Works council & DPIA pack

Everything a works council, a data protection officer or an employee needs to assess Quorum: the floors below which it withholds a figure, what each source sends, what is kept and for how long, and the few places it holds anything about one person. Every threshold on this page is read from the value the product enforces. Quorum is provided by Creative Coders sp. z o.o., which processes the data on the employer’s behalf.

Download as Markdown:Whole pack Works council FAQ Employee FAQ DPIA helper

Principles

Quorum never evaluates, scores or ranks an individual. Analytics operate at organization, team and meeting-series level; there is no per-person score, ranking or productivity metric, and no feature may add one.
Quorum is read-only on calendars. Its policy rules are measurement, never enforcement: it holds read-only calendar scopes, so it cannot create, move, decline or cancel a meeting. Only the organizer changes a calendar.
AI recommends, a person decides. A recommendation and the organizer's decision are stored separately. Cost, health scores and savings are deterministic code — no model produces a number.
Sensitive meetings are reduced at ingestion, not hidden in the interface. A 1:1, review, pay, hiring, disciplinary, medical, HR or legal meeting keeps only its time — no participants, attendance, cost or AI output.
Written work is counted, never read. Message, comment and description text is discarded on arrival; conversations are stored as counts, participants and timestamps, and there is no per-person message count anywhere.

Privacy floors

A floor is the smallest group a figure may describe. Below it the figure is withheld, not estimated or blurred.

Floor	Threshold	What it withholds
Team size	3 active people	Per-person rates (meeting hours per person per week, share of the week in meetings), focus figures, the team efficiency grade and the load band. A team below the floor is left off the Load screen entirely and only the number of such teams is reported. The company-wide row is gated on the same floor. Cost totals are deliberately not gated: what a unit committed to in meeting invitations is a budget fact about the unit, not a rate or a score about a person.
Response-time sample	5 conversations and 3 people	Time to first response for a team, repository, Slack or Teams channel, Jira project, Linear team or GitLab project. Below 5 conversations, or 3 distinct participants, the figure is withheld; a team's figure also needs 3 active members. Quorum never reports who answers slowest.
Distribution cohort	10 people	The distribution of weekly meeting time across the analysed population — a median and the share above a stated threshold. Below 10 people nothing is shown. No percentile above the median is published at any size, because near the top it describes one person's week.
Attendance coverage	80% of a team's measurable meetings measured	The team grade. This is an evidence floor rather than a privacy floor: below it the grade is withheld with the reason, because it would rest on too few measured meetings. Meetings no platform can measure (no conferencing link, or a platform the workspace has not connected) are outside the basis and stated beside it.
Author digest lifetime	30 days at most	The keyed digest of a conversation's author (see below) is deleted when someone else answers, and in any case after 30 days.

What each source sends

Quorum contacts a provider only after an administrator connects it. The full list of third parties is on the Security & sub-processors page.

Source	What Quorum processes	What it never processes
Calendars — Microsoft Outlook (Graph) and Google Calendar	Event title and description, start and end, recurrence, join URL, organizer, invitee list and RSVP status, through read-only calendar permissions. Every invitee's copy is merged into one meeting so it is priced once.	No event is created, changed, declined or cancelled. A meeting whose title or description matches a private topic is reduced to its time before it is stored.
Meeting platforms — Microsoft Teams, Google Meet and Zoom	Join and leave times per participant, to measure what a meeting actually cost. Transcript speaker segments only if an administrator switches transcript analysis on; it is off by default.	No bot joins a call and Quorum fetches no audio or video. Google Meet attendance is excluded from every named person view.
Slack	Member ids and work emails, to match accounts (only matches are kept), and delivery of Quorum's own messages. After a separate administrator opt-in, reply events from public channels Quorum is invited to: an event id, a count, a timestamp, the mapped participants and the channel's name.	Message text arrives in Slack's event envelope and is discarded at the request boundary — never stored, logged or sent to a model.
Microsoft Teams channels	After a separate administrator opt-in and each team owner's consent: message and thread ids as opaque receipts, times, participants matched by work email from the Teams roster, and the channel and team names.	Message text is discarded on arrival — never stored, logged or sent to a model.
GitHub	Signed webhooks and count-only queries for the repositories an administrator connects: participant logins, titles, timestamps, state and comment totals.	Comment bodies and code are never requested or stored.
Jira, Linear and GitLab	Signed webhooks for the sites, workspaces and projects an administrator adds: the issue or merge request key and title, ids, dates, state, and participants mapped to colleagues.	Descriptions and comment bodies are discarded on arrival. Confidential GitLab issues are ignored. Quorum makes no request back to these vendors.
HRIS — through Merge or Kombo	Work email, name, job title, employment status and dates, reporting manager references and group memberships, through a read-only connection, to keep the directory current.	No payroll, private contact details, bank data or raw HRIS responses. Reporting lines do not grant dashboard permissions by themselves.
Cost bands	An hourly rate per band and which band each person is in, entered by an administrator. The only input that turns hours into money.	Never inferred and never fetched from a payroll system.
AI analysis (Google Gemini and/or OpenAI), when enabled	Meeting title, agenda and invitee roles, to recommend who needs to attend live; for the assistant, a sheet of team-, series- and workspace-level figures the reader can already open.	Never sensitive-meeting content, never a per-person figure. Without AI analysis nothing is sent to any model.

Per-person data, stated plainly

The conversation author fingerprint

Some sources (a Teams reply, a Jira or Linear comment) do not say whose conversation a reply belongs to. To tell an answer from the author's own follow-up, Quorum holds a keyed one-way digest of the author, salted with that one conversation, so it cannot be matched across conversations. It is deleted as soon as someone else answers, and after 30 days at most. It is never shown anywhere.

Private-time blocks

When a private meeting is reduced to its time, each person whose calendar holds it keeps a block with only their start and end — no meeting, title, event or other person. Blocks are read only to compute meeting hours and focus for teams of at least 3 active people, and to show the same person their own hours in My week. They never appear per person to anyone else, per meeting, in the heatmap or in any money figure.

Named calendar commitments for workload planning

Administrators, and managers for people in their own team subtree, can see a person's calendar commitments and factual participation in meetings, to plan workload. These are facts, not scores: there is no rating, ranking or productivity figure, and they are not offered as a sort key. Google Meet attendance is excluded from these views.

My week: each person's own figures, for that person only

Every person can see their own last week and a four-week trend — meeting hours (private meetings as time only), share of the working week, focus days, back-to-back stretches, invitations not joined, written threads and the recurring meetings they organize. Only that person can open it: not their manager, not an administrator, not the assistant, and it is in no report, export, audit entry or log. It is computed when opened and not stored. It shows no score and names no colleague; the only comparison is with the person's own team aggregate, and only when the rest of the team is at least 3 people. Administrators can switch sign-in to it off for employees without dashboard access, and each person can hide it.

Attendance recommendations

With AI analysis on, an invitee can receive a private recommendation about whether a meeting needs them live. It is a suggestion about a meeting, not an assessment of the person, and nothing changes unless the organizer acts.

Retention

Data	How long it is kept
Meetings, attendance, recommendations and decisions	365 days by default; each workspace sets its own window in Settings. A daily job deletes everything older.
Conversation volume (counts, participants, timestamps)	The same window, 365 days by default, measured from the last message.
Private-time blocks	The same window as meetings, and deleted when the person is erased or the workspace is deleted.
My week settings (hidden, weekly message on or off) — the figures themselves are never stored	Until the person changes them; deleted when the person is erased or the workspace is deleted.
People who have been deactivated	Erased by the daily job once deactivated longer than the workspace's window (the meeting window, 365 days by default, unless an administrator sets a separate one). Past meetings keep an anonymous participant in their place, so their size and stored cost do not change.
Conversation author digest	Until someone else answers, and never longer than 30 days.
Transcripts (only if switched on)	30 days by default — the shortest window, because it is the most sensitive record.
Assistant usage (time and outcome; never the question or answer)	90 days, or the workspace window if that is shorter.
Operational records (job logs, calendar copies used to merge invitations, model inputs)	Fixed windows enforced by the same daily job, independent of the workspace setting.
Workspace export archives	Encrypted while they wait to be downloaded, and deleted after 7 days.
Everything, when the workspace is deleted	Deleted 14 days after an administrator (or, at contract end, Quorum) asks, unless an administrator cancels. Only a record that the deletion happened remains, and the audit trail until its own window ends; backups allow recovery for 3 days.

See the Privacy notice for how to request deletion ahead of a window.

Works council FAQ

Is Quorum a performance-monitoring tool?

No. It measures what meetings and written threads cost a team and recommends where fewer people need to be live. It produces no per-person score, ranking or productivity metric, and its own rules forbid adding one. Google's Meet terms prohibit using Meet data for performance tracking, and Quorum applies that rule to every provider.

What is the smallest group Quorum reports on?

Per-person rates, grades and load bands need a team of 3 active people; response times need 5 conversations and 3 people; distributions need 10 people. Below a floor the figure is withheld, not estimated. Cost totals are reported at any size, because they are budget facts about a unit rather than measurements of a person.

What can a manager see about an individual?

Calendar commitments and factual participation for people in their own team subtree, for workload planning, excluding Google Meet attendance. No score, rating or ranking, no person's private meetings — those exist only as time inside team totals — and never anyone's My week, which only its own person can open.

Can Quorum change, decline or cancel meetings?

No. It holds read-only calendar permissions. Meeting policy in Quorum is measurement: it reports how a calendar compares with the rules you declare, and the organizer decides what to change.

Does Quorum read what employees write?

No. Slack, Teams, Jira, Linear and GitLab deliver text with their events; Quorum discards it on arrival and keeps counts, times and participants. GitHub is queried for counters only.

Does AI decide anything about employees?

No. AI is optional and only recommends whether a meeting needs a given invitee live. The organizer's decision is stored separately and nothing changes unless they act. AI never sees sensitive meetings and never produces a cost or a score.

How long is data kept?

365 days by default for meetings, attendance and conversation volume, 30 days for transcripts if they are switched on, and 30 days at most for an author digest. People who have been deactivated are erased after the workspace's window. A daily job enforces it; the windows can be set in Settings and agreed with you. Employees can download their own data from My week, administrators can erase a person or export the whole workspace, and deleting the workspace deletes everything after a 14-day cooling-off.

What can be agreed in a works agreement?

Which sources are connected, whether the optional sources (Slack or Teams channel tracking, transcript analysis) are switched on, the retention windows, and whether the workspace assistant is available are all workspace settings. Policy, cost-band and access changes are recorded in an audit trail visible to administrators in Settings.

Employee FAQ

What does Quorum know about me?

The meetings on your work calendar (title, time, invitees and responses), when you joined and left calls, your directory entry (name, work email, role, team) and the cost band your employer assigned. For written threads, that you took part — never what you wrote.

Will my manager get a score or ranking of me?

No. Quorum has no per-person score or ranking. Team figures are shown only for teams of at least 3 people, so a team figure is never your figure. Your manager can see your calendar commitments and meeting participation for workload planning, as facts.

Can I see my own figures?

Yes, and only you can. My week shows your own meeting hours, focus days, back-to-back stretches and the recurring meetings you organize, for last week and the three before. Sign in with your work account, or type /quorum me in Slack; you can also ask for it as a private weekly message, or hide it. Your manager and administrators cannot open it.

Does Quorum read my messages?

No. Text from chat and issue trackers is discarded on arrival. Quorum counts messages per thread, never per person.

What about my 1:1s, reviews or medical appointments?

Meetings on private topics are reduced to their time before they are stored: no title, participants or attendance. Their time counts only inside the meeting hours of a team of at least 3 people.

Will Quorum change my calendar?

No. It cannot create, move, decline or cancel a meeting. You may receive a private suggestion about whether a meeting needs you live; the organizer decides.

Does a bot join my calls?

No. Attendance comes from the meeting platform's own join and leave records.

How long is my data kept, and who can I ask?

Meeting data is deleted after 365 days unless your employer set a different window. If you leave and are deactivated, you are erased after the same window. You can download everything Quorum stores about you from My week. Your employer is responsible for this processing: ask your administrator or data protection contact to correct or erase your data — administrators can erase a person from Quorum. Creative Coders sp. z o.o., the company that provides Quorum, processes the data on your employer's behalf.

DPIA helper

An outline for your data protection officer. Each heading carries the facts Quorum can supply; the assessment, the lawful basis and your organizational measures are yours to complete.

Purpose of processing

State your purpose and the decisions it informs.

Measuring the cost of meetings and written threads at team and series level, and recommending where fewer people need to attend live.
Not performance evaluation: Quorum produces no per-person score, ranking or productivity metric.

Data subjects

List the groups affected and any you exclude.

Employees in the connected directory and calendars; external invitees appear as invitees only and carry no cost.

Data categories

Confirm which sources you will connect.

Calendars — Microsoft Outlook (Graph) and Google Calendar: Event title and description, start and end, recurrence, join URL, organizer, invitee list and RSVP status, through read-only calendar permissions. Every invitee's copy is merged into one meeting so it is priced once.
Meeting platforms — Microsoft Teams, Google Meet and Zoom: Join and leave times per participant, to measure what a meeting actually cost. Transcript speaker segments only if an administrator switches transcript analysis on; it is off by default.
Slack: Member ids and work emails, to match accounts (only matches are kept), and delivery of Quorum's own messages. After a separate administrator opt-in, reply events from public channels Quorum is invited to: an event id, a count, a timestamp, the mapped participants and the channel's name.
Microsoft Teams channels: After a separate administrator opt-in and each team owner's consent: message and thread ids as opaque receipts, times, participants matched by work email from the Teams roster, and the channel and team names.
GitHub: Signed webhooks and count-only queries for the repositories an administrator connects: participant logins, titles, timestamps, state and comment totals.
Jira, Linear and GitLab: Signed webhooks for the sites, workspaces and projects an administrator adds: the issue or merge request key and title, ids, dates, state, and participants mapped to colleagues.
HRIS — through Merge or Kombo: Work email, name, job title, employment status and dates, reporting manager references and group memberships, through a read-only connection, to keep the directory current.
Cost bands: An hourly rate per band and which band each person is in, entered by an administrator. The only input that turns hours into money.
AI analysis (Google Gemini and/or OpenAI), when enabled: Meeting title, agenda and invitee roles, to recommend who needs to attend live; for the assistant, a sheet of team-, series- and workspace-level figures the reader can already open.

Data not processed

Confirm these exclusions meet your requirements.

Calendars — Microsoft Outlook (Graph) and Google Calendar: No event is created, changed, declined or cancelled. A meeting whose title or description matches a private topic is reduced to its time before it is stored.
Meeting platforms — Microsoft Teams, Google Meet and Zoom: No bot joins a call and Quorum fetches no audio or video. Google Meet attendance is excluded from every named person view.
Slack: Message text arrives in Slack's event envelope and is discarded at the request boundary — never stored, logged or sent to a model.
Microsoft Teams channels: Message text is discarded on arrival — never stored, logged or sent to a model.
GitHub: Comment bodies and code are never requested or stored.
Jira, Linear and GitLab: Descriptions and comment bodies are discarded on arrival. Confidential GitLab issues are ignored. Quorum makes no request back to these vendors.
HRIS — through Merge or Kombo: No payroll, private contact details, bank data or raw HRIS responses. Reporting lines do not grant dashboard permissions by themselves.
Cost bands: Never inferred and never fetched from a payroll system.
AI analysis (Google Gemini and/or OpenAI), when enabled: Never sensitive-meeting content, never a per-person figure. Without AI analysis nothing is sent to any model.
Sensitive meetings keep only their time; no participants, attendance, cost or AI output.

Recipients

Name your internal recipients and add the sub-processors you enable.

Inside your organization: administrators (workspace), managers (their own team subtree), organizers (their own meetings).
Processor: Creative Coders sp. z o.o., ul. Płk. Zoltána Baló 6 lok. 5, 02-793 Warszawa, Poland, KRS 0001271368 — the company that provides Quorum — processes the data on your behalf.
Sub-processors: Render hosts the service; every other provider receives data only when you connect it. The Security & sub-processors page lists each one and what it receives.

Retention

Record the windows you configure.

Meetings, attendance, recommendations and decisions: 365 days by default; each workspace sets its own window in Settings. A daily job deletes everything older.
Conversation volume (counts, participants, timestamps): The same window, 365 days by default, measured from the last message.
Private-time blocks: The same window as meetings, and deleted when the person is erased or the workspace is deleted.
My week settings (hidden, weekly message on or off) — the figures themselves are never stored: Until the person changes them; deleted when the person is erased or the workspace is deleted.
People who have been deactivated: Erased by the daily job once deactivated longer than the workspace's window (the meeting window, 365 days by default, unless an administrator sets a separate one). Past meetings keep an anonymous participant in their place, so their size and stored cost do not change.
Conversation author digest: Until someone else answers, and never longer than 30 days.
Transcripts (only if switched on): 30 days by default — the shortest window, because it is the most sensitive record.
Assistant usage (time and outcome; never the question or answer): 90 days, or the workspace window if that is shorter.
Operational records (job logs, calendar copies used to merge invitations, model inputs): Fixed windows enforced by the same daily job, independent of the workspace setting.
Workspace export archives: Encrypted while they wait to be downloaded, and deleted after 7 days.
Everything, when the workspace is deleted: Deleted 14 days after an administrator (or, at contract end, Quorum) asks, unless an administrator cancels. Only a record that the deletion happened remains, and the audit trail until its own window ends; backups allow recovery for 3 days.

Lawful basis

Your assessment; Quorum cannot make it for you.

Calendar and attendance analytics are commonly assessed under legitimate interest with a documented balancing test; transcript analysis requires a separate administrator enablement and is off by default.

Risks to employees

Rate likelihood and severity for your context.

Function creep: the data being used to judge individuals.
Re-identification of an individual inside a small team's figures.
Inference from private time: a team's hours moving between weeks can show that someone on it had private meetings, though not who or with whom.
Named workload views read as monitoring if employees are not told about them.
Transfer of meeting titles and agendas to an AI provider when AI analysis is enabled.

Mitigations

Add your organizational measures, such as a works agreement and an employee notice.

Team size floor (3 active people): Per-person rates (meeting hours per person per week, share of the week in meetings), focus figures, the team efficiency grade and the load band. A team below the floor is left off the Load screen entirely and only the number of such teams is reported. The company-wide row is gated on the same floor. Cost totals are deliberately not gated: what a unit committed to in meeting invitations is a budget fact about the unit, not a rate or a score about a person.
Response-time sample floor (5 conversations and 3 people): Time to first response for a team, repository, Slack or Teams channel, Jira project, Linear team or GitLab project. Below 5 conversations, or 3 distinct participants, the figure is withheld; a team's figure also needs 3 active members. Quorum never reports who answers slowest.
Distribution cohort floor (10 people): The distribution of weekly meeting time across the analysed population — a median and the share above a stated threshold. Below 10 people nothing is shown. No percentile above the median is published at any size, because near the top it describes one person's week.
Attendance coverage floor (80% of a team's measurable meetings measured): The team grade. This is an evidence floor rather than a privacy floor: below it the grade is withheld with the reason, because it would rest on too few measured meetings. Meetings no platform can measure (no conferencing link, or a platform the workspace has not connected) are outside the basis and stated beside it.
Author digest lifetime floor (30 days at most): The keyed digest of a conversation's author (see below) is deleted when someone else answers, and in any case after 30 days.
No per-person score, ranking or sort by a person's behaviour exists in the product.
Read-only calendar permissions; message text discarded on arrival; sensitive meetings reduced at ingestion.
Retention enforced by a daily job; credentials encrypted with AES-256-GCM; every query scoped to your workspace; administrative changes recorded in an audit trail.
Data rights built in: each employee downloads their own data from My week; administrators export or erase one person, export the whole workspace, or delete it after a cooling-off period; deactivated people are erased after the retention window.

Consultation and transparency

Record works council consultation, the employee notice and its date.

The Employee FAQ in this pack can be shared with employees as written.
Announce the rollout, name the controller, state the purpose, the retention and how to exercise data rights.