Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

qamaas GmbH
Berliner Allee 55
22850 Norderstedt
Germany

Represented by its managing director Patrick Ross.
Phone: +49 40 46652660
Email: dataprivacy@qamaas.com

qamaas GmbH is not required to appoint a data protection officer; please direct all data protection enquiries to the contact details above.

2. Visiting this website

This website is delivered as static pages. Our hosting provider processes technical connection data (IP address, time of request, requested page, browser and operating system) in server log files in order to deliver the site and keep it secure. The legal basis is our legitimate interest in the secure and reliable operation of the site (Art. 6(1)(f) GDPR).

Hosting provider: Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA. Our services run on Railway's infrastructure in its European region (Amsterdam, Netherlands). Railway acts as our processor under a data processing agreement; any transfers to the USA are covered by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914).

Editorial content is managed in a content management system provided by Sanity AS, Trondheimsveien 2K, 0560 Oslo, Norway. Content is fetched when the site is built, not when you visit it, so visiting these pages does not transmit your data to that provider. A data processing agreement with Sanity is in place as part of its terms of service.

Fonts are served from our own server; your browser does not contact third-party font services. We do not set cookies, do not use a content delivery network that profiles visitors, and do not use advertising services on this website.

2a. Audience measurement without cookies

To understand which pages are read and how the website is used, we run our own cookieless audience measurement. Nothing is stored on your device: no cookies, no local storage, no identifier that survives the page. A small script only uses values the page knows anyway in order to be displayed. When a page is opened and closed, your browser sends us the page address (without its query string, except campaign parameters such as utm_source), the referring website, the window width (used only to tell desktop, tablet and smartphone apart; the width itself is not stored), and how long and how far the page was viewed. While the page is visible, it also signals every 30 seconds that it is still open; we use this for an overview of current visits and store only the time of the last activity.

Your IP address and browser identifier are processed only briefly in memory and are not stored. From them we form a pseudonymous value that changes every day; the daily key needed to form it is deleted after the day, so visits cannot be linked across days or traced back to you. To recognise companies that visit the website from their own company network, we look up the owner of the network your IP address belongs to in the public registry of the RIPE NCC (Amsterdam); only the network part of the address is sent (IPv4: first three blocks, IPv6: first 48 bits). For networks outside Europe, the RIPE NCC forwards the query to the responsible regional registry (for example ARIN in the USA); again only the network part is transmitted. Networks of internet, mobile and hosting providers are not evaluated. We only record the company name and country, never a person, and we do not combine this data with the data from our forms.

We store per page view: the page path, campaign parameters, the referring host, the device type, the time of the visit, viewing time and scroll depth, the daily pseudonymous value, and — for company networks — the company name and country. Because we store neither your IP address nor a lasting identifier, we cannot attribute page views to you; we are therefore not able to identify you for the purpose of a request for access (Art. 11 GDPR).

The legal basis is our legitimate interest in understanding the reach of our website and the interest of companies in our offer (Art. 6(1)(f) GDPR). If your browser sends a "Do Not Track" or "Global Privacy Control" signal, no measurement takes place. You can object at any time by email to dataprivacy@qamaas.com. Page view data is deleted automatically after 13 months; cached registry data after 30 days.

The measurement is received and evaluated by our internal sales application, which we operate ourselves on the infrastructure of Railway Corporation (see section 2). Only authorised internal staff can access it.

3. Demo and contact requests

When you request a demo or contact us through the form on this website, we process the data you enter: first and last name, company, work email address, phone number, the subscription packs you select, your optional message, and your consent confirmations together with their time and the version of the consent wording. We use this data to respond to your request, to arrange and run the demo, and to document your consent.

The legal bases are your consent (Art. 6(1)(a) GDPR) and the steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Without your consent to storage, no record is created.

Your request is stored in our customer relationship management system, Zoho CRM, provided by Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany, under a data processing agreement. Our Zoho account is hosted in Zoho's European data centres (Netherlands and Ireland), operated by Zoho Corporation B.V., Utrecht; your data is not transferred outside the European Union for this purpose. A copy of the request is also stored in our internal sales application, which we operate ourselves on the infrastructure of Railway Corporation (see section 2).

3a. Quote requests

When you request a quote on our pricing pages, we process the data you enter: name, company, work email address and, optionally, your role, organisation type, number of employees, modules of interest, current situation, scope, timeline and a description of the problem you want to solve, together with your consent confirmations. We use this data to prepare and discuss your quote. The legal bases are your consent (Art. 6(1)(a) GDPR) and the steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

Quote requests are stored in our internal sales application, which we operate ourselves on the infrastructure of Railway Corporation (see section 2). The application notifies our sales team by email through the email delivery service Resend (Resend, 2261 Market Street #5039, San Francisco, CA 94114, USA), under a data processing agreement. Resend is certified under the EU-U.S. Data Privacy Framework and additionally bound by the EU Standard Contractual Clauses; the notification email contains your request data and is processed in the USA. Your request may later be transferred to Zoho CRM (see section 3) to continue the sales process.

4. Retention

We keep request data for as long as it is needed to handle your enquiry and any business relationship that results from it, and thereafter for 24 months after our last contact with you. Statutory retention obligations under commercial and tax law remain unaffected. Records of your consent are kept for as long as they may be needed as evidence. Audience measurement data is deleted after 13 months (see section 2a).

5. Withdrawing your consent

You can withdraw any consent you have given at any time, with effect for the future, by email to dataprivacy@qamaas.com. The withdrawal does not affect the lawfulness of processing carried out before it. Once you withdraw your consent, we stop contacting you by phone about your request.

6. Your rights

You have the right to obtain access to your personal data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on our legitimate interests (Art. 21 GDPR). To exercise these rights, contact us using the details in section 1.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de.

7. Changes to this policy

We update this privacy policy when our services or the legal requirements change. The version published here applies; the date at the top shows the last revision.