy Policy at collection; no sale of personal data; opt-out for marketing only. |
| PIPEDA (Canada) | Implied consent acceptable for business contact information and service delivery processing. | Implied consent through registration/contract for account data and service communications. |
| General B2B SaaS | In B2B contexts, individuals’ accounts are created under organisational contracts; implied consent for service delivery is standard industry practice. | Account registration under organisational contract constitutes implied consent for platform operation. |
3. Processing Activities Relying on Implicit Consent
| Processing Activity | Personal Data Involved | Basis for Implicit Consent | Notice Mechanism |
|---|---|---|---|
| User account creation and login | Name, email, hashed password, workspace membership, role | Registration constitutes implied consent; ToS and Privacy Policy accepted at sign-up; continued use implies acceptance of terms. | Privacy Policy linked on Registration Page; ToS checkbox at sign-up |
| Sending essential service emails | Email address | Creating an account implies consent to receive essential account security emails (password reset, MFA codes, invite confirmations) — necessary for service delivery and security. | Disclosed in Privacy Policy; cannot be opted out of while account remains active |
| In-app and configurable notifications | Email, name, notification content | Enabling a notification type in User Settings implies consent to that notification type. | All non-essential notification types: opt-in in User Settings; defaults disclosed in Help Docs |
| Audit log recording of user actions | User ID, IP, action type, resource, timestamp | Use of the platform implies consent to logging of actions for security, compliance, and audit trail purposes; disclosed in Privacy Policy. | Disclosed in Privacy Policy and Trust Center; workspace admins can view their workspace’s audit log |
| Support ticket processing | Name, email, support conversation content | Submitting a support request implies consent to QA Touch processing the communication to resolve the issue. | Disclosed in Privacy Policy; support interactions handled only by authorised support staff |
| Anonymous usage analytics | Anonymised/aggregated usage patterns (no personal identification) | Use of platform implies consent to anonymised analytics that cannot identify individuals; disclosed in Privacy Policy. | Disclosed in Privacy Policy; no individual profiling; opt-out available if identifiable analytics enabled [VERIFY] |
| Integration event and activity logging | User ID, integration action type, outcome, timestamp | Configuring and using an integration implies consent to logging of integration activity for debugging and audit. | Disclosed in Privacy Policy and integration setup UI |
| Essential session cookies | Session token stored in HttpOnly browser cookie | Loading the QA Touch application implies acceptance of essential cookies required for secure session management. | Cookie banner at first access; essential cookies cannot be declined without breaking login functionality |
4. Processing Activities Requiring Explicit Opt-In Consent
| Processing Activity | Collection Point | Consequence of Non-Consent |
|---|---|---|
| Marketing emails and product newsletters | Unchecked checkbox at registration; or User Settings → Email Preferences | User does not receive marketing communications. No impact on platform access, features, or data. |
| Optional identifiable usage analytics | User Settings → Privacy | No identifiable analytics collected from this account. |
| AI prompt data used for third-party model training [VERIFY if applicable] | AI Feature Settings / Privacy Settings [VERIFY] | Prompts not used for AI model training. AI generation features remain fully available. |
| Third-party integration OAuth grant | OAuth consent screen presented by third-party provider | Integration not activated; no data synced with the third-party system. |
5. Validity Criteria for Implicit Consent
- Notice: the data subject has been clearly informed through the Privacy Policy, ToS, in-product disclosure, or this document.
- Reasonable expectation: the processing is reasonably expected given the nature of the SaaS service being used.
- Non-objection: the data subject has not objected or withdrawn consent; opt-out mechanisms are available where applicable.
- Proportionality: processing is limited to what is strictly necessary for the stated purpose.
- Documentation: this document and the Privacy Policy together constitute the documented rationale for implied consent reliance.