Privacy Policy

1. Introduction

1.1. Data protection is of particular importance to QUALLEE.

Through this privacy policy, our company wishes to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, data subjects are informed of their rights through this privacy policy. The processing of personal data, such as name, address, email address, or telephone number of a data subject, is always carried out in accordance with the General Data Protection Regulation and in compliance with the country-specific data protection regulations applicable to QUALLEE.

2. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union, and other provisions of a data protection nature is:

Contact

Email: info(at)quallee.de
Contact Form
Web: quallee.ai

3. Name and Address of the Data Protection Officer

The Data Protection Officer of the controller is:

Any data subject may contact our Data Protection Officer directly at any time with questions or suggestions regarding data protection.

4. General Use of the Website

4.1. Access Data

The website quallee.ai collects a range of general data and information with each access to the website by a data subject or automated system. This general data and information is stored in the server log files. The following may be collected: (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites accessed via an accessing system on our website, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) other similar data and information that serve to prevent threats in the event of attacks on our information technology systems.

When using this general data and information, QUALLEE does not draw any conclusions about the data subject.

4.2. Cookies

The website quallee.ai uses cookies. Cookies are text files that are stored on a computer system via an Internet browser. Through the use of cookies, QUALLEE can provide users of this website with more user-friendly services that would not be possible without cookie settings.

The user can prevent the setting of cookies by our website at any time by means of an appropriate setting of the Internet browser used and thus permanently object to the setting of cookies.

Statistics Cookies (4)

Statistics cookies help website owners understand how visitors interact with websites by collecting and reporting information anonymously.

Marketing Cookie (1)

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and therefore more valuable for publishers and third-party advertisers.

4.3. Newsletter

QUALLEE informs interested parties at regular intervals by means of a newsletter about company offers.

Which personal data is transmitted to the controller when ordering the newsletter can be seen from the input mask used for this purpose.

The newsletter of our company can only be received by the data subject if (1) the data subject has a valid email address and (2) the data subject registers for the newsletter mailing. For legal reasons, a confirmation email will be sent to the email address entered by a data subject for the first time for newsletter dispatch using the double opt-in procedure. This confirmation email serves to verify whether the owner of the email address as the data subject has authorized receipt of the newsletter.

All personal data will be deleted after unsubscription.

The newsletters are sent using Listmonk, an open-source newsletter software that we operate on our own servers in Germany.

The email addresses of our newsletter recipients, as well as other data described in this notice, are stored and processed exclusively on our own servers in Germany. There is no transfer of personal data to third countries. The data is not passed on to third parties. More information about Listmonk can be found at: https://listmonk.app/

Newsletter usage is analyzed analytically. The goal is to optimize newsletter delivery and better adapt the content of future newsletters to the interests of data subjects. For this purpose, the newsletter contains so-called tracking pixels. A tracking pixel is a miniature graphic embedded in emails sent in HTML format to enable log file recording and analysis. This collected data is not passed on to third parties. Data subjects are entitled to revoke the separate consent given via the double opt-in procedure at any time - this also applies to the unsubscribe link contained in each newsletter footer. After revocation, these personal data will be deleted by the controller. QUALLEE automatically interprets an unsubscription from the newsletter as a revocation.

4.4 Contact Form

If you contact us via our contact form, the data you provide (e.g., email address, name, first name, salutation) will be stored by us to answer your questions. We delete the data collected in this context after storage is no longer required, or restrict processing if statutory retention obligations exist. There is no merging with other data about you. The data is not passed on to third parties and no automated decision-making takes place.

4.5 Data Processing for Form Requests and Downloads

If you request a download (e.g., whitepaper, studies) via one of our forms, we use the personal data you provide (e.g., name, email address, company) exclusively to provide you with the requested content and to contact you for questions on the respective topic. You can revoke your consent to be contacted at any time by sending an email to info@quallee.de. After revocation, we will not further use your personal data and will delete it unless statutory retention obligations exist. The data collected via the form is processed exclusively internally and not passed on to third parties. We use appropriate technical and organizational measures to ensure the security of your data. Your data will be deleted after completion of the process, but no later than 24 months, unless statutory retention obligations exist or you have previously revoked your consent.

5. Collection, Storage and Processing of Personal Data

We collect personal data within the framework of data avoidance and data minimization only to the extent and for as long as is necessary for the purpose, or as prescribed by law. The legal basis for data processing according to the above provisions is Art. 6 para. 1 lit. a), b) and f) GDPR. We take the protection of your personal data seriously and strictly adhere to the relevant legal regulations and this privacy policy when collecting and processing personal data. If the purpose of data collection ceases to exist or the end of the statutory retention period is reached, the collected data will be blocked or deleted. Normally, our website can be used without the disclosure of personal data. If we collect personal data - such as your name, address, or email address - this data is collected voluntarily. Without express consent from you, this data will not be disclosed to third parties.

6. Analysis with Google Analytics

We use the web analytics service Google Analytics from Google LLC, Mountain View, CA on our website. Google is certified under the EU-US Data Privacy Framework: www.dataprivacyframework.gov/list

Google uses cookies. These are text files that allow analysis of your user behavior in relation to our website by being stored on your PC. The cookies generate information that is transmitted to a Google server. These servers are usually located in the USA and truncate your IP address before transmission to the United States. Only in exceptional cases is the IP address truncated after transmission to the USA. Google evaluates the transmitted information and provides further services in this context for us website operators. The determined IP address is not merged with other Google services.

You can prevent the storage of cookies on your computer by changing your browser settings. However, this may result in display and functional restrictions when using our website. A browser plugin also prevents the collection and use of data generated by cookies. You can download it at: https://tools.google.com/dlpage/gaoptout?hl=de

Learn more about Google and Google Analytics privacy terms at: http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/

7. Payment Processing with Stripe

For processing payments and subscriptions, we use the payment service provider Stripe Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA.

Stripe is certified under the EU-US Data Privacy Framework: www.dataprivacyframework.gov/list

During payment transactions, the payment data you enter (e.g., credit card number, expiration date, CVC) is transmitted directly to Stripe and processed there. We do not store any complete payment data ourselves - only a reference ID for assigning the payment.

Stripe processes this data to execute the payment, for fraud prevention, and to comply with legal obligations. The legal basis for data processing is Art. 6 para. 1 lit. b) GDPR (contract performance).

For more information about data protection at Stripe, please visit: https://stripe.com/privacy

8. Participation in Meetings via Microsoft Teams

When we arrange online meetings, we use - unless otherwise individually agreed - Microsoft Teams. This is a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

The transcription function is used, which means that the spoken word is recorded in text form and can be assigned to the data subject, i.e., the speaker.

Microsoft Corporation is certified under the Data Privacy Framework: www.dataprivacyframework.gov/list

The data will be deleted without undue delay. This usually means three years after the end of the calendar year in which the recording took place (Section 195 German Civil Code). In individual cases, the retention period may be longer, particularly in the case of criminal offenses or unlawful acts. A deletion concept can be provided at any time upon first request.

No automated decision-making, including profiling, or transfer to international organizations takes place.

Information about Microsoft Teams' privacy policy can be found at: https://privacy.microsoft.com/de-de/privacystatement

The legal basis for data processing is Art. 6 para. 1 lit. f) GDPR, i.e., our legitimate interest in evaluating conversations as effectively as possible, as well as Art. 6 para. 1 lit. b) GDPR, i.e., evaluation for the performance of a contractual relationship with you.

9. AI-Powered Data Processing

QUALLEE uses AI technologies for conducting and analyzing interviews. Data is transmitted to external AI providers:

9.1 Speech Recognition (Speech-to-Text)

For transcribing voice recordings, we use the Whisper API from OpenAI, Inc., 3180 18th Street, San Francisco, CA 94110, USA. Audio data is transmitted to OpenAI for conversion to text.

9.2 Interview Analysis and Chat

For AI-powered interview facilitation and analysis, we use the Claude API from Anthropic, PBC, 548 Market St, San Francisco, CA 94104, USA. Text content from interviews is transmitted to Anthropic for processing.

9.3 Text Analysis and Embeddings

For semantic text analysis and creating embeddings, we also use APIs from OpenAI. Text content is transmitted for vectorization.

9.4 AI-Powered Support

QUALLEE offers registered users AI-powered support via the support form on our website.

This AI Support responds as a text-based, automated dialogue system to questions about products and services, whereby an artificial intelligence accesses various data sources (knowledge database, FAQs) via an integration of interfaces and generates answers based on user input.

When interacting with AI Support, the following data is collected: technical metadata (date, time, request ID), the email address of the registered user, and the content of the support request. This data is required to process and answer the requests.

For quality assurance purposes and possible further processing of the matter, chat histories are stored. Storage also serves to ensure adequate transparency. The stored chat histories are used to continuously improve and develop the AI Support. Training or machine learning of the AI models by the providers is not associated with this – such use is contractually excluded in the DPAs.

Support requests are automatically stored for 24 months and then deleted, unless legal retention obligations exist.

The legal basis for processing is Art. 6 para. 1 lit. b) GDPR (contract performance) and Art. 6 para. 1 lit. f) GDPR (legitimate interest in providing the best possible response to support requests and quality assurance).

Data Processing Agreements

Both providers process personal data exclusively as data processors pursuant to Art. 28 GDPR on our instructions. Data Processing Addendums are in place with both providers, which include EU Standard Contractual Clauses for data transfers to the USA.

Both providers implement industry-standard security measures (encryption, access control, SOC 2 certification).

No Use for AI Training

Important: Your data will NOT be used by AI providers for training their models. This is contractually stipulated in the DPAs. Processing is solely for providing the commissioned service.

Data Storage

Raw data (audio files, complete transcripts) is stored exclusively on our servers in Germany. Only the data necessary for the respective processing is transmitted to the AI APIs.

Legal Basis

The legal basis for this data processing is Art. 6 para. 1 lit. b) GDPR (contract performance) as well as Art. 6 para. 1 lit. a) GDPR (consent), which is obtained before the start of an interview.

Further Information

OpenAI Privacy Policy: https://openai.com/policies/privacy-policy

Anthropic Privacy Policy: https://www.anthropic.com/privacy

10. Data Sharing for Participant Recruitment

When you place a participant recruitment order through QUALLEE, your contact data (name, email address, phone number) is transferred to our recruitment partner TestingTime AG, Zurich, Switzerland. This transfer is based on Art. 6(1)(b) GDPR (contract performance), as the sharing is necessary for the execution of the recruitment order.

TestingTime requires your contact data to reach you as the client – in particular for queries regarding target group definition, scheduling, and status updates on the recruitment order.

Data processing by TestingTime is governed by their own privacy policy. QUALLEE has no influence on the further processing of your data by TestingTime after transfer. Further information can be found in the TestingTime privacy policy at: https://www.testingtime.com/en/privacy-policy/

11. Data Subject Rights

You have the right:

• pursuant to Art. 15 GDPR to request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if not collected by us, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details;
• pursuant to Art. 16 GDPR to immediately demand the rectification of incorrect or completion of your personal data stored by us;
• pursuant to Art. 17 GDPR to demand the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
• pursuant to Art. 18 GDPR to demand the restriction of processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is unlawful but you oppose its erasure and we no longer need the data, but you need it for the establishment, exercise, or defense of legal claims, or you have objected to processing pursuant to Art. 21 GDPR;
• pursuant to Art. 20 GDPR to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or to demand transmission to another controller;
• pursuant to Art. 7 para. 3 GDPR to revoke your consent at any time to us. This has the consequence that we may no longer continue the data processing based on this consent in the future; and
• pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority.

12. Right to Object

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right pursuant to Art. 21 GDPR to object to the processing of your personal data, provided there are grounds for this arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation.

If you wish to exercise your right of revocation or objection, an email to info(at)quallee.de is sufficient.