1. Controller

The controller responsible for processing personal data on this website is:

Ablaxis—Proprietor Marcel Machoni
Wolffsonstieg 4
22297 Hamburg
Germany

Email: m@qtrflow.ai
Additional business email: marcel@machoni.de
Contact form: qtrflow.ai/kontakt/

2. Provision and security of the website

The website is operated on Google Cloud infrastructure and delivered and protected through Cloudflare services.

In particular, the following technical data may be processed when you access the website:

IP address
date and time of access
address accessed and volume of data transferred
browser, operating system and device type
referrer, where transmitted by the browser
HTTP status and technical error data
security-relevant connection and event data

This processing serves to provide the website reliably, prevent attacks and misuse, and analyze and resolve technical errors.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically error-free operation of the website.

To protect the website, technically reduced reports concerning violations of the website's security policies may also be processed. For example, the security rule concerned and a shortened destination address are logged.

Further information: Google Cloud privacy and Cloudflare privacy.

3. Contact form and HubSpot

When you use the contact form, the data you enter is first transmitted to the QTRflow server, where it is checked technically, and is then transferred to HubSpot through a server-side interface. The browser does not transmit the form data directly to HubSpot.

In particular, the following data may be processed:

first and last name
company
Email address
phone number provided voluntarily
selected subject
content of the message
time and context of the inquiry
your consent to the processing of the contact inquiry

Where a HubSpot identifier is already present in the browser, it may be taken into account as part of the server-side form submission. No general HubSpot tracking script is currently used on the website.

The data is used to process your inquiry, enable follow-up questions and document further communication.

Depending on the content of your inquiry, processing is based on:

Article 6(1)(a) GDPR, where you give consent,
Article 6(1)(b) GDPR, where your inquiry serves to prepare or perform a contract,
Article 6(1)(f) GDPR for other business inquiries. Our legitimate interest lies in the appropriate processing and documentation of the inquiry.

Consent that has been given may be withdrawn at any time with effect for the future. The lawfulness of processing up to the time of withdrawal remains unaffected.

Further information about HubSpot: HubSpot privacy.

4. Contact by email

If you contact us by email, we process your email address, the content of your message and any other information and documents you may provide.

Processing is carried out to handle your inquiry. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual inquiries and otherwise Article 6(1)(f) GDPR. Our legitimate interest lies in responding to and documenting business inquiries.

5. Scheduling appointments with Calendly

A Calendly appointment scheduling service is embedded on the contact page. When the embedded Calendly function is accessed, the browser may establish a connection to Calendly.

In particular, the following data may be processed:

IP address and technical connection data
browser, device and usage information
cookies or comparable browser identifiers
name and contact details
selected appointment and time zone
information provided voluntarily during the booking process

The data entered during the booking process is used to schedule, confirm and hold the appointment.

The appointment details themselves are processed on the basis of Article 6(1)(b) GDPR where this serves to prepare or conduct a business relationship. Otherwise, they are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in efficient and user-friendly appointment scheduling.

The requirements of Section 25 TDDDG also apply to storing information on your terminal device or accessing information already stored there. Where the technologies used are not strictly necessary, prior consent is required.

Further information about Calendly: Calendly privacy.

6. Q-Chat

Q-Chat on the product page answers questions based on the Q knowledge base provided on qtrflow.ai.

The question entered and the process of identifying the appropriate answer are handled in the browser. The question is not transmitted to an external AI service, HubSpot or another external chat provider.

The current chat history is displayed only within the open page. The chat history is not stored persistently on the server.

If you open and submit the contact form from Q-Chat, the information in the 'Contact form and HubSpot' section applies to the data entered there.

7. Local storage, cookies and tracking

The website stores the view you select—for example, Light Mode or Executive Mode—under the name 'q-theme' in your browser's local storage. This setting remains in place until you change it or clear your browser's local storage.

For navigation, the back function and page position, technically necessary information may be stored in the browser's session storage during the current browser session.

These functions provide the presentation and usability of the website that you request. Processing is based on Article 6(1)(f) GDPR. Where access to the terminal device is strictly necessary for the function expressly requested, Section 25(2) TDDDG applies.

QTRflow currently does not use its own services for audience measurement, advertising tracking or user-specific profiling.

Third-party providers such as Calendly may use their own cookies or comparable technologies as part of their embedded functions. The information in the relevant section of this privacy policy applies.

8. Recipients and international data transfers

Depending on the function used, personal data may be processed by the following service providers:

Google Cloud as a hosting and infrastructure provider
Cloudflare as a provider of delivery, security and protection against attacks
HubSpot for contact inquiries and their processing
Calendly for scheduling appointments

These service providers process data in accordance with their respective contractual and data protection provisions.

Where personal data is processed outside the European Union or the European Economic Area, it is transferred only on the basis of the statutory requirements of Articles 44 et seq. GDPR. This may include an adequacy decision by the European Commission, particularly for appropriately certified companies under the EU-US Data Privacy Framework, or suitable safeguards such as the European Commission's standard contractual clauses.

Information on data processing terms:

9. Retention period

Personal data is stored only for as long as necessary for the respective processing purpose.

The data is then deleted unless statutory retention obligations, legitimate interests in limited further storage, or claims and evidence obligations prevent deletion.

Technical log data is retained only for as long as necessary for operations, security and error analysis. Data from contact inquiries and appointment scheduling is stored depending on the course of the inquiry and statutory and contractual retention obligations.

10. Your rights

Subject to the statutory requirements, you have in particular the right to:

access your stored personal data,
rectification of inaccurate or incomplete data,
erasure of your data,
restriction of processing,
data portability,
object to processing based on legitimate interests,
withdraw consent that has been given, with effect for the future.

To exercise your rights, it is sufficient to send a message to m@qtrflow.ai.

If you object to processing based on Article 6(1)(f) GDPR, we will assess your personal situation. We will then no longer process the data concerned unless compelling legitimate grounds or the establishment, exercise or defence of legal claims prevent this.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The authority with particular jurisdiction for the controller's registered office is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg

datenschutz-hamburg.de

12. Automated decisions

No solely automated decision-making with legal or similarly significant effects takes place on this website. No personal profiling is used for advertising or decision-making purposes.

13. Changes to this privacy policy

We update this privacy policy when functions, service providers or legal requirements change. The version currently published on this website is authoritative.

Note on the English-language version

This website is provided in German and English. The English version was created on the basis of the German version using artificial intelligence. It is provided to aid understanding.

In the event of discrepancies, ambiguities or questions of interpretation, the German version is authoritative. This applies in particular to legal notices and information concerning the scope of services, functions, availability or characteristics of Q. Differing wording in the English version alone does not create any additional assurances, guarantees or obligations.

Individual agreements and contracts remain unaffected.

How we process personal data on this website.