Privacy Policy
Last updated: 12 November 2026
1. Who we are
Quillwren (“we”, “us”) provides concierge and executive assistance services. Quillwren is the controller of the personal data described in this policy. For all privacy matters, write to [email protected].
2. What data we process
- Contact data you send us: name, email address, phone number.
- Request data: travel dates, preferences, booking details and any other information you choose to share so that we can fulfil a request.
- Correspondence with you, and with suppliers on your behalf.
- This website sets no cookies and uses no analytics or tracking. Our hosting provider processes technical data (IP address, browser type) in server logs for security.
3. Why we process it and on what legal basis
- To answer your enquiry and provide the service — performance of a contract, or steps before entering into a contract (GDPR Art. 6(1)(b)).
- To keep records required by law — legal obligation (Art. 6(1)(c)).
- To keep this website and our email secure — legitimate interests (Art. 6(1)(f)).
4. Who receives your data
- Suppliers that fulfil your request — hotels, airlines, transport companies, restaurants, event venues and retailers — receive only the data they need.
- Service providers that process data on our behalf: website hosting (Cloudflare), email hosting (Fastmail) and AI service providers that help us prepare requests. They act under data processing agreements.
- Public authorities, where the law requires it.
We never sell personal data.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area, for example in the United States. In such cases we rely on an adequacy decision, including the EU–U.S. Data Privacy Framework, or on the European Commission’s Standard Contractual Clauses.
6. How long we keep data
- Request data — as long as needed to provide the service and handle follow-up questions, and no longer than 24 months after that.
- Data we must keep for legal reasons — for the period the law requires.
- Server logs — up to 30 days.
7. Your rights
You can ask for access to your data, its correction or deletion, restriction of processing and data portability. You can also object to processing based on legitimate interests. Write to [email protected]; we answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority in the EU country where you live or work.
8. Automated processing
We use AI tools to prepare and organise requests. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing: a person approves every payment and commitment.
9. Changes
We may update this policy. The date at the top shows the current version.