Privacy

Controller

The controller within the meaning of the GDPR for data processing on this website is:

• —[Company name]
• —[Street and number]
• —[Postal code and city]
• —[Country]
• —Email: [privacy@…]
• —Phone: [phone number]

These details match the legal notice (Impressum) and will be added together with it before this website officially launches.

Data Protection Officer

[To be completed: Is a Data Protection Officer appointed under Art. 37 GDPR? If so, add their contact details here; if not, this section can be removed before launch.]

Hosting and server log files

This website is hosted with Railway (Railway Corporation). Whenever a page is accessed, the hosting provider automatically processes technical access data transmitted by your browser – in particular your IP address, date and time of access, the page requested, browser and operating system, and the referring page. These server log files are required for the technical operation and security of the website.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a functional and secure website). Log files are automatically deleted after [retention period to be added, e.g. 7 days] unless needed to investigate a specific security incident.

[To be completed: In which region does Railway host this service (EU or third country)? See “International data transfers” below.]

No cookies, no tracking

This website does not use cookies. It embeds no analytics or tracking services (such as web analytics or advertising networks), no external fonts and no other third-party resources. No profiling and no cross-site tracking takes place.

Local storage of your display preference (light/dark mode)

Your choice between light and dark mode is stored locally in your browser (in what is known as local storage) so the setting persists on your next visit. This information stays on your device and is never transmitted to our servers; we have no knowledge of it.

As this is a technically necessary function with no tracking purpose, no consent under § 25 TDDDG (Germany's ePrivacy implementation) is required. You can clear this storage at any time via your browser settings.

Link to the live demo

The “Live demo” button takes you to the actual EnterpriseCAQ application at qms.up.railway.app, leaving this website. The application is a separate service with its own sign-in and its own data processing (including login credentials and session cookies); this privacy policy covers this marketing website only, not the application itself. [Add a link to the application’s own privacy policy once published.]

Recipients and processors

Personal data from the server log files described above is processed on our behalf by our hosting provider, Railway, under a data processing agreement pursuant to Art. 28 GDPR. Data is not shared with any other third parties.

International data transfers

[To be completed: Are the servers used by Railway located within the EU/EEA? If data is transferred to a third country (e.g. the USA), state the legal basis here – for example the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) or an adequacy decision (Art. 45 GDPR).]

Retention period

As described above, server log files are deleted automatically after a short period. Beyond this, the website does not process personal data for which a retention period would apply.

Your rights as a data subject

You have the following rights regarding your personal data against the controller:

• —Right of access to the data we process about you (Art. 15 GDPR)
• —Right to rectification of inaccurate data (Art. 16 GDPR)
• —Right to erasure of data stored about you (Art. 17 GDPR)
• —Right to restriction of processing (Art. 18 GDPR)
• —Right to data portability, where processing is based on consent or a contract and carried out by automated means (Art. 20 GDPR)
• —Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• —Right to withdraw any consent given, with effect for the future (Art. 7(3) GDPR), to the extent processing is based on consent

To exercise these rights, an informal message to the controller's contact address above is sufficient.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work, or the location of our registered office. [Add the competent supervisory authority once the registered office is confirmed.]

Currency and changes to this privacy policy

This privacy policy is updated whenever the website or the applicable legal requirements change. The version current at the time of your visit applies.