Privacy policy

QMVP GmbH, Frankfurter Straße 56, 61231 Bad Nauheim, Germany, represented by Managing Director Eugen Betche. Contact for privacy inquiries: info@qmvp.de

We process personal data only as necessary to operate and statistically evaluate this website, respond to inquiries, establish and conduct business relationships, or manage applications. The relevant legal bases are stated for each activity below. We do not carry out automated decision-making, including profiling.

This website is hosted by Netlify, Inc. (USA). When you visit the website, technically necessary access data are processed, including IP address, date and time, requested URL, referring URL, browser and operating system information, HTTP status and transferred data volume. Processing serves website delivery, technical security, troubleshooting and abuse prevention under Article 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of this website. The recipients of the data are Netlify and the necessary subprocessors. Server-side audience analytics are described in section 7a. See section 9 for international transfers.

When you contact us by email or through the form, we process the information you provide. Name, email address and message are required; company and subject area are optional. We also record the language of the inquiry. We process this information to respond, communicate before entering into a contract and document correspondence. The legal bases are Article 6(1)(b) GDPR for contractual or pre-contractual inquiries and Article 6(1)(f) GDPR for other business communication. Form submissions are stored in a database provided by Neon. To notify us of new inquiries, we transmit your name, email address, company, subject area and message to the email delivery service Resend. Within QMVP, access is limited to those handling the inquiry. To prevent automated abuse, an IP-based verification value is generated with a secret key. The IP address is not stored in plain text in the contact record. The legal basis is Article 6(1)(f) GDPR; our interest is protecting the form and our systems. We delete or anonymize inquiries once they have been resolved, unless retention is required for contractual or statutory reasons or the defense of legal claims.

If you apply for a position or contact us about working together, we process the application data you provide. This may include contact details, CV, qualifications, work history, availability, salary expectations and correspondence. Processing serves the decision on establishing an employment relationship under section 26(1) BDSG or, where that provision does not apply, pre-contractual measures under Article 6(1)(b) GDPR. Special categories of personal data are processed only where necessary and legally permitted. Access is limited to those involved in selection and necessary IT and email providers. Application data is generally deleted within six months after the process ends, unless legal obligations or legitimate grounds for defending claims require longer retention. Retention in an applicant pool requires separate, voluntary consent, which may be withdrawn at any time with future effect. Without consent, speculative applications are not retained indefinitely.

Our website links to external websites, including LinkedIn profiles and posts. Simply visiting our website does not embed LinkedIn content or establish a connection to LinkedIn. Following an external link takes you away from this website. The respective provider is responsible for subsequent processing under its privacy information.

Public pages use no marketing or tracking cookies or automatically loaded third-party embeds. The audience analytics described in section 7a operate on the server without analytics cookies or an additional tracking script in the browser. When you expressly choose a language, the qmvp_locale cookie stores de or en for up to twelve months. It remembers your choice for subsequent visits to the home page. Dismissing the language suggestion is recorded in session storage for the current tab session. These settings are used only to provide your chosen language experience. The protected CMS uses technically necessary session and security cookies for authorized internal users. They serve authentication, session management and permission checks. Storage and access are necessary under section 25(2)(2) TDDDG to provide the expressly requested protected access. Where personal data are processed, the legal basis is Article 6(1)(f) GDPR; our interest is secure, access-controlled CMS operation. Sign-in may use Microsoft Entra ID or an internal CMS account. Microsoft processes the information required for authentication and account association under its own or contractually agreed responsibilities.

We use Netlify Web Analytics to evaluate website usage in aggregate and improve our content and technical delivery. The analysis uses hosting server logs and includes page views, pages requested, referring websites, approximate geographical origin, data transferred and unsuccessful requests. Netlify uses distinct IP addresses to estimate visitor numbers within each reporting period. This figure is approximate and does not necessarily represent individual people. We do not use the results to identify individual visitors, for individualized advertising or to create personal usage profiles. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is understanding demand for our information and improving our offering accordingly. We use aggregate statistics from existing server data without additional analytics cookies, fingerprinting or cross-device identifiers. We access aggregate reports only within the period provided by our hosting plan. Underlying hosting logs are processed for the periods necessary for security, troubleshooting and abuse prevention. For retention criteria, Netlify as recipient, international transfers and your right to object, see sections 8 to 11.

We disclose personal data only where necessary for the relevant purpose, required by law or authorized by consent. Technical providers include Netlify for hosting, media delivery and server-side audience analytics, Neon for the database, Resend for form notifications and Microsoft for email communication and, where applicable, internal authentication. Where providers act on our behalf, they are contractually bound under Article 28 GDPR. Data may also be disclosed to advisers, authorities or courts where legally necessary or to establish, exercise or defend legal claims.

Some technical providers or their subprocessors are located outside the European Economic Area, particularly in the United States. Personal data may therefore be processed in third countries. Where no European Commission adequacy decision applies, transfers rely on appropriate safeguards under Article 46 GDPR, particularly the European Commission standard contractual clauses. Where applicable, valid certification under the EU–US Data Privacy Framework may also apply.

We retain personal data only as long as necessary for its purpose, then delete or anonymize it unless statutory retention periods, contractual obligations or legitimate grounds for defending legal claims require otherwise. Specific criteria for inquiries and applications appear in sections 4 and 5. Technical logs are subject to the hosting operation security and retention periods and are used only as necessary for security and troubleshooting.

Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction, data portability and objection to certain processing. Where processing relies on consent, you may withdraw it at any time with future effect. Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. Contact info@qmvp.de to exercise your rights.

You may lodge a complaint with a data protection supervisory authority. In particular, the competent authority for QMVP GmbH is the Hessian Commissioner for Data Protection and Freedom of Information, PO Box 3163, 65021 Wiesbaden, Germany; email: poststelle@datenschutz.hessen.de. You may also contact the authority at your habitual residence, workplace or the place of the alleged infringement.

Last updated: 12 October 2026. We update this policy when legal requirements or actual technical processing change.