I. Information on the Processing of Your Personal Data pursuant to Art. 13 GDPR

1. Controller and Data Protection Officer

The controller within the meaning of Art. 4 No. 7 GDPR is:
Q-Detect Deutschland GmbH
Gebrüder-Pauken-Straße 13
56218 Mülheim-Kärlich
Germany

Email: r.kowalik@q-detect.ai

Phone: +49 151 23506505

x. Company Data Protection Officer

You can reach our company’s Data Protection Officer at:

RA Per Kristian Stöcker
c/o LLR Data Security and Consulting GmbH
Mevissenstraße 15
50668 Köln

Email: stoecker@llrdsc.de

Phone: +49 (221) 29191370

2. Website in General — Server Log Files and Hosting

a. What data is processed and for what purpose?

Each time our website is accessed, our hosting provider automatically stores data in so-called server log files. This includes the following information:

  • IP address of the accessing device
  • Date and time of access
  • URL accessed (page / file)
  • Website from which the access originated (referrer)
  • Web browser used and version
  • Operating system
  • Amount of data transferred and HTTP status code

The temporary storage of this data is technically necessary to enable delivery of the website. In addition, the log files are stored to ensure the security and functionality of the systems and to detect and prevent attacks or misuse.

b. On what legal basis is this data processed?

The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Our overriding legitimate interest lies in the technical operation and security of the website as well as in defending against attacks.

c. Are there any recipients of your personal data other than the controller?

Recipients of your data within our company are employees who, under a graduated authorization concept, must process your data as necessary for the purposes stated above. In addition, so-called processors under Art. 28 GDPR may receive your data in the context of providing services, such as IT service providers, in particular our hosting provider. All our service providers process data solely within the European Union or the European Economic Area, or outside of it only on the basis of an adequacy decision or other appropriate safeguards (Art. 44 et seq. GDPR), and are contractually obligated to implement appropriate technical and organizational measures to ensure data protection and to maintain data confidentiality. As a general rule, no data processing takes place in a so-called third country.

d. How long is the data stored?

Server log files are automatically deleted after no more than [7] days, unless longer retention is required in individual cases to defend against a specific attack or for criminal prosecution purposes.

3. Contact Form

a. What data is processed and for what purpose?

On our website, you can submit an inquiry to us via a contact form. The following personal data is collected in the process:

  • Name (required field)
  • Email address (required field, needed for our reply)
  • Subject (required field)
  • Message content (required field)
  • Phone number (optional)

Collection of the required information is necessary to process your inquiry. Without providing a way to reply (email or phone), processing is not possible. Voluntary information such as the phone number should only be provided if you would like a reply by phone.

b. On what legal basis is this data processed?

Insofar as the inquiry relates to an existing or intended contractual relationship with Q-Detect, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). Otherwise, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

c. Are there any recipients of your personal data other than the controller?

Data submitted via the contact form is forwarded to our email system. Insofar as an external email service provider is used for this purpose, a
data processing agreement under Art. 28 GDPR has been concluded with that provider. Data is not disclosed to any other third parties.

d. How long is the data stored?

Data submitted via the contact form is deleted once the respective inquiry has been fully processed and no further contact is expected. If data from the correspondence is subject to commercial or tax law retention obligations (in particular Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)), it will be retained for the legally required period (generally six or ten years).

e. Right to Object and to Have Data Removed

You may revoke the processing of your data from the contact form at any time by sending us an email at r.kowalik@q-detect.ai. In this case, all stored personal data will be deleted, provided no statutory retention obligations prevent this.

4. Cookie Consent Tool

a. What data is processed and for what purpose?

On our website, we use the cookie consent tool provided by Complianz B.V., Burgemeester Stramanweg 105, 1101 AA Amsterdam, Netherlands, privacy policy: https://complianz.io/legal/privacy-statement/. A data processing agreement under Art. 28 GDPR has been concluded with the provider.

We use this tool to obtain, document, and manage your consent to cookies and similar technologies. The tool stores the choices you have made (consent to or rejection of individual cookie categories), the timestamp of your decision, and an anonymized identifier for your browser.

b. On what legal basis is this data processed?

Storing the consent status serves to fulfill our legal obligation to document consent in a verifiable manner and to be able to demonstrate it upon request (Art. 7(1) GDPR, Section 25 TDDDG [German Telecommunications Digital Services Data Protection Act]). The legal basis is Art. 6(1)(c) GDPR (compliance with a legal obligation).

c. How long is the data stored?

The consent status is stored for [12] months so that you are not asked for your consent again on every visit. After this period has expired, you will be asked for your consent again.

d. Right of Withdrawal

You may withdraw your consent at any time with future effect by accessing and changing your cookie settings via the corresponding link in the footer of our website. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

5. Google Analytics

Important note: Google Analytics is used on this website exclusively after you have given your express consent via the cookie consent tool. Without your consent, no analytics cookies are set and no usage data is transmitted to Google.

a. What data is processed and for what purpose?

If you have given your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google Analytics”). The parent company, Google LLC, is based in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR, adequacy decision of the EU Commission dated July 10, 2023), so that a transfer to the USA is permissible on this basis. Google Analytics uses cookies (small text files) that enable an analysis of your use of our website. The following data is processed in the process:

  • Pages accessed and session duration
  • Source of the visit (referrer, search engines)
  • Device type, operating system, browser type, and language setting
  • Anonymized IP address (IP anonymization is enabled; the full IP address is not
    stored)
  • Demographic data and interest categories (if enabled)
  • Interactions with website elements.

The purpose of this data processing is the statistical analysis of user behavior in order to improve our website offering.

b. On what legal basis is this data processed?

The legal basis is Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG. Processing by Google Analytics takes place exclusively on the basis of the consent you have previously given via the cookie consent tool.

c. How long is the data stored?

The retention period in Google Analytics is configurable. We have set the retention period to [14]. After this period expires, the data is automatically deleted.

d. Right to Withdraw Consent

You may withdraw your consent to the use of Google Analytics at any time with future effect by:

Withdrawal does not affect the lawfulness of processing carried out up to the point of withdrawal. Further information can be found in Google’s privacy policy at https://policies.google.com/privacy.

II. Rights of Data Subjects

As a data subject, you have the following rights against the controller:

  • Right of access (Art. 15 GDPR): You have the right to obtain information about the data stored about you, the purposes of processing, recipients, and the planned storage period.
  • Right to rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate data or the completion of incomplete data. Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data, provided the legal requirements are met.
  • Right to restriction of processing (Art. 18 GDPR): You may request that the processing of your data be restricted.
  • Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used, and machine-readable format.
  • Right to object (Art. 21 GDPR): You may object to the processing of your data. Further details can be found in Section II of this privacy policy.
  • Right to lodge a complaint (Art. 77 GDPR): If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Phone: 06131 8920-0, Email: poststelle@datenschutz.rlp.de. You may also contact the supervisory authority at your place of residence or habitual abode.

III. Right to Object pursuant to Art. 21(1) GDPR

Insofar as we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time for reasons arising from your particular situation.

In the event of an objection, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

Note: The collection of data required to provide the website (server log files) is technically essential for operating the website. An objection to this processing is therefore not possible.

You may direct your objection to: Q-Detect Deutschland GmbH, Email: r.kowalik@q-detect.ai (see above).

IV. Note on Art. 14 GDPR

Art. 14 GDPR governs information obligations for cases in which personal data is not collected directly from the data subject. On our website, we collect personal data exclusively directly from the data subjects themselves (when visiting the website and via the contact form). Art. 14 GDPR therefore does not apply to the pure operation of the website. Should we receive data about individuals from other sources in the course of our business activities, we will inform the data subjects separately in accordance with Art. 14 GDPR.

Last updated: July 2026
Version 0.1