Legal
Privacy policy
This policy covers the website qualishift.de. For the processing of employee data inside the application itself, the customer company is the controller; the basis for that is a data processing agreement under Art. 28 GDPR.
1. Controller
The controller for data processing on this website within the meaning of the General Data Protection Regulation is CITO GmbH, Jungfrauenthal 8, 20149 Hamburg, Germany, represented by its Managing Director Sebastian Johnston. QualiShift is a brand of CITO GmbH.
Please send data protection enquiries by email to hello@qualishift.de. We answer in writing. We deliberately do not publish a telephone number.
2. Legal bases
We process personal data on the basis of Art. 6 (1) (b) GDPR where processing is necessary for steps taken prior to entering into a contract or for the performance of a contract, for example when you enquire about our services.
Otherwise we rely on Art. 6 (1) (f) GDPR. Our legitimate interest lies in operating the website securely and in answering enquiries that reach us. Where processing requires consent, we obtain it beforehand and rely on Art. 6 (1) (a) GDPR.
3. Hosting
This website is hosted by Vercel Inc. The provider processes the data arising when the website is accessed on our behalf as a processor. A data processing agreement under Art. 28 GDPR is in place with it.
Delivery and processing are configured to data centres inside the European Union. Where a transfer to a third country occurs in an individual case, it takes place on the basis of the European Commission's standard contractual clauses.
4. Server log files
When this website is accessed, data transmitted by your browser is collected automatically. It is required to deliver the pages and to keep the service secure.
- IP address of the requesting device
- Date and time of access
- Address of the page requested and volume of data transferred
- Notification of whether the request succeeded, and the HTTP status code
- Referrer, meaning the previously visited page, where transmitted
- Browser type, browser version and operating system used
The legal basis is Art. 6 (1) (f) GDPR. This data is not merged with other sources and is not used to build user profiles. It is deleted as soon as it is no longer needed for operations and for defending against attacks, as a rule within a few days.
5. Contact by email
If you write to us by email, we process your details solely to deal with your request and in case follow-up questions arise. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR.
We delete these messages once the matter has been dealt with conclusively and no statutory retention obligations stand in the way. Retention periods under commercial and tax law remain unaffected.
6. Forms
We use the Web3Forms service for the forms on this website. The details you enter are transmitted to our mailbox through that service. The provider processes the data on our behalf as a processor under Art. 28 GDPR.
Only the fields you complete are transmitted, plus the technical details required for delivery. Mandatory fields are marked as such. The legal basis is Art. 6 (1) (b) GDPR for enquiries about our services, otherwise Art. 6 (1) (f) GDPR.
We do not use form entries for advertising unrelated to your enquiry and we do not pass them to third parties who are not involved in handling it.
7. Cookies, analytics and audience measurement
This website uses Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for audience measurement. We run the service with Consent Mode v2, configured so that every consent category defaults to denied.
In practice that means: unless you consent, Google Analytics stores no cookies on your device and creates no identifier that could recognise you. Only cookieless signals without recognition are transmitted, from which we receive aggregated reports on how the website is used. The data is not combined with other sources, and we use no advertising features and no Google Signals.
The legal basis for this cookieless measurement is our legitimate interest in statistical analysis of website use under Art. 6(1)(f) GDPR. No information is accessed on your device within the meaning of Section 25 TDDDG. Should we move to consent-based cookies for measurement in future, we will obtain your consent through a consent dialogue and update this policy before any processing starts.
Google processes the data as a processor under Art. 28 GDPR. Any transfer to the United States takes place on the basis of the European Commission's standard contractual clauses; the recipient is certified under the EU-US Data Privacy Framework. You can also prevent collection by Google Analytics using Google's browser add-on at https://tools.google.com/dlpage/gaoptout.
If a language preference is stored, that happens solely in a technically necessary cookie which does not allow your behaviour to be analysed. No marketing cookies and no ad networks are embedded.
8. Recipients and processors
Access to personal data is limited to people who need it to handle your request, and to the processors we use, currently the hosting provider, the form service and the audience measurement provider.
Disclosure to other third parties only takes place where we are legally obliged or entitled to do so. We do not sell data.
9. Retention
We store personal data only for as long as it is needed for the respective purpose. Server log files expire quickly, enquiries are deleted once they have been dealt with conclusively.
Where statutory retention obligations apply, in particular under the German Commercial Code and the Fiscal Code, processing is restricted for the duration of those periods instead of the data being deleted.
10. Your rights
Under the General Data Protection Regulation you have the following rights in relation to us. An informal message to the address above is enough to exercise them.
- Access to the data processed about you under Art. 15 GDPR
- Rectification of inaccurate data under Art. 16 GDPR
- Erasure under Art. 17 GDPR
- Restriction of processing under Art. 18 GDPR
- Data portability under Art. 20 GDPR
- Objection to processing based on legitimate interests under Art. 21 GDPR
You can withdraw consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
11. Right to lodge a complaint
If you believe that the processing of your data infringes the General Data Protection Regulation, you can lodge a complaint with a supervisory authority, without prejudice to other remedies.
The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information. You may also contact the supervisory authority of your place of residence or place of work.
12. Changes to this policy
We update this policy when the processing changes, for instance because a new service is added. The version published on this page at the time applies. Changes requiring consent are only implemented after we have obtained it.