Privacy Policy

in accordance with Art. of the 13 GDPR.

 

1.    General

With this privacy policy we are fulfilling our obligation to inform you about the collection and processing of your personal data when you visit our website, as well as who is responsible for the data processing, what rights you are entitled to, and whom you can contact if you have any questions.

We are providing you with this privacy policy on the basis of Article 13 of the GDPR.

2.    The data controller

The data controller responsible for processing your data is QUNDIS GmbH, Sonnentor 2, 99098 Erfurt. You can contact us by email at info@qundis.comor by telephone on +49 361 26280-0.

3.    Data protection officer

You can reach our data protection officer at datenschutz@qundis.com or at our postal address with the addition „Datenschutz“ (data protection).

4.    Collection and obligation to provide data

The provision of personal data is always voluntary. However, for certain processing operations the provision of such data is necessary, as otherwise we will not be able to process your request.
If the provision of personal data is essential (e.g. for order processing, or for the provision of specific functions of the website), no right of objection can consequently be asserted.
Where possible, for example in contact or order forms, we use both optional fields and mandatory fields. Mandatory fields are marked as such. Data from mandatory fields contains information that we require, for example, to process your enquiry, to create your account or to send you the newsletter. The data this specifically concerns can be seen from the relevant input fields.

5.    Verarbeitungen

The following general provisions always apply, independently of or in addition to the provisions specified in the individual processing operations:

  • Personal data will only be passed on if we are obliged to do so by law or by court order. Any further disclosure will only be made with your consent.
  • Personal data may be stored for longer than the above-mentioned periods if we are entitled or obliged to do so in accordance with the performance of a contract, by law or by a court ruling.
  • Your personal data will be deleted if it is no longer required for the purpose of processing, if a consent you have given is revoked or if other permissions cease to apply. If data is still required for the assertion, exercise or defence of legal claims, we will delete it as soon as this is no longer the case. If we store personal data due to legally prescribed retention periods, we delete the data after the applicable retention period has expired.

5.1    Website / storage of data on your end device

5.1.1   Contents of the processing

Our website is based on the WordPress system, which uses your local storage system to deliver the web pages and stores cookies and other files there that are necessary for the technically faultless operation of the website.

In addition, our website uses the WordPress plugin „Borlabs Cookie“ to obtain your consent to the storage of cookies in your browser and to document this in a data protection-compliant manner. These are technically necessary cookies in accordance with §25 Para. 2 Sentence 2 of Germany’s Telecommunications-Telemedia Data Protection Act (TTDSG). This data is not passed on to the provider of „Borlabs Cookie“, but is only stored on our server. Details on the data processing by Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/

Apart from communicating with you at your express request (see below), no data is processed or stored with the purpose of identifying individuals. An evaluation of the data to create personal user profiles does not take place.

5.1.2   Categories of data subject

The following groups of persons are affected by the processing:

  • All visitors to our website(s)

5.1.3   Categories of personal data which is processed

The following personal data is stored:

  • Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, WordPress website domain and path, consents, VAT ID.

5.1.4   Recipients of the data

The following bodies are recipients of the data processed:

  • The department which is responsible for the operation of the website at QUNDIS.
  • The data processor which is used for hosting the website in accordance with Art. 28 Para 1 of the GDPR.

5.1.5   Legal basis and purpose

The legal basis is Art. 6 Para. 1 f of the GDPR, in this case our legitimate interest in a technically and creatively correct provision of our website as well as an anonymous statistical evaluation. For this purpose, we store data on your end device in accordance with §25 Para. 2 Sentence 2 of the TTDSG. This data is not used for any other purposes.

5.1.6   Duration of the storage

The storage period for telemetry data, cookies and locally stored data is usually one year, or until you request us to delete it or until you delete the data yourself in your browser.

5.2    Use of third-party services

5.2.1   Use of Matomo

5.2.1.1   Contents of the processing

We use „Matomo“ on this website for the purpose of statistical analysis. Matomo is an open-source tool for web analysis. It is deactivated when you visit our website. Your usage behaviour is only recorded pseudonymously if you provide your consent. For this purpose, Matomo uses cookies that are stored on your computer. With the information collected, we can generally analyse usage behaviour on the website and eliminate errors. Your IP address is anonymised, which means we are not able to identify any user.

5.2.1.2   Categories of data subject

The following groups of persons are affected by the processing:

  • All visitors to our website(s)

5.2.1.3   Categories of personal data which is processed

The following personal data is stored:

  • Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, date, time, time zone, WordPress website domain and path, consents, VAT ID.
  • Statistical data: in addition to telemetry data, this also includes general location data, user agent, screen resolution, websites and subpages visited, referrer URL, information on downloaded files, links clicked, search terms from the search engines used.

5.2.1.4   Recipients of the data

The following bodies are recipients of the data processed:

  • The department which is responsible for the operation of the website at QUNDIS.
  • The data processor which is responsible for hosting Matomo in accordance with Art. 28 Para 1 of the GDPR.

5.2.1.5   Legal basis and purpose

The legal basis is your consent in accordance with Art. 6 Para. 1 a of the GDPR. This can be revoked at any time with effect for the future. The data is not used to identify you, but only to measure the coverage of our website and to enable rectification of errors.

5.2.1.6   Duration of the storage

The storage period for Matomo cookies is up to 13 months from the end of the session, or you can delete the data in your browser yourself. The analyses and statistics based on the data remain, but they no longer allow any conclusions to be drawn about personal data.

5.2.2   Use of YouTube

5.2.2.1   5.2.2.1 Contents of the processing

We use the services of YouTube to play videos on our website. These are integrated via the no-cookies function in such a way that they first have to be actively unlocked. Data is therefore only transferred to YouTube with your consent. You will find information about processing by YouTube here: https://policies.google.com/privacy

5.2.2.2   Categories of data subject

The following groups of persons are affected by the processing:

  • All visitors to the website(s)

5.2.2.3   Categories of personal data which is processed

The following personal data is stored:

  • Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, date, time, time zone, WordPress website domain and path, consents, VAT ID.
  • – Statistical data: in addition to telemetry data, this also includes general location data, user agent, screen resolution, websites and subpages visited, referrer URL, information on downloaded files, links clicked, search terms from the search engines used.

5.2.2.4   Recipients of the data

The following bodies are recipients of the data processed:

  • The processor responsible for hosting Matomo in accordance with Art. 28 Para. 1 of the GDPR.
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

5.2.2.5   Legal basis and purpose

The legal basis is your consent in accordance with Art. 6 Para. 1 a of the GDPR. This can be revoked at any time with effect for the future.

5.2.2.6   Duration of the storage

You will find detailed information about processing by YouTube here: https://policies.google.com/privacy

5.3    Forms

5.3.1   Contents of the processing

We use a number of forms (registration for participation in training courses, contact form, tendering texts etc.) to offer additional services such as course registrations and documents for downloading.

5.3.2   Categories of data subject

The following groups of persons are affected by the processing:

  • website visitors, interested parties, suppliers, customers, employees

5.3.3   Categories of personal data which is processed

The following personal data is stored:

  • contact information: this includes the name, postal address, telephone, fax and email address of the person contacting us and, if applicable, a description of any problem.

5.3.4   Recipients of the data

The following bodies are recipients of the data processed:

  • The department which is responsible for the operation of the website at QUNDIS.
  • The QUNDIS sales department, if this is necessary for the fulfilment of any enquiry.

5.3.5   Legal basis and purpose

The legal basis is your consent in accordance with Art. 6 Para. 1 a of the GDPR. This can be revoked at any time with effect for the future.

5.3.6   Duration of the storage

The storage period of data from forms depends on their purpose, i.e. until this purpose has been fulfilled or you request us to delete the data.

5.4    Serviceportal Q eco

5.4.1   Contents of the processing

The purpose of the processing is to provide a service portal on which tenants can view their consumption data. In this way landlords comply with their legal obligation to provide information on consumption at any time during the year in accordance with Section 6a of Germany’s Heating Costs Ordinance (HeizkostenVO). There are no plans to change these purposes. As a tenant you can revoke the use of the portal at any time and inform your landlord that you wish to have the consumption data provided in some other way.

A household profile is created in order to automatically obtain and display the desired information. Technically required cookies are stored on your end device in order to enable a secure login and to detect malfunctions in the portal.

In addition, the other processing procedures for QUNDIS websites apply.

5.4.2   Categories of data subject

The following groups of persons are affected by the processing:

  • Tenants

5.4.3   Categories of personal data which is processed

The following personal data is stored:

  • Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, date, time, time zone, WordPress website domain and path, consents, VAT ID.
  • Household profile data: mandatory data includes the user ID and password; optional data covers the persons in the household (number of children, number of adolescents, number of adults). In addition, an error report including the time of occurrence (time stamp) may be generated, which is linked to your account. An automated error report is only generated with your express consent.
  • Consumption data for the supply of heating: meter reading and consumption information, a cost overview based on current consumption and consumption comparisons in the form of user and third-party user data, as well as suggestions for saving energy.

5.4.4   Recipients of the data

The following bodies are recipients of the data processed:

  • The department at QUNDIS which is responsible for the operation of the customer portal.
  • The contract processor used for hosting the website in accordance with Art. 28 Para. 1 of the GDPR.

5.4.5   Legal basis and purpose

The legal basis is your consent in accordance with Art. 6 Para. 1 a of the GDPR. This can be revoked at any time with effect for the future.

The legal basis for the use of QUNDIS by your landlord is Article 28 of the GDPR, in conjunction with Section 6a of Germany’s Heating Costs Ordinance (statutory obligation).

5.4.6   Duration of the storage

The storage period of your data is as long as a contractual relationship exists between you and your landlord, or until you terminate the use of the portal or request us to delete the data.

5.5    MeinMessdienstportal

5.5.1   Contents of the processing

The MeinMessdienstportal website at https://meinmessdienstportal.de is used to search for metering service companies by property managers, property owners and others.

5.5.2   Contents of data subject

The following groups of persons are affected by the processing:

  • All visitors to the website(s)
  • The contact persons of the registered companies

5.5.3   Categories of personal data which is processed

The following personal data is stored:

  • Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, WordPress website domain and path, consents, VAT ID
  • Contact information (on registration): this includes the name, telephone number and email address of the contact person.

5.5.4   Recipients of the data

The following bodies are recipients of the data processed:

  • The department which is responsible for the operation of the website at QUNDIS.

5.5.5   Legal basis and purpose

The legal basis is your consent in accordance with Art. 6 Para. 1 a of the GDPR. This can be revoked at any time with effect for the future.

5.5.6   Duration of the storage

The storage period for your data is for as long as you use the portal or until you request us to delete it. If your registration fails or is not completed, your data will be deleted after 14 days.

6.    Transfer of data to non-EU countries or an international organisation

We endeavour to carry out all processing in the European Union (EU) or countries covered by the Adequacy Decision of the EU Commission (Art. 45 of the GDPR). However, in some cases, e.g. when we employ external service providers, we may also transfer personal data to service providers in non-EU countries.

Subject to legal or contractual permissions, we process personal data through the use of service providers in a non-EU country only if the specific requirements of Art. 44 et seq. of the GDPR are met. The data is then processed on the basis of appropriate safeguards (Art. 46 of the GDPR), mandatory internal data protection rules (Art. 47 of the GDPR) special safeguards, or your consent (Art. 49 Para. 1 a of the GDPR).

If we transfer data to service providers in non-EU countries, we disclose this in the respective processing.
In summary, we carry out the following transfers to non-EU countries:

  • to the USA in connection of the use of the job application portal (own privacy policy, see the site) as well as the customer portal (own privacy policy, see the site) and in the use of YouTube, but then only in anonymised form.

7.    No automated decision-making or profilingg

Profiling (Art. 4 No. 4 of the GDPR) describes a type of automated processing of personal data that consists of evaluating, analysing or predicting certain personal aspects such as the work performance, economic situation, health or personal preferences of individuals. We do not use automated decision-making and profiling.

8.    Rights of the data subject and right of complaint

As a data subject affected by the processing of personal data, you have a number of rights arising from Articles 7 and 15 to 22 of the GDPR. You have the following rights:

  • in accordance with Art. 7 of the GDPR: a right to revoke the processing if it is based on your consent in accordance with Art. 6. Para. 1 Sentence 1 a) of the GDPR. The revocation is free of charge and can be made without any formalities, if possible by email to the address given above. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected. Please also note that we may have to retain certain data for various periods in order to comply with legal requirements, e.g. for statutory retention obligations.
  • in accordance with Art. 15 of the GDPR: a right to receive information about the data we process
  • in accordance with Art. 16 of the GDPR: a right of correction if we process incorrect data about you
  • in accordance with Art. 17 of the GDPR: a right to deletion, unless exceptions apply to the grounds on which we are still storing the data, e.g. retention obligations or statutory periods of limitation
  • in accordance with Art. 18 of the GDPR: a right to restriction of processing,
  • in accordance with Art. 19 of the GDPR: the right to be informed about the correction, deletion or restriction of the processing of your personal data. If you request this, we will inform you as the data subject.
  • in accordance with Art. 20 of the GDPR: a right to data portability if we are to transfer your data to another data controller and this is technically feasible.
  • in accordance with Art. 21 of the GDPR: a right to object to processing in the public or legitimate interest, i.e. on the basis of Art. 6 Para. 1 Sentence 1 e) or f) of the GDPR. We will no longer process your data if we cannot demonstrate compelling legitimate grounds for doing so. In the case of direct marketing or profiling, you do not need to give reasons for your objection (Art. 21 Para. 2 of the GDPR), otherwise a justification based on your personal circumstances is required.

In accordance with Art. 77 of the GDPR, you can contact a data protection supervisory authority if you believe that we are not processing your data properly. The authority which is responsible for our company is the Thuringian State Commissioner for Data Protection and Freedom of Information (https://www.tlfdi.de/) zuständig.

 

Valid from: February 2023.