Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

Managing directors authorised to represent the company: Thomas Brocksch, Felix Ihde
Phone: +49 451 / 30 50 62 02
Email: contact@qualitas-pro.com

2. Data protection officer

qualitas-pro GmbH has not appointed a data protection officer, because the statutory requirements under § 38 BDSG are not met (fewer than 20 persons are constantly engaged in the automated processing of personal data). For data protection matters, please contact the management directly at contact@qualitas-pro.com.

3. General information and legal bases

We process personal data on the basis of the following provisions of the GDPR:

• Art. 6(1)(a) GDPR: consent of the data subject
• Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures (e.g. enquiries through the contact form)
• Art. 6(1)(c) GDPR: compliance with legal obligations
• Art. 6(1)(f) GDPR: legitimate interests (IT security, spam prevention, reach measurement)

4. Hosting (Amazon Web Services)

This website is operated in our own Amazon Web Services (AWS) account. The contracting party for customers in the European Economic Area is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The website content is held in S3 storage and the contact form is processed by a Lambda function; both are operated in the AWS Frankfurt am Main region (eu-central-1).

The website is delivered through the Amazon CloudFront content delivery network, which may also use locations outside the EU. If you access the website from outside the EU, it may therefore be delivered from a location outside the EU.

Processing on our behalf: We have a data processing agreement with AWS under Art. 28 GDPR (AWS GDPR Data Processing Addendum).

Transfers to third countries: Amazon Web Services EMEA SARL is based in Luxembourg. Because delivery may take place from locations outside the EU, and group companies based in the USA may be involved in operating the service, personal data is transferred to a third country on the basis of the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR, which form part of the AWS data processing agreement. Legal basis for the processing: Art. 6(1)(f) GDPR (legitimate interest in providing the website reliably).

5. Server log files

We create no access logs when you simply visit the website: access logging on the content delivery network is switched off.

The website is protected against automated attacks by a web application firewall. It keeps samples of individual requests available for inspection for no more than three hours; such a sample may contain the IP address, the URL requested and the time of the request. Requests are not logged beyond this. Legal basis: Art. 6(1)(f) GDPR (IT security).

Logs are created only when the contact form is processed. They are stored in Amazon CloudWatch Logs and deleted automatically after 14 days. Your IP address is used only as a SHA-256 hash, to prevent repeated automated submissions, and is not logged in plain text. Legal basis: Art. 6(1)(f) GDPR (security, error analysis, stability). This data is not combined with data from other sources.

6. Contact form

If you send us an enquiry through the contact form, the details you enter in the form (company, first and last name, email address, optionally your role or title, your message, your answer to what brings you here [Consulting / qp-squid / Not sure yet], and an internal note, which does not identify you by itself, of the area of the website from which you reached the form), including the contact details you provide there, are stored by us to handle your enquiry and in case of follow-up questions; for storage in our CRM system, see section 7. Your answer to what brings you here is used only to forward your enquiry to the right contact person.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) for business enquiries, and Art. 6(1)(a) GDPR (consent). Your explicit consent is obtained through the privacy policy checkbox before the form is sent, and the checkbox is not pre-selected.

The retention period is set out in section 11.

7. CRM system and processing of contact enquiries (HubSpot)

We use the HubSpot CRM system to receive, manage and answer contact enquiries. The details submitted through the contact form (see section 6) are transferred to HubSpot and stored there. Our contracting party is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland. We have a data processing agreement with HubSpot Ireland Limited under Art. 28 GDPR (HubSpot Data Processing Agreement).

HubSpot Ireland Limited uses sub-processors including HubSpot, Inc., based in the USA. Where personal data is transferred to the USA in the process, this is done on the basis of the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR, which form part of the HubSpot Data Processing Agreement.

The legal basis for the processing is Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract). No HubSpot tracking or analytics features are used on this website; no HubSpot script is loaded and no HubSpot cookies are set. The retention period is set out in section 11.

8. Web analytics (Google Analytics 4)

Where Google Analytics 4 (GA4) is enabled, it is loaded only after you have given your consent: before you consent, no GA4 scripts are loaded and no data is sent to Google. The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; data is transferred to Google LLC in the USA on the basis of the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). You can withdraw your consent at any time using the “Cookie settings” link at the bottom of every page.

9. Spam protection (Altcha)

The contact form is protected against automated spam submissions by Altcha (altcha.org, open source, MIT licence). Altcha is self-hosted (same-origin, /api/altcha); no data is transferred to third parties. The method is based on a cookie-free proof of work. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing spam).

10. Cookies and similar technologies

We do not use any reach measurement that works without consent; in particular, Plausible is not used.

We manage your consent with Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot asks for your consent and stores your decision in the CookieConsent cookie, so that we do not have to ask you again on every page you open. This cookie is strictly necessary within the meaning of § 25(2) no. 2 TDDDG and does not require consent. When Cookiebot loads, your IP address is transmitted to the Cookiebot servers for technical reasons. To document your consent (Art. 7(1) GDPR), Cookiebot logs your decision together with a randomly generated consent ID, the date and time, the URL visited and details of your browser; whether, and in what shortened form, your IP address is also stored is being verified as part of the pending legal review. The processing takes place in the EU; for it, Usercentrics uses sub-processors including Microsoft Ireland Operations Limited and BunnyWay d.o.o. (Slovenia). We have a data processing agreement with Usercentrics A/S under Art. 28 GDPR. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent), and Art. 6(1)(f) GDPR (legitimate interest in reliable consent management).

Non-essential tags, namely Google Analytics 4 for reach measurement and the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company for marketing and reach purposes, are loaded only after you have given your consent in the Cookiebot banner, and only then set cookies. These tags are not loaded before you consent. You can withdraw your consent at any time using the “Cookie settings” link at the bottom of every page (Art. 7(3) GDPR, § 25(1) TDDDG). The LinkedIn Insight Tag may involve a transfer of data to LinkedIn Corporation (USA) on the basis of the EU Standard Contractual Clauses.

11. Retention period

• Contact form data: We keep the data from contact enquiries only for as long as is necessary to handle the enquiry and any follow-up questions. We delete your data at any time on request (Art. 17 GDPR), unless statutory retention obligations prevent this; a request to the contact details in section 1 is sufficient. A fixed standard deletion period will be set as part of the ongoing legal review. If a customer relationship results, the retention obligations under commercial and tax law apply (§ 257 HGB: 6 years / § 147 AO: 10 years).
• Server log files: No access logs are created when you visit the website. The web application firewall samples are available for no more than three hours. The logs from processing the contact form are deleted automatically after 14 days.
• Google Analytics 4: If you consent, GA4 sets the cookies _ga and _ga_<property ID>. According to Google, their default lifetime is up to 24 months, but it can be configured differently in the GA4 property and restarts with new activity. For user-level and event-level data, a standard property can be set to two or 14 months; aggregated standard reports are not affected. The values actually set, and further property settings, are being verified as part of the pending legal review. After you withdraw your consent, the cookies we have set under our domain are deleted.
• Consent (Cookiebot): The CookieConsent cookie expires after 12 months, after which we ask for your consent again. Cookiebot keeps the proof of your consent for 12 months. Both periods follow the configuration of our Cookiebot account and are being verified as part of the pending legal review.

12. Rights of data subjects

You have the following rights against the controller:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7(3) GDPR)

To exercise your rights, please contact contact@qualitas-pro.com.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for qualitas-pro GmbH, which is based in Lübeck, is:

14. Right to withdraw consent

You can withdraw any consent you have given at any time, with effect for the future (Art. 7(3) GDPR). The lawfulness of the processing carried out before the withdrawal remains unaffected. You can send your withdrawal informally to contact@qualitas-pro.com.

15. Obligation to provide personal data

Providing the contact form details marked as required (company, first and last name, email, message, what brings you here, consent) is necessary for us to handle your enquiry. Without these details we cannot handle your enquiry. There is no contractual or statutory obligation to provide them.

16. Automated decision-making / profiling

There is no automated decision-making within the meaning of Art. 22 GDPR. If you have consented to the use of Google Analytics 4, your usage behaviour is analysed pseudonymously (profiling within the meaning of Art. 4(4) GDPR). The analysis serves to measure reach and to improve our website, and has no legal or similarly significant effect on you. Which additional processing is enabled by the external GA4 property configuration is being verified as part of the pending legal review. You can withdraw your consent at any time using the “Cookie settings” link at the bottom of every page.

17. B2B clause (§ 14 BGB)

qualitas-pro GmbH concludes contracts exclusively with businesses (Unternehmer within the meaning of § 14 BGB). Our services are not addressed to consumers within the meaning of § 13 BGB.

18. Validity and changes to this privacy policy

This privacy policy is currently valid and is dated September 2026. As our website and services develop, or because of changes in legal or regulatory requirements, it may become necessary to change this privacy policy. The current privacy policy can be viewed on this page at any time.