Privacy Notice Consent Requirements
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document establishes the framework and mandatory content requirements for the QA Touch Privacy Notice (Privacy Policy), with particular focus on consent requirements for specific categories of personal information. It supports SOC 2 Privacy criteria P1.1 (Privacy Notice) and P2.1 (Consent) and serves as the internal reference for maintaining the customer-facing Privacy Policy.
NOTE: This document is an internal framework. The customer-facing Privacy Policy derived from this framework must be published at a publicly accessible, stable URL and linked from the registration page, login page, cookie banner, and website footer.
2. Privacy Notice Publication Requirements
- Published at a stable, publicly accessible URL (e.g., https://qatouch.com/privacy [VERIFY]).
- Linked from: registration page, login page, website footer, cookie banner, and user settings.
- Dated with effective date and version number; previous versions archived.
- Material changes communicated via email with minimum 30 days’ notice before taking effect.
- Written in plain, accessible language targeting a Grade 8 reading level or lower.
3. Mandatory Privacy Notice Sections
| Section | Required Content | Consent Relevance |
|---|---|---|
| Identity of Controller | QA Touch legal entity name, registered address, privacy contact email. | Informs data subjects who is responsible for their data. |
| Data We Collect | Comprehensive list: name, email, IP, usage analytics, AI prompts, audit log data, etc. | Foundation for implied consent through informed use. |
| How We Collect | Direct entry (registration, test creation); automatic collection (logs, cookies); integrations; AI submissions. | Informs of all collection mechanisms. |
| Purposes and Legal Bases | Table of each processing activity, purpose, and GDPR Art. 6 legal basis. | GDPR Art. 13 requirement; establishes lawful basis. |
| Explicit Consent Categories | Processing requiring active opt-in: marketing emails, optional analytics, AI training (if applicable). | Specifies where affirmative action is required. |
| Consequences of Not Consenting | What happens if user refuses explicit consent for each optional category. | GDPR requirement: informed consent includes outcome disclosure. |
| Data Sharing and Sub-Processors | Categories of third parties receiving data; link to Sub-Processor List page. | Basis for implied consent to sub-processor sharing within contract. |
| International Transfers | Whether personal data transfers outside EEA/UK; transfer mechanism (SCCs, adequacy decision). | GDPR Chapter V requirement. |
| Retention Periods | Summary retention periods per data category; link to full Retention Schedule. | Allows data subjects to understand data lifecycle. |
| Data Subject Rights | Rights to access, correction, erasure, restriction, portability, objection; how to exercise; 30-day response timeframe. | GDPR Arts. 13–21 mandatory disclosure. |
| Cookies | Essential vs optional cookie types; how to manage preferences; link to Cookie Policy. | Cookie consent separate from general Privacy Policy. |
| Contact / DPO | Privacy contact email; DPO details if applicable; supervisory authority for complaints. | Data subjects must know who to contact. |
| Policy Changes | How and when users will be notified of material changes; current version effective date. | Ensures ongoing informed consent. |
4. Explicit Consent — Categories, Collection Points, and Consequences
| Processing Activity | Consent Type | Collection Point | Consequence of Non-Consent |
|---|---|---|---|
| Marketing and newsletter emails | Explicit opt-in (unchecked checkbox) | Registration page; User Settings → Email Preferences | No marketing communications received. No impact on platform access, features, or data. |
| Optional identifiable usage analytics | Explicit opt-in toggle | User Settings → Privacy | No identifiable analytics collected from this account. Anonymous aggregate analytics unaffected. |
| AI prompt data for model training [VERIFY] | Explicit opt-in (if applicable) | AI Feature Settings / Privacy Settings | AI features remain available; prompts not used to train third-party models. |
| Third-party integration OAuth scope | Explicit consent via OAuth grant screen | Integration configuration flow (OAuth provider’s consent screen) | Integration not activated; no data synced. User can configure integration later. |
| Profile photo upload | Voluntary / implied | User Settings → Profile (optional upload) | No avatar displayed; default system avatar used. No functional impact. |
| Phone number for MFA | Voluntary / implied | MFA Setup in User Settings (optional) | Phone-based MFA not available; TOTP authenticator app MFA remains available as alternative. |
5. Consent Management Controls
- Explicit consent events (marketing opt-in, analytics opt-in) are logged with: user ID, timestamp, consent text version, and collection point.
- Users may withdraw consent for optional processing at any time via User Settings → Email Preferences or Privacy Settings; withdrawal is immediate.
- Consent records retained for account lifetime plus 3 years as legal accountability evidence.
- If Privacy Policy materially changes, new consent is sought for affected optional processing activities before the change takes effect.