Privacy Policy

1. Controller and Data Protection Officer

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:

Qunevo GmbH

Oestervenn 16

33758 Schloß Holte-Stukenbrock

Germany

Phone: +49 5207 957 3619

Email: info@qunevo.com

Website: qunevo.com

Represented by the Managing Directors:

Dr. Felix Johannes Grumbach

Stefan Görlitz

Our Data Protection Officer can be reached at:

We are not legally required to appoint a data protection officer and have not appointed one. For data protection inquiries, you can contact us directly using the contact details provided above.

2. Collection of General Information When Visiting Our Website (Server Log Files)

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected (server log files):

• Browser type and browser version
• Operating system used
• Referrer URL (the previously visited page)
• Hostname of the accessing computer
• Date and time of the server request
• IP address
• Name of the retrieved file and amount of data transferred
• Message whether the retrieval was successful

Purpose of data processing:

The temporary storage of the IP address (which may be considered personal data) by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. Storage in log files is done to ensure the functionality of the website. Additionally, the data serves us to optimize the website and to ensure the security of our information technology systems (e.g., to defend against and analyze attacks). Data evaluation for marketing purposes does not take place in this context.

Legal basis:

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the purposes mentioned above, in particular ensuring the stability, security and functionality of our website.

Storage duration:

The data is deleted as soon as it is no longer necessary for achieving the purpose for which it was collected. In the case of collecting data for providing the website, this is the case when the respective session is ended. In the case of storing data in log files, this is the case after 7 days at the latest. Extended storage is only possible if the IP addresses have been previously anonymized or pseudonymized or if further retention is exceptionally required for investigating security incidents or for legal prosecution. Blanket permanent storage of log files does not take place.

Objection and removal possibility:

The collection of data for providing the website and the storage of data in log files is mandatory for the operation of the website. Consequently, there is no possibility for the user to object to this specific processing.

3. Use of Cookies and Similar Technologies

Our website uses cookies and possibly similar technologies (e.g., Local Storage). Cookies are small text files that are stored on your device.

Technically necessary cookies:

We use cookies that are absolutely necessary for the operation of the website and the provision of basic functions you have requested (e.g., storage of login data, shopping cart functions, storage of your consent settings).

Legal basis: The use of these technically necessary cookies and the associated data processing is based on Art. 6 para. 1 lit. f GDPR (our legitimate interest in a functional and user-friendly online service) as well as § 25 para. 2 No. 2 TTDSG.

Consent-required cookies and technologies:

All other cookies and technologies, in particular those for reach measurement, marketing purposes or from third parties (e.g., analysis tools, social media plugins), we only use after your explicit prior consent.

Legal basis: The legal basis for this is your consent according to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TTDSG.

Consent management:

We use a Consent Management Platform (CMP) to obtain, manage, and document your consent. Upon your first visit to our website and at any time later via a link, you can view detailed information about the individual consent-required cookies and technologies (provider, purpose, storage duration) and make or change your selection. You can revoke your consent at any time with effect for the future by adjusting the settings in our CMP.

Note on browser settings:

You can set your browser to inform you about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or generally, and activate the automatic deletion of cookies when closing the browser. Please note that deactivating technically necessary cookies may limit the functionality of our website. Browser settings do not replace the granting or revocation of consent via our CMP for consent-required cookies.

Data transfer to third parties:

We only pass on data collected through cookies to third parties if this is absolutely necessary for technically necessary cookies (e.g., to technical service providers) or if you have given us your explicit consent for this within the framework of consent-required cookies (e.g., to providers of analysis tools). Details can be found in the information of our CMP.

4. Use of Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies (see section 3) that enable an analysis of your use of the website.

Purpose of data processing:

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website usage and internet usage to the website operator. This serves the purpose of analyzing our offering, regularly improving it, and operating it more economically.

Processed data:

The information generated by the cookie about your use of this website (including your IP address, browser type/version, operating system used, referrer URL, time of server request, pages visited, dwell time, interactions) is usually transmitted to and stored on a Google server in the USA. We point out that on this website Google Analytics has been extended with the function of IP anonymization (anonymizeIp). Thereby, your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before transmission to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

Legal basis:

The use of Google Analytics and the associated storage of analysis cookies as well as the evaluation of your user behavior is based exclusively on your consent according to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. We obtain this consent via our Consent Management Platform (CMP).

Data transfer to the USA:

Data collected by Google Analytics may be transferred to servers of the parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data transfers to the USA, we rely on the adequacy decision of the European Commission according to Art. 45 GDPR within the framework of the EU-U.S. Data Privacy Framework (DPF), provided the recipient (Google LLC) is certified there. Google LLC is certified under the DPF. If a transfer is not possible on this basis or if the validity of the DPF ends, the transfer is made on the basis of standard contractual clauses of the EU Commission according to Art. 46 para. 2 lit. c GDPR, which are intended to provide appropriate guarantees for the protection of your data. Despite these measures, it cannot be completely excluded that US security authorities could access the data stored at Google under certain circumstances. By consenting to the use of Google Analytics, you also agree to a possible data transfer to the USA. Further information on data protection at Google and the DPF can be found at: https://policies.google.com/privacy?hl=en and on the official DPF website.

Storage duration:

The data we send and that is linked to cookies, user identifiers (e.g., User ID) or advertising IDs is automatically deleted after a period we set in Google Analytics (by default, e.g., 14 months). The deletion of data whose retention period has been reached occurs automatically once a month. You can find the exact storage duration of Google Analytics cookies in the detailed information in our CMP.

Withdrawal of consent / Opt-out:

You can revoke your consent at any time with effect for the future by adjusting the cookie settings in our CMP accordingly. You can also prevent the storage of cookies by setting your browser software accordingly; however, we point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your anonymized IP address) to Google as well as the processing of this data by Google by downloading and installing the browser add-on available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en

Data processing agreement:

We have concluded a data processing agreement with Google according to Art. 28 GDPR, which obliges Google to process the data of our users only according to our instructions and to maintain confidentiality.

5. SSL/TLS Encryption

To protect the security of your data during transmission, we use encryption procedures in accordance with the current state of technology (e.g., SSL/TLS) via HTTPS. You can recognize an encrypted connection by the prefix "https://" in the address bar of your browser and/or by the lock symbol in your browser bar.

6. Contact (e.g., via Email or Contact Form)

If you contact us via email or through a contact form, the personal data you provide (e.g., name, email address, phone number, your request) will be stored and processed.

Purpose of data processing:

The processing of this data is carried out exclusively for handling your request and for communication with you.

Legal basis:

If the contact is made in connection with the initiation or fulfillment of a contract with you, the legal basis is Art. 6 para. 1 lit. b GDPR. In all other cases, the processing is based on our legitimate interest in the efficient handling and answering of inquiries directed to us (Art. 6 para. 1 lit. f GDPR). If we request consent, this is the legal basis (Art. 6 para. 1 lit. a GDPR).

Storage duration:

The data you provide remains with us until the purpose for data storage ceases to apply (e.g., after completion of handling your request), you request us to delete it, or you revoke any consent you may have given for storage. Mandatory legal provisions – in particular legal retention periods (e.g., from commercial or tax law) – remain unaffected.

Data disclosure:

Your data will generally not be disclosed to third parties without your consent, unless this is necessary for processing your inquiry or we are legally obliged to do so.

7. Legal Bases for Processing (Summary)

The processing of your personal data is based on the following legal bases:

• Art. 6 para. 1 lit. a GDPR: Your consent to the processing.
• Art. 6 para. 1 lit. b GDPR: The processing is necessary for the performance of a contract with you or for taking steps prior to entering into a contract.
• Art. 6 para. 1 lit. c GDPR: The processing is necessary for compliance with a legal obligation to which we are subject.
• Art. 6 para. 1 lit. f GDPR: The processing is necessary for the purposes of our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms which require the protection of personal data override such interests.

The specific legal basis for the respective processing is listed in the preceding sections when describing the respective data processing operation.

8. Data Transfer to Third Countries

A transfer of your personal data to recipients in countries outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries) takes place if this is necessary, for example, in the context of using certain services (such as Google Analytics, see section 4), is legally required, or you have given us your consent.

When data is transferred to a third country, we ensure that an adequate level of data protection is guaranteed, e.g., through adequacy decisions of the EU Commission (such as the EU-U.S. Data Privacy Framework for certified US companies) or through the conclusion of EU standard contractual clauses. We will inform you about details upon request or when describing specific services.

9. Duration of Storage

We process and store your personal data only for the period necessary to achieve the storage purpose or as provided by legal regulations.

Specific storage periods are, where possible, mentioned in the sections on the respective processing operations.

If the storage purpose ceases to apply or a legally prescribed storage period expires (e.g., commercial or tax retention periods), the personal data is routinely blocked or deleted in accordance with legal regulations.

10. Your Data Subject Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) to your data processed by us.
• Right to rectification (Art. 16 GDPR) of incorrect data.
• Right to erasure("right to be forgotten") (Art. 17 GDPR) of your data, provided there are no overriding reasons (e.g., legal obligations).
• Right to restriction of processing (Art. 18 GDPR) of your data.
• Right to data portability (Art. 20 GDPR), i.e., release of your data in a structured, commonly used and machine-readable format or transmission to another controller.
• Right to object (Art. 21 GDPR): You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR. This also applies to profiling based on these provisions. We will no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the pursuit of legal claims. If your data is processed for direct marketing, you have the right to object to such processing at any time; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw given consent (Art. 7 para. 3 GDPR): You have the right to withdraw consent once given at any time with effect for the future. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, please contact us using the contact details provided in point 1. To withdraw your cookie consent, please use the option described in points 3 and 4 via our CMP.

11. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority primarily responsible for Qunevo GmbH is:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211/38424-0
Website: https://www.ldi.nrw.de/

12. Changes to Our Privacy Policy

We reserve the right to occasionally update this privacy policy to ensure it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g., when introducing new services. The new privacy policy will then apply to your next visit.

Last updated: October 10, 2025