Privacy Policy

1. Data Controller and Data Protection Officer

1.1 Name and address of the data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:

Qlar Europe GmbH

Pallaswiesenstraße 100

64293 Darmstadt

Germany

T +49 61 51-15 31 0

info@qlar.com

Management:

Dr Jörg Ulrich

1.2 Name and address of the Data Protection Officer

The data protection officer for the data controller is:

Graf von Westphalen Verwaltungs GmbH

Poststr. 9 – Alte Post

20354 Hamburg

datenschutz@qlar.com

2. General information on data processing

2.1 Scope of personal data processing

We generally collect and process your personal data only to the extent necessary to provide the website and our services.

2.2 Legal basis for the processing of personal data

You can find out the legal basis for the processing under the specific data processing operations.

2.3 Data erasure and retention period

We will delete or block your personal data as soon as the purpose of the processing no longer applies. However, data may be stored beyond the original purpose if this is required by national or international regulations to which we are subject. In such cases, the data will be blocked or deleted once the retention period prescribed by the aforementioned regulations expires, unless there is a need to continue storing the data for the conclusion or fulfilment of a contract.

3. Collection of data when visiting our website

3.1 When you use the website purely for information purposes, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server. When you view the website, we collect the following data, which is technically necessary to display our website to you and to ensure its stability and security:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request originates
• Browser
• Operating system and its interface
• Language and version of the browser software.

3.2 The legal basis for the processing is Section 25(2)(2) of the Telecommunications, Digital Services and Data Protection Act (TDDDG) or Article 6(1)(f) of the GDPR.

3.3 The collection of data for the provision of the website and the storage of data in the log files is strictly necessary for the operation of the website. You therefore have no right to object.

4. Cookies

In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and associated with the browser you are using, and through which certain information is transmitted to us or third parties. Cookies cannot execute programs or transmit viruses to your computer . They serve to make the website more user-friendly and effective overall. There are various types of cookies, e.g.:

4.1 Essential cookies

Technically necessary cookies help you to navigate the website by ensuring basic functions such as page navigation and access to secure areas. Without these cookies, our website would not function properly. Examples of uses for necessary cookies include language settings or shopping baskets. In individual cases, technically necessary cookies or comparable technologies may also include storage/access that is required for the provision of functions of our website expressly requested by the user, such as for the technical implementation of an active chat session, including the maintenance of the session context. Necessary cookies are stored for the duration of your internet session. 

Depending on whether the cookies are necessary for the operation of the website itself or for the service you are using, the processing is based on our legitimate interest pursuant to Section 25(2)(2) TDDDG in conjunction with Article 6(1)(f) GDPR or the fulfilment or initiation of a contractual relationship established between you and us in accordance with Section 25(2)(2) TDDDG in conjunction with Article 6(1)(b) GDPR.

4.2 Performance and statistics cookies (analytics)

Analytics cookies are used to collect information about the use of the website. These cookies record, among other things, the number of website visitors, the pages visited and the duration of their visit. The data collected is used to improve the website’s offerings and to optimally adapt the website’s content to the wishes and needs of visitors. 

The legal basis for the use of these cookies is your consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) in conjunction with Article 6(1)(a) of the GDPR.

5. Social media

5.1 LinkedIn Insight Tag

The so-called Insight Tag from the social network LinkedIn is used on our pages. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter “LinkedIn”). The LinkedIn Insight Tag is a small snippet of JavaScript code that we have added to our website.

The LinkedIn Insight Tag enables the collection of data regarding visits to our website, including the URL, referrer URL, truncated IP address, device and browser characteristics, timestamps and page views. LinkedIn does not share any personal data with us, but only provides aggregated reports on the website audience and ad performance. LinkedIn also offers retargeting for website visitors, enabling us to display targeted advertising outside our website using this data, without identifying the member in the process. 

LinkedIn members can control the use of their personal data for advertising purposes in their account settings. To deactivate the Insight Tag on our website (‘opt out’), click here. 

The LinkedIn Insight Tag is used to enable detailed campaign reports and to gather information about visitors to our website. As a customer of LinkedIn Marketing Solutions, we use the LinkedIn Insight Tag to track conversions, retarget our website visitors and gather additional information about the LinkedIn members who view our advertisements.

The data is encrypted, anonymised within seven days, and the anonymised data is deleted within 90 days.

5.2 Other social media

Otherwise, we do not use any other social media plugins on our website. We merely provide links to our profiles on the following networks: LinkedIn, Xing, Facebook, Kununu and X (formerly Twitter). We do not collect any personal data in this regard. If you wish to ensure that no data relating to your visit to our website is stored by these providers, we recommend that you log out of your accounts there.

6. Third-party services provided by Google

We use various services provided by the third-party provider Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001 (“Google”) on our website.

You can find Google’s privacy policy at: https://policies.google.com/privacy. 

There you will also find further information on data processing by Google, your rights in this regard and settings options to protect your privacy.

6.1 General information and transfers to third countries

We use Google’s services in what is known as Basic Consent Mode. This means that we do not transmit any personal data to Google or set cookies unless you have given us your consent in accordance with Section 25(1) sentence 1 of the TDDDG and Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

To exercise your right of withdrawal, please deactivate the relevant service via the “cookie banner” provided on our website. 

If you consent to the processing or setting of cookies in connection with Google’s services, you thereby grant both us and Google consent to process your data and to set cookies for the purposes specified here. Further information on the respective Google services can be found in the following sections.

For the USA, the European Commission adopted its adequacy decision on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. As Google’s servers are distributed worldwide and a transfer to third countries (for example, to Singapore) cannot be entirely ruled out, we have also concluded the EU Standard Contractual Clauses with the provider.

6.2 Google Analytics 4 (website analytics)

We use Google Analytics 4 on our website, a web analytics service provided by Google that enables us to analyse your use of our website.

By default, when you visit the website, Google Analytics 4 sets cookies, which are small text files stored on your device and collect certain information. This information includes your IP address, although Google truncates the last few digits to prevent direct personal identification.

Google uses the information collected on our behalf to evaluate your use of the website, to compile reports on website activity for us, and to provide other services related to website and internet usage. The truncated IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. The data collected through the use of Google Analytics 4 is stored for a period of two months and then deleted.

Google Analytics 4 will not be used during your visit to the site without your consent. You may withdraw your consent at any time with future effect. To exercise your right of withdrawal, please deactivate this service via the “cookie banner” provided on our website. Alternatively, you can download a browser add-on HERE to deactivate Google Analytics 4. 

Further legal information on Google Analytics 4 can be found at https://policies.google.com/privacy and at https://policies.google.com/technologies/partner-sites.

6.3 Use of YouTube

We also embed videos from YouTube on our website. YouTube is operated by Google.

We use YouTube in enhanced privacy mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to this website before they watch the video. However, the enhanced privacy mode does not necessarily prevent data from being shared with YouTube partners. Thus, YouTube establishes a connection to the Google DoubleClick network regardless of whether you watch a video. 

To mitigate this risk, we use the so-called ‘two-click solution’. This means that you can only watch a YouTube video once you have clicked on it, thereby actively consenting to the data transfer described above.

As soon as you start a YouTube video on this website, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, after starting a video, YouTube may store various cookies on your device or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, amongst other things, to collect video statistics, improve user-friendliness and prevent fraud attempts.

Where applicable, further data processing operations may be triggered after a YouTube video has started, over which we have no control.

The use of YouTube is in the interest of presenting our online services in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Further information on data protection at YouTube can be found in their privacy policy at: https://policies.google.com/privacy.

7. Email contact / Contact forms / Registration

7.1 If you contact us by email or submit an enquiry via one of our contact, product or service forms, we will process the data you have provided or entered in the form – in particular your email address, name, telephone number, details of your company and any other information contained in your message or the form fields – in order to process and respond to your enquiry. Enquiries submitted via our forms are only transmitted to us once the email address you have provided has been confirmed via a confirmation link sent to that address. This serves to verify the enquiry and prevent misuse. We will delete your data as soon as the purpose for which it was stored no longer applies.

Furthermore, data may be stored if this is provided for by European or national legislation in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when a storage period prescribed by the aforementioned standards expires.

7.2 The legal basis for the processing of data is Article 6(1)(a) of the GDPR where consent has been given. If the email contact is aimed at concluding a contract, the legal basis for the processing is Article 6(1)(b) of the GDPR. In all other cases, the legal basis for the processing of data is Article 6(1)(f) of the GDPR. Our legitimate interest in the processing lies in responding to your enquiry and, where contact is made via a form, in verifying the email address provided, ensuring the enquiry is correctly attributed, and preventing abusive contact requests.

7.3 On our website, you have the option to register to download certain documents, in particular PDF files, or to subscribe to a newsletter or press releases. In this case, we process the data you enter in the registration form in order to provide you with the desired download, to document your enquiry and to enable internal allocation to the relevant recipients. The legal basis is – insofar as the registration serves to initiate or fulfil a contractual relationship – Article 6(1)(b) of the GDPR; otherwise, it is our legitimate interest pursuant to Article 6(1)(f) of the GDPR in providing content, following up on enquiries from interested parties and organising our communication processes.

7.4 In addition, our website offers the option to register for our newsletter or to receive press releases. In this case, we process the data you enter in the relevant registration form, in particular your email address and, where applicable, further details such as your name, company, country or areas of interest, in order to send you the requested information and to tailor the content to your selection or interests. The legal basis for this processing is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, in particular via the unsubscribe link in the relevant communications.

8. Chatbot / Chat function on the website

8.1 We offer a chatbot on our website through which users can make enquiries about our products and services and receive support in using our website.

8.2 When using the chatbot, the following data in particular may be processed, depending on your input:

• Content data: text entries in the chat, uploaded content (where available), chat history
• Contact details, if provided by you: e.g. name, email address, telephone number
• Usage/metadata: time of use, technical identifiers (e.g. session ID)
• Other data that you voluntarily provide in the chat

Please do not transmit any special categories of personal data (e.g. health data) or any confidential information via the chat, unless this is expressly required.

8.3 The processing of your data in connection with the use of the chatbot takes place:

• to respond to enquiries and to carry out pre-contractual measures or to fulfil a contract on the basis of Article 6(1)(b) of the GDPR, provided your enquiry relates to this,
• on the basis of our legitimate interest in the efficient processing of enquiries and the improvement of our chat, customer service and information provision in accordance with Article 6(1)(f) of the GDPR
• for marketing purposes (marketing-related analysis of chatbot usage, including the analysis and evaluation of the effectiveness of content and communication formats, the targeted optimisation of the website from a sales perspective, and the sales-oriented further development of our range of services) exclusively on the basis of prior explicit consent in accordance with Article 6(1)(a) of the GDPR, which is obtained via the cookie or consent banner and covers not only the use of any necessary technologies, but also the marketing-related evaluation of chatbot usage based thereon.

For the aforementioned purposes, we store complete chat histories, comprising all messages sent by the user to the chatbot and all messages sent by the chatbot, including the relevant timestamps. In addition, a unique but anonymous session ID is stored, which serves solely to facilitate the technical provision and allocation of the relevant chat history. IP addresses or similar directly identifying characteristics are not stored. Chat histories are stored in pseudonymised form. Without additional information, we are unable to directly link them to an identified or identifiable natural person. No individual behavioural analysis, profiling or personalised communication with users takes place. 

If, whilst using the chatbot, the user expressly indicates that they wish to be contacted and voluntarily provides personal contact details (e.g. email address or telephone number) in the subsequent dialogue, the processing of this data takes place exclusively on the basis of prior express consent in accordance with Article 6(1)(a) of the GDPR. Consent is obtained as part of a separate dialogue and covers, in particular:

• the storage of the contact details provided,
• internal transfer to the relevant departments (e.g. sales or service),
• the transfer of the data and a summary of the enquiry to internal customer or prospect systems (e.g. CRM),
• the contact-related processing of the specific enquiry.

Where cookies or comparable technologies (e.g. local storage) are used in connection with the chatbot function, the following applies:

• technically necessary storage/access: Section 25(2)(2) TDDDG
• where not necessary: consent pursuant to Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR (via the cookie/consent banner).

8.4 Recipients / Use of service providers (data processing)

We use the following service provider as a data processor for the provision of the chatbot:

• OpenAI Ireland Ltd, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI processing)
• n8n GmbH, Novalisstr. 10, 10115, Berlin (hosting and automation of chatbot processes)
• Qdrant Solutions GmbH, Chausseestraße 86, 10115 Berlin (provision of a vector database for knowledge search in the chatbot)

8.5 The transfer of personal data to countries outside the EU/EEA cannot be ruled out if the chatbot service provider or its subcontractors use servers in third countries (e.g. the USA). In such cases, the transfer takes place on the basis of appropriate safeguards in accordance with Article 46 of the GDPR, in particular the EU Standard Contractual Clauses. Where data is transferred to the USA and the respective recipient is certified under the EU-US Data Privacy Framework, the transfer takes place on the basis of the EU Commission’s adequacy decision.

8.6 The data processed in connection with the use of the chatbot is deleted as soon as it is no longer required to achieve the respective purposes. The chat histories stored by the system within the chatbot are generally retained for a period of up to one (1) week and subsequently deleted automatically, provided they are not required for the processing of a specific enquiry. Chat histories or extracts thereof may be exported from the chatbot and further processed in internal analysis files (e.g. in spreadsheet format) for the purposes mentioned above. These exported data also contain only the chat history and a session ID, and no personally identifiable information. The exported data is stored only for as long as is necessary for the aforementioned purposes and is subsequently deleted or processed in aggregated form. Statutory retention obligations remain unaffected.

8.7 No automated decision-making within the meaning of Article 22 of the GDPR takes place.

9. Your rights

You have the following rights in relation to your personal data:

9.1 Right of access

You have the right to request information regarding the categories of data processed, the purposes of processing, any recipients of the data, and the planned storage period (Article 15 GDPR);

9.2 Right to rectification

You have the right to request the rectification or completion of inaccurate or incomplete data (Art. 16 GDPR);

9.3 Right to erasure

You have the right, in certain cases under Article 17 of the GDPR, to request the erasure of data – in particular, if the data is no longer necessary for the intended purpose or is being processed unlawfully, or if you have withdrawn your consent or objected;

9.4 Right to restriction of processing

You have the right, under certain conditions, to request the restriction of data processing where erasure is not possible or the obligation to erase is disputed (Art. 18 GDPR);

9.5 Right to withdraw consent

You have the right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR);

9.6 Right to object to processing

You have the right to object to data processing carried out on the basis of a legitimate interest for reasons arising from your particular si . In addition, you may object to the processing of your personal data for the purposes of advertising and data analysis at any time, without giving reasons (Art. 21(1) GDPR).

9.7 Right to data portability

You have the right to data portability, i.e. you may receive the data you have provided to us in a commonly used machine-readable format, such as CSV, and, where applicable, transmit it to others (Art. 20 GDPR).

9.8 Right to lodge a complaint

If you believe that the processing of your data infringes data protection law or that your data protection rights have otherwise been infringed, you may also lodge a complaint with a data protection supervisory authority, such as the Hessian Commissioner for Data Protection and Freedom of Information, who is responsible for us (Art. 77 GDPR).

Gustav-Stresemann-Ring 1

65189 Wiesbaden

Telephone: 0611-1408 0

Email: 

poststelle@datenschutz.hessen.de