Effective date: 17 October 2026
This policy explains how QUAD – A GROUP LTD, formerly QUAD-A RECORDS LIMITED, handles personal information through Situation Room at work.quad-a.com. We operate Situation Room from Kampala, Uganda, to manage our business, projects, approvals and communications, including work for Quad-A, Quad-A Academy and XP Africa.
Situation Room is intended for authorised business users and invited collaborators. Its public privacy page does not make private company records or connected accounts public. For privacy questions or requests, email ahuurra@quad-a.com with the subject “Situation Room privacy”.
Information we handle
- Accounts and access: names, business contact details, usernames, roles, authentication records and access permissions.
- Business records: information users enter or make available through authorised connections, such as project notes, contacts, files, messages, calendar items, tasks, budgets, drafts, approvals and activity records. The information available depends on each user’s permissions and the services connected.
- Connected-service information: account or Page identifiers, authorised roles, access tokens and connection status, together with the content and statistics required for the features in use.
- Technical information: IP addresses, browser and device information, request times, error records, security logs and cookies or local preferences needed to operate the service.
- AI and media work: prompts, selected context, uploaded materials, generated responses, audio, images and videos, and their review history.
Why we use information
We use information to provide and secure Situation Room; manage authorised projects and business operations; prepare and review content; deliver approved communications; report on company activity; investigate errors; and respond to requests or legal obligations. We process information where necessary for our business relationship, legitimate operational interests, applicable legal obligations, or consent where required. A connected account’s authorisation can be withdrawn.
We do not sell personal information. We do not use the LinkedIn connector for advertising audience building or to collect private member messages. Staff access is limited by the roles and permissions assigned within the service.
LinkedIn company Page integration
When LinkedIn grants the necessary product access and an authorised Page administrator connects their account, Situation Room uses LinkedIn’s authorisation process to request permission to read company Page activity, publish company Page content and check Page administration roles. These capabilities correspond to the requested permissions r_organization_social, w_organization_social and rw_organization_admin. A request for permission does not mean LinkedIn has approved or enabled it.
The connector is configured for the Quad – A Group, Quad-A Academy and XP Africa Pages. It handles authorised Page roles, Page identifiers, prepared posts and media, publication identifiers and links, and aggregate statistics such as followers, impressions, clicks and engagement counts. It does not currently retrieve individual commenters’ profiles, private messages or members’ connection lists.
LinkedIn account passwords are entered on LinkedIn, not collected by Situation Room. Situation Room stores the access credentials LinkedIn returns so that authorised Page operations can work. Content released for publication is sent to LinkedIn and becomes visible according to the Page and post settings. LinkedIn handles that published content under its own Privacy Policy.
We do not train or fine-tune AI models on LinkedIn API data. We use LinkedIn data only for the authorised business features and subject to LinkedIn’s applicable use, storage and deletion requirements. You can revoke the app’s access in your LinkedIn account settings and contact us to request removal of stored connection information. Revoking access does not by itself remove posts already published on LinkedIn; those must be managed on LinkedIn or through an authorised deletion request.
AI assistance and external providers
AI features send prompts and the context selected or supplied to the feature to the configured provider for processing. Depending on the feature and configuration, providers may include OpenAI, Google and ElevenLabs. Users should include only information they are authorised to process and should not put passwords, unnecessary identity documents or unrelated confidential records into prompts. Generated material may contain errors and should be reviewed before use.
Hosting and technical service providers, including Hostinger, process information needed to operate and maintain the site. Connected services such as Dropbox, Google services and social publishing services process information when the relevant connection or action is used. LinkedIn company posting uses the direct LinkedIn connector. Connecting another service does not give all Situation Room users unrestricted access to it.
External providers have their own privacy terms and retention practices. Relevant notices include OpenAI, Google, ElevenLabs, Hostinger and Dropbox. Processing by a provider can involve systems outside Uganda. We consider the purpose, permissions and applicable safeguards when making information available to a provider.
Sharing and publication
Information is available to authorised personnel and service providers as needed for their work. Approved communications and published content are shared with their intended recipients or platforms. We may also disclose information where required by law or necessary to address fraud, security incidents or the protection of legal rights. Drafts and private files are not intended for public publication simply because they are stored in Situation Room.
Retention and deletion
We retain information for the operational purpose for which it is held, taking account of project history, contractual requirements, legal obligations, security and applicable platform limits. Different records have different retention needs; there is no single retention period for all Situation Room information.
The LinkedIn reporting view keeps up to 60 dated daily entries per Page metric. Page-role information is cached for refresh, and publication records and per-post reports can remain in the business record until removed. LinkedIn-sourced data must be removed or refreshed within the applicable LinkedIn limits, including in response to a valid deletion request or withdrawal where required. Company-authored drafts and independently supplied business records are considered separately from LinkedIn-sourced data.
Deletion requests are assessed against the purpose and any legal retention requirements. Backups and security records may persist separately until their normal replacement or retention period ends; they should not be used to restore deleted information to routine use. We will explain any material reason we cannot fulfil a request in full.
Cookies and security
Situation Room uses authentication and session cookies and may store interface preferences needed for sign-in and normal operation. Connected or embedded third-party services may use their own cookies. You can control cookies through your browser, although blocking essential cookies can prevent sign-in or other features from working.
We use HTTPS, authenticated access, permission checks and operational safeguards to reduce unauthorised access. No online service can guarantee complete security. Tell us promptly if you believe your access or company information has been compromised.
Your choices and rights
Subject to applicable law and necessary identity checks, you can ask us to explain the personal information we hold about you, provide access, correct inaccurate information, remove information, or consider an objection or restriction. You can withdraw consent where consent is the basis for processing and revoke connected-service access through that service. Withdrawal does not invalidate processing already carried out lawfully.
Send requests to ahuurra@quad-a.com. Tell us which account, record or connection your request concerns; do not send a password or access token. If you are dissatisfied with how we handle a privacy concern, you may contact Uganda’s Personal Data Protection Office.
Children and changes to this policy
Situation Room is a business workspace and is not directed at children. If information about a child is needed for an authorised project, it must be handled with the permissions and safeguards appropriate to that project. Contact us if you believe information has been supplied without proper authority.
We will update this page when our processing changes and revise the effective date. Material changes affecting users’ choices will be communicated where appropriate.