# Quorum — DPIA helper

_Quorum is a product of Creative Coders sp. z o.o., ul. Płk. Zoltána Baló 6 lok. 5, 02-793 Warszawa, Poland · KRS 0001271368 · Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy Krajowego Rejestru Sądowego · NIP 9512657914 · share capital PLN 5,000.00_

## DPIA helper

### Purpose of processing

_State your purpose and the decisions it informs._

- Measuring the cost of meetings and written threads at team and series level, and recommending where fewer people need to attend live.
- Not performance evaluation: Quorum produces no per-person score, ranking or productivity metric.

Your notes:

### Data subjects

_List the groups affected and any you exclude._

- Employees in the connected directory and calendars; external invitees appear as invitees only and carry no cost.

Your notes:

### Data categories

_Confirm which sources you will connect._

- Calendars — Microsoft Outlook (Graph) and Google Calendar: Event title and description, start and end, recurrence, join URL, organizer, invitee list and RSVP status, through read-only calendar permissions. Every invitee's copy is merged into one meeting so it is priced once.
- Meeting platforms — Microsoft Teams, Google Meet and Zoom: Join and leave times per participant, to measure what a meeting actually cost. Transcript speaker segments only if an administrator switches transcript analysis on; it is off by default.
- Slack: Member ids and work emails, to match accounts (only matches are kept), and delivery of Quorum's own messages. After a separate administrator opt-in, reply events from public channels Quorum is invited to: an event id, a count, a timestamp, the mapped participants and the channel's name.
- Microsoft Teams channels: After a separate administrator opt-in and each team owner's consent: message and thread ids as opaque receipts, times, participants matched by work email from the Teams roster, and the channel and team names.
- GitHub: Signed webhooks and count-only queries for the repositories an administrator connects: participant logins, titles, timestamps, state and comment totals.
- Jira, Linear and GitLab: Signed webhooks for the sites, workspaces and projects an administrator adds: the issue or merge request key and title, ids, dates, state, and participants mapped to colleagues.
- HRIS — through Merge or Kombo: Work email, name, job title, employment status and dates, reporting manager references and group memberships, through a read-only connection, to keep the directory current.
- Cost bands: An hourly rate per band and which band each person is in, entered by an administrator. The only input that turns hours into money.
- AI analysis (Google Gemini and/or OpenAI), when enabled: Meeting title, agenda and invitee roles, to recommend who needs to attend live; for the assistant, a sheet of team-, series- and workspace-level figures the reader can already open.

Your notes:

### Data not processed

_Confirm these exclusions meet your requirements._

- Calendars — Microsoft Outlook (Graph) and Google Calendar: No event is created, changed, declined or cancelled. A meeting whose title or description matches a private topic is reduced to its time before it is stored.
- Meeting platforms — Microsoft Teams, Google Meet and Zoom: No bot joins a call and Quorum fetches no audio or video. Google Meet attendance is excluded from every named person view.
- Slack: Message text arrives in Slack's event envelope and is discarded at the request boundary — never stored, logged or sent to a model.
- Microsoft Teams channels: Message text is discarded on arrival — never stored, logged or sent to a model.
- GitHub: Comment bodies and code are never requested or stored.
- Jira, Linear and GitLab: Descriptions and comment bodies are discarded on arrival. Confidential GitLab issues are ignored. Quorum makes no request back to these vendors.
- HRIS — through Merge or Kombo: No payroll, private contact details, bank data or raw HRIS responses. Reporting lines do not grant dashboard permissions by themselves.
- Cost bands: Never inferred and never fetched from a payroll system.
- AI analysis (Google Gemini and/or OpenAI), when enabled: Never sensitive-meeting content, never a per-person figure. Without AI analysis nothing is sent to any model.
- Sensitive meetings keep only their time; no participants, attendance, cost or AI output.

Your notes:

### Recipients

_Name your internal recipients and add the sub-processors you enable._

- Inside your organization: administrators (workspace), managers (their own team subtree), organizers (their own meetings).
- Processor: Creative Coders sp. z o.o., ul. Płk. Zoltána Baló 6 lok. 5, 02-793 Warszawa, Poland, KRS 0001271368 — the company that provides Quorum — processes the data on your behalf.
- Sub-processors: Render hosts the service; every other provider receives data only when you connect it. The Security & sub-processors page lists each one and what it receives.

Your notes:

### Retention

_Record the windows you configure._

- Meetings, attendance, recommendations and decisions: 365 days by default; each workspace sets its own window in Settings. A daily job deletes everything older.
- Conversation volume (counts, participants, timestamps): The same window, 365 days by default, measured from the last message.
- Private-time blocks: The same window as meetings, and deleted when the person is erased or the workspace is deleted.
- My week settings (hidden, weekly message on or off) — the figures themselves are never stored: Until the person changes them; deleted when the person is erased or the workspace is deleted.
- People who have been deactivated: Erased by the daily job once deactivated longer than the workspace's window (the meeting window, 365 days by default, unless an administrator sets a separate one). Past meetings keep an anonymous participant in their place, so their size and stored cost do not change.
- Conversation author digest: Until someone else answers, and never longer than 30 days.
- Transcripts (only if switched on): 30 days by default — the shortest window, because it is the most sensitive record.
- Assistant usage (time and outcome; never the question or answer): 90 days, or the workspace window if that is shorter.
- Operational records (job logs, calendar copies used to merge invitations, model inputs): Fixed windows enforced by the same daily job, independent of the workspace setting.
- Workspace export archives: Encrypted while they wait to be downloaded, and deleted after 7 days.
- Everything, when the workspace is deleted: Deleted 14 days after an administrator (or, at contract end, Quorum) asks, unless an administrator cancels. Only a record that the deletion happened remains, and the audit trail until its own window ends; backups allow recovery for 3 days.

Your notes:

### Lawful basis

_Your assessment; Quorum cannot make it for you._

- Calendar and attendance analytics are commonly assessed under legitimate interest with a documented balancing test; transcript analysis requires a separate administrator enablement and is off by default.

Your notes:

### Risks to employees

_Rate likelihood and severity for your context._

- Function creep: the data being used to judge individuals.
- Re-identification of an individual inside a small team's figures.
- Inference from private time: a team's hours moving between weeks can show that someone on it had private meetings, though not who or with whom.
- Named workload views read as monitoring if employees are not told about them.
- Transfer of meeting titles and agendas to an AI provider when AI analysis is enabled.

Your notes:

### Mitigations

_Add your organizational measures, such as a works agreement and an employee notice._

- Team size floor (3 active people): Per-person rates (meeting hours per person per week, share of the week in meetings), focus figures, the team efficiency grade and the load band. A team below the floor is left off the Load screen entirely and only the number of such teams is reported. The company-wide row is gated on the same floor. Cost totals are deliberately not gated: what a unit committed to in meeting invitations is a budget fact about the unit, not a rate or a score about a person.
- Response-time sample floor (5 conversations and 3 people): Time to first response for a team, repository, Slack or Teams channel, Jira project, Linear team or GitLab project. Below 5 conversations, or 3 distinct participants, the figure is withheld; a team's figure also needs 3 active members. Quorum never reports who answers slowest.
- Distribution cohort floor (10 people): The distribution of weekly meeting time across the analysed population — a median and the share above a stated threshold. Below 10 people nothing is shown. No percentile above the median is published at any size, because near the top it describes one person's week.
- Attendance coverage floor (80% of a team's measurable meetings measured): The team grade. This is an evidence floor rather than a privacy floor: below it the grade is withheld with the reason, because it would rest on too few measured meetings. Meetings no platform can measure (no conferencing link, or a platform the workspace has not connected) are outside the basis and stated beside it.
- Author digest lifetime floor (30 days at most): The keyed digest of a conversation's author (see below) is deleted when someone else answers, and in any case after 30 days.
- No per-person score, ranking or sort by a person's behaviour exists in the product.
- Read-only calendar permissions; message text discarded on arrival; sensitive meetings reduced at ingestion.
- Retention enforced by a daily job; credentials encrypted with AES-256-GCM; every query scoped to your workspace; administrative changes recorded in an audit trail.
- Data rights built in: each employee downloads their own data from My week; administrators export or erase one person, export the whole workspace, or delete it after a cooling-off period; deactivated people are erased after the retention window.

Your notes:

### Consultation and transparency

_Record works council consultation, the employee notice and its date._

- The Employee FAQ in this pack can be shared with employees as written.
- Announce the rollout, name the controller, state the purpose, the retention and how to exercise data rights.

Your notes: