Privacy Policy & Cookies

Privacy Summary – Quotanda LLC (United States)

This document is a summary of Quotanda LLC’s Privacy Policy. It contains essential information on the processing of personal data and financial information. For full details, retention periods, international transfers and complete terms, please see the full Privacy Policy at https://quotanda.com/legal/en/quotanda-privacy-policy-usa.pdf.

1. Who is Quotanda LLC?

Legal Entity Quotanda LLC — Delaware limited liability company, United States
Services Education financing: Deferred Tuition, Payment Plans and Income Share Agreements (ISAs)
Federal Regulator Federal Trade Commission (FTC) — under GLBA (16 CFR Parts 313 and 314)
Contact support@quotanda.com · www.quotanda.com
Quotanda LLC acts as the responsible entity when directly managing student financing. When providing technology services to an educational institution, it acts as Service Provider under that institution’s instructions.

2. What information do we collect?

Quotanda LLC collects the following categories of personal information and nonpublic personal information (NPI) under the GLBA:
Category What it includes
Identifiers and contact Name, email, phone, mailing address, date of birth, identity document number.
Financial information (NPI) Income level, employment status, banking information for ACH payments and contract payment history.
Academic information Educational institution, programme, enrolment status and programme dates.
Employment and income data For income-linked payment contracts: employer, job title, income level. Updated periodically during the contract term.
Technical and usage data IP address, browser, device and session data collected automatically.
Communications Records of calls, emails and messages with the Quotanda LLC team.
Quotanda LLC does not consult consumer reporting agencies (credit bureaus) and does not carry out formal KYC verification.

3. Why do we use your information?

Purposes necessary for the service
The consumer or customer may not opt out while maintaining an active relationship with Quotanda LLC:
  • Assessment and processing of the education financing application.
  • Identity verification and document authentication.
  • Contract administration: payment management, communications and account monitoring.
  • Instalment calculation for income-linked payment contracts.
  • Fraud prevention and verification against applicable sanctions lists.
  • Default management and, where necessary, collaboration with authorised collections companies.
  • Compliance with federal and state legal obligations.
  • Sending essential service communications.
Optional purposes
The consumer or customer may opt out at any time:
  • Marketing communications about new Quotanda LLC products or services.
  • Statistical analyses with anonymised data to improve the service.
To opt out: support@quotanda.com · Subject: “Data use limitation — [full name]”

4. With whom do we share your information? (GLBA Notice)

Under the Gramm-Leach-Bliley Act (GLBA), Quotanda LLC discloses the reasons it may share your nonpublic personal information (NPI):
Reason for sharing Do we share? Can you limit this?
Everyday business: processing your application, administering your account and legal compliance. Yes No
Quotanda LLC marketing: offering you new products or services. Yes Yes — support@quotanda.com
Joint marketing with other financial companies. No We don’t share
Affiliates’ everyday operations. No We don’t share
Non-affiliates for their own marketing purposes. No We don’t share
Quotanda LLC does not sell personal information or share it for cross-context behavioral advertising.

5. Artificial Intelligence and Financing Decisions

Quotanda LLC uses AI-assisted technology tools for internal document management operations. All decisions regarding the assessment of financing applications are made by Quotanda LLC personnel. No automated system alone determines whether an application is approved or rejected. California residents may request information about the use of automated tools and exercise their rights under the CCPA’s ADMT regulations at support@quotanda.com.

6. Your Rights

Depending on your state of residence, you may have the following rights regarding your personal data:
Right What it allows
Access Know what information Quotanda LLC holds about you and how it is used.
Correction Request correction of inaccurate or out-of-date data.
Deletion Request deletion of your data, subject to legal retention obligations.
Portability Obtain a copy of your data in structured format.
Opt-out Object to the sale or sharing of your data and to its use for marketing.
Non-discrimination Quotanda LLC will not take discriminatory action for the exercise of these rights.
How to exercise your rights: Send your request to support@quotanda.com indicating your full name, state of residence and the right you wish to exercise. Quotanda LLC will acknowledge receipt within 10 business days and provide a complete response within 45 days.

7. Security

Quotanda LLC maintains a Written Information Security Program (WISP) under the GLBA Safeguards Rule (16 CFR Part 314), which includes data encryption in transit and at rest, access controls and audit logging. In the event of a security incident affecting 500 or more consumers or customers, Quotanda LLC will notify the FTC within 30 days.

8. Complaint Authorities

Authority Scope Contact
Federal Trade Commission (FTC) GLBA regulator — non-bank financial practices ftc.gov
Consumer Financial Protection Bureau (CFPB) Enforcement over education financing products (ISAs, TILA / Regulation Z) consumerfinance.gov
California Privacy Protection Agency (CalPrivacy) CCPA/CPRA rights — California residents cppa.ca.gov
Your state Attorney General Applicable state privacy laws (20 states with active legislation) See full policy — Section 6
This document is a summary. The full Privacy Policy contains detailed information on:
  • Retention periods by category of user.
  • Specific rights by state of residence (20 states with active legislation).
  • Full list of Service Providers and security measures.
  • Complete GLBA Notice under the Financial Privacy Rule (16 CFR Part 313).
  • Rights under FERPA when Quotanda LLC acts as Service Provider for an educational institution.
  • Rights under TILA / Regulation Z for education financing products.
Full Privacy Policy: https://quotanda.com/legal/en/quotanda-privacy-policy-usa.pdf Quotanda LLC · support@quotanda.com · www.quotanda.com

Privacy Policy (Summary) – Quotanda Loans, S.L. (EU/UK)

At Quotanda we manage the education financing for your programme — including the application process, contract signing and payment management. To do so, we need to process some of your personal data. Here we explain how we do it, clearly and simply. If you would like to read all the details, please see our complete Privacy Policy.

1. Who is responsible for your data?

The data controller is Quotanda Loans, S.L., CIF B-65979890, Calle d’Aribau, 168, 1-1, 08036 Barcelona. Contact us at support@quotanda.com. If you are a UK resident, the controller is Quotanda (UK) Ltd, 11 The Terrace, London, SW13 0NP. Contact: uksupport@quotanda.com. In many cases we act on behalf of your educational institution — the school or university offering the financing programme. In that case, your institution decides how your data is processed and we manage the technical and operational process under their instructions.

2. What data do we collect?

We collect only the data needed to manage your financing:
  • Identity data: name, date of birth, national ID/passport and address.
  • Contact data: email and mobile phone.
  • Financial data: bank statements, account number (IBAN), payslips and proof of income.
  • Employment data (ISA contracts only): employment status, employer and income, provided periodically to calculate your instalments.
  • Academic data: programme, institution and enrolment status.
  • AML verification data: check of your name against international sanctions lists, in compliance with anti-money laundering regulations.
  • Technical data: IP address, device and portal activity, necessary for the service to function.
We may also consult publicly available information online or on LinkedIn to verify application information.

3. Biometric identity verification

If your programme is backed by the European Investment Fund (InvestEU), we carry out an enhanced identity verification through Jumio Corporation that includes:
  • Verification of your identity document.
  • Real-time selfie compared against your document using facial recognition.
  • Physical presence detection to prevent fraud.
This process is mandatory to access the programme. Biometric data is processed on the legal basis of substantial public interest (Art. 9.2.g GDPR), as the programme is financed with EU public funds. Jumio retains this data for up to 3 years. Data is transferred to the US with the required legal safeguards (SCCs). You will receive a specific notice before starting this process on the portal.

4. Why do we use your data?

  • To process your financing application and assess its viability.
  • To sign and administer your contract — instalments, payments and communications.
  • To verify your identity and comply with AML/KYC regulations.
  • To manage any defaults.
  • To fulfil InvestEU programme obligations where applicable.
  • To improve our service, using anonymised data where possible.
  • To send you marketing communications, only with your consent.
All decisions on your application are made by people — never by a machine alone. We use AI tools such as Anthropic’s Claude as support, but the final decision is always made by a person.

5. With whom do we share your data?

  • Your educational institution receives information on the status of your contract.
  • Technology providers: companies that help us deliver the service (digital signing, payments, communications, identity verification). See the full list in our complete privacy policy.
  • EIF and EIB: in InvestEU programmes, they may access your data for their supervisory functions as independent controllers.
  • Competent authorities: when legally required.
  • Collections agencies: only in case of non-payment and to the extent necessary.
Some providers are outside the European Union (primarily the US). In all such cases we ensure transfers are made with the legal safeguards required by the GDPR.

6. How long do we keep your data?

  • If your application is approved: for the duration of the contract and up to 36 months after closing. For InvestEU programmes, the period is longer due to EIF requirements.
  • If your application is rejected or you abandon the process: 5 years.
  • AML data: 10 years from contract closure, as required by law.
Once these periods expire, your data is securely deleted or anonymised.

7. Your rights

Right What it means
Access Know what data we hold about you and obtain a copy.
Rectification Correct inaccurate or incomplete data.
Erasure Request deletion of your data when no longer necessary.
Objection Object to processing based on legitimate interest or for marketing.
Restriction Request limitation of the use of your data in certain circumstances.
Portability Receive your data in digital format to transfer to another provider.
Human review Request that a person reviews any automated decision affecting you.
Withdraw consent Withdraw any consent you have given at any time, without retroactive effect.
To exercise any of these rights, write to support@quotanda.com (or uksupport@quotanda.com if you are a UK resident), including your full name, identity document number and the right you wish to exercise. We will respond within 30 days.

8. Supervisory authority

If you believe we have processed your data incorrectly, you may complain to the data protection authority in your country: Before lodging a complaint, we invite you to contact us directly — we are committed to resolving any issue quickly and transparently.

9. Cookies

We use cookies to improve your portal experience. See our Cookie Policy at www.quotanda.com/cookies to find out which cookies we use and how to manage them. For all the details, see our complete Privacy Policy at: https://quotanda.com/legal/en/quotanda-privacy-policy-eu-uk.pdf Quotanda Loans, S.L. · support@quotanda.com · www.quotanda.com

Simplified Privacy Notice – Quotanda México

In accordance with the LFPDPPP · In force since 21 March 2025. This is your simplified privacy notice. It contains essential information on the processing of your personal data. For full details, retention periods, international transfers and complete terms, see the Comprehensive Privacy Notice at https://quotanda.com/legal/en/quotanda-privacy-policy-latam.pdf.

1. Controller Identity and Contact

Company Quotanda México, S.A.P.I. de C.V.
RFC QME150209M46
Address Sirenas #36 int. 401, Col. Infonavit Iztacalco, Alcaldía Iztacalco, C.P. 08900, Mexico City
Contact support@quotanda.com · www.quotanda.com

2. Personal Data We Process

We process the following categories of data. Those marked as SENSITIVE require your express consent.
Category What it includes
Identification Name, date of birth, CURP, INE, passport, RFC, address, email, phone, document photograph.
Financial and patrimonial ⚠ SENSITIVE Bank statements, account movements, CLABE, proof of income, payslips, economic situation and payment history.
Credit history ⚠ SENSITIVE Queries to credit information societies (Mexico only, with your express written consent).
Employment (ISA contracts only) ⚠ SENSITIVE Employer, job title, income level, sector and periodic updates during the ISA contract.
Academic Educational institution, programme, level of study, enrolment status and dates.
Fraud prevention Verification against restrictive lists, PEP lists and international sanctions lists under AML regulations.
Technical and usage IP, device, browser, time zone, pages visited and portal access logs.

3. Why We Use Your Data

Purposes necessary for the service
Do not require your consent (except sensitive data):
  • Receiving, evaluating and resolving your financing application (Deferred Tuition, Payment Plan or ISA).
  • Verifying your identity and authenticating documentation submitted.
  • Assessing financing viability and administering your contract (instalments, collections, communications).
  • Querying credit history with credit information societies (Mexico only, with express consent).
  • Verifying against restrictive lists, PEP and international sanctions lists (AML regulations).
  • Preventing and detecting fraud and identity theft.
  • Managing non-payment situations and, where applicable, extrajudicial debt recovery.
  • Complying with fiscal, regulatory and anti-money laundering legal obligations.
  • Sending essential notices: application status, due dates, contract changes and security alerts.
  • Periodically managing employment information and income during an ISA contract (ISA holders only, with express consent).
Optional purposes
Require your separate express authorisation:
  • Sending you commercial or promotional communications about Quotanda products and services.
  • Carrying out statistical analyses and market research with anonymised or pseudonymised data.
You may object at any time by writing to support@quotanda.com. Your objection does not affect the service.

4. How to Limit the Use or Disclosure of Your Data

Email: support@quotanda.com · Suggested subject: “Data use limitation — [your full name]”. Your request will not affect the provision of the service or your contractual relationship with Quotanda.

5. Your ARCO Rights

Under the LFPDPPP 2025 you have the following rights over your personal data:
Right What it allows you to do
Access Know what data we hold about you, for what purposes and under what conditions.
Rectification Request correction of inaccurate, incomplete or out-of-date data.
Cancellation Request that we cease processing your data. Involves blocking and subsequent deletion, respecting legal retention periods.
Objection Object to the processing of your data for specific purposes, particularly commercial communications.
Limitation Request restriction of the use of your data in certain circumstances.
Withdrawal Withdraw consent given for voluntary purposes, without retroactive effect.
To exercise your ARCO rights, send your request to support@quotanda.com. Include: full name · CURP or official ID · right you wish to exercise · copy of your ID. Response time: 20 business days under the LFPDPPP 2025. If not satisfied with our response, you may lodge a complaint with the Secretaría de Anticorrupción y Buen Gobierno (authority responsible for data protection in Mexico since 21 March 2025): www.anticorrupcion.gob.mx

6. See the Comprehensive Privacy Notice

This document is a summary. The Comprehensive Privacy Notice contains full information on:
  • National and international data transfers to third parties.
  • Retention periods by applicant type (active, rejected, inactive).
  • Technical, administrative and physical security measures.
  • Cookie policy and similar technologies.
  • Procedure in the event of security breaches.
  • Rights applicable to users in Colombia, Chile and other Latin American countries.
Access the Comprehensive Notice at: https://quotanda.com/legal/en/quotanda-privacy-policy-latam.pdf Quotanda México, S.A.P.I. de C.V. · support@quotanda.com · www.quotanda.com