Privacy Policy

5.2.1.2 Categories of data subject

The following groups of persons are affected by the processing:

• All visitors to our website(s)

5.2.1.3 Categories of personal data which are processed

The following personal data is stored:

• Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, date, time, time zone, TYPO3 website domain and path, consents, VAT ID.
• Statistical data: in addition to telemetry data, this also includes general location data, user agent, screen resolution, websites and subpages visited, referrer URL, information on downloaded files, links clicked, search terms from the search engines used.

5.2.1.4 Recipients of the data 

The following bodies are recipients of the data processed:  

• The department which is responsible for the operation of the website at QUNDIS.  
• The data processor responsible for hosting Matomo in accordance with Art. 28 Para. 1 GDPR. 

5.2.1.5 Legal basis and purpose 

The legal basis is Art. 6 Para. 1 Letter a of the GDPR, your consent. This can be revoked at any time with effect for the future. The data will not be used to identify you, but only to measure the coverage of our website and to enable troubleshooting.

5.2.1.6 Duration of the storage 

Matomo cookies are stored for up to 13 months. After the end of the session, you can delete the data in your browser yourself. The analyses and statistics based on the data are retained, but it is no longer possible to draw any conclusions about personal data from them. 

5.2.2 Use of YouTube and Google Maps 

5.2.2.1 Contents of the processing

We use the YouTube service to play videos on our website. We use the Google Maps service to display locations on a map, both services provided by Google Ireland Ltd. or Google Inc. USA. To enable the integration of these services, it is necessary to transfer your IP address and other telemetry and statistical data to Google. 

The services are integrated via the no-cookies function and have to be actively unblocked by the user. This means that data is only transferred with your consent. Information about data processing at Google can be found here: policies.google.com/privacy

5.2.2.2 Categories of data subject 

The following groups of people are affected by the processing:

• All visitors to our website(s)

 
5.2.2.3 Categories of personal data processed 

The following personal data is stored:  

• Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, date, time, time zone, WordPress website domain and path, consents, VAT ID.
• Statistical data: in addition to telemetry data, this also includes general location data, user agent, screen resolution, websites and subpages visited, referrer URL, information on downloaded files, links clicked, search terms from the search engines used.

5.2.2.4 Recipients of the data 

The following bodies are recipients of the data processed:  

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland 

5.2.2.5 Legal basis and purpose 

The legal basis is Art. 6 Para. 1 Letter a) of the GDPR, your consent. This can be revoked at any time with effect for the future.  

5.2.2.6 Duration of the storage 

Detailed information on how YouTube stores your data can be found here: policies.google.com/privacy  

5.2.3 Use of a consent management system from CCM19

5.2.3.1 Contents of the processing

Our website also uses consent technology from CCM19 to obtain your consent and document it in a manner that complies with data protection requirements. This involves the storage of a technically necessary cookie in accordance with §25 Para. 2 Sentence 2 of Germany’s Teleservices Data Protection Act (TTDSG).

The cloud version of CCM19 used by us does not store any personal data or transfer it to CCM. As a result, no personal data is processed.

5.3 Applications portal  

5.3.1 Contents of the processing 

We offer you the opportunity to apply to us online. For this purpose, we use the service Onlyfy from New Work SE, Am Strandkai 1, 20457 Hamburg, www.onlyfy.com.  

You will find separate data protection information for this processing at: qundis.onlyfy.jobs/policy. 

You will find the privacy policy of Onlyfy itself at: onlyfy.com/de/datenschutz/ 

5.4 Q eco service portal

5.4.1 Contents of the processing 

The purpose of the processing is to provide a service portal on which tenants can view their consumption data. In this way landlords comply with their legal obligation to provide information on consumption at any time during the year in accordance with Section 6a of Germany’s Heating Costs Ordinance (HeizkostenVO). There are no plans to change these purposes. As a tenant you can revoke the use of the portal at any time and inform your landlord that you wish to have the consumption data provided in some other way.

A household profile is created in order to automatically obtain and display the desired information. Technically required cookies are stored on your end device in order to enable a secure login and to detect malfunctions in the portal.

In addition, the other processing procedures for QUNDIS websites apply. 

5.4.2 Categories of data subject 

The following groups of people are affected by the processing:  

• Tenants 

5.4.3 Categories of personal data processed 

The following personal data is stored:  

• Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, date, time, time zone, TYPO3 website domain and path, consents, VAT ID.
• Household profile data: mandatory data includes the user ID and password; optional data covers the persons in the household (number of children, number of adolescents, number of adults). In addition, an error report including the time of occurrence (time stamp) may be generated, which is linked to your account. An automated error report is only generated with your express consent.
• Consumption data for the supply of heating: meter reading and consumption information, a cost overview based on current consumption and consumption comparisons in the form of user and third-party user data, as well as suggestions for saving energy. 

5.4.4 Recipients of the data 

The following bodies are recipients of the data processed:  

• The department at QUNDIS which is responsible for the operation of the customer portal.
• The contract processor used for hosting the website in accordance with Art. 28 Para. 1 of the GDPR. 

5.4.5 Legal basis and purpose 

The legal basis is Art. 6 Para. 1 Letter a of the GDPR, your consent. This can be revoked at any time with effect for the future.  

The legal basis for your landlord's use of QUNDIS is Article 28 of the GDPR, in conjunction with § 6a of the Heating Costs Ordinance (statutory obligation).

5.4.6 Duration of the storage 

The storage period of your data is as long as a contractual relationship exists between you and your landlord, or until you terminate the use of the portal or request us to delete the data.

5.5 MeinMessdienstportal 

5.5.1 Contents of the processing 

The MeinMessdienstportal website at meinmessdienstportal.de is used to search for metering service companies by property managers, property owners and others.

5.5.2 Categories of data subject 

The following groups of people are affected by the processing:  

• All visitors to our website(s) 
• The contact persons of the registered companies

5.5.3 Categories of personal data processed 

The following personal data is stored:  

• Telemetry data: this includes the IP address, browser type/version, operating system, cookie duration, cookie version, TYPO3 website domain and path, consents, VAT ID
• Contact information (on registration): this includes the name, telephone number and email address of the contact person.

5.5.4 Recipients of the data 

The following bodies are recipients of the data processed:  

• The department which is responsible for the operation of the website at QUNDIS.  

5.5.5 Legal basis and Purpose

The legal basis is Art. 6 Para. 1 Letter a of the GDPR, your consent. This can be revoked at any time with effect for the future.  

5.5.6 Duration of the storage

The storage period for your data is for as long as you use the portal or until you request us to delete it. If your registration fails or is not completed, your data will be deleted after 14 days.

5.6 Processing: applicants

5.6.1 Contents of the processing

We process the data necessary for the establishment, implementation and termination of the employment relationship. This includes personal data, contact details, qualifications, working hours, salary data, social security contributions and similar information that you provide to us in the context of establishing the contract or that is determined and calculated for its implementation. If necessary, we may process further personal data about you which is not mentioned here. In such cases, you will receive further data protection information as required.  

5.6.2 Categories of data subject

The following groups of people are affected by the processing: 

• Employees: this includes full-time and part-time employees, apprentices, interns, volunteers, applicants and former employees.  

5.6.3 Categories of personal data processed

The following data is stored, if available and applicable: 

• Basic data: surname, first name, previous surnames, title, academic degree
• Communication data: landline, mobile phone, email, Internet address
• HR master data: personnel number, date of birth, place of birth, gender, marital status, children, nationality, bank details, length of service, social security number, tax number, health insurance membership, sick notes, fixed-term employment data, notice period, job title, 
• Extended personal data: authorisations to represent the company, photograph, working time records, holiday management data, religion, health resort stays, maternal leave, absences, business travel data, degree of disability, basis for calculating remuneration, gross and net remuneration, social security contributions, expense allowances, daily allowances, tax office, data on the use of company vehicles, special qualifications, secondary employment and, if applicable, further similar information.  

5.6.4 Recipients of the data

The following bodies are recipients of the data processed: 

• Social insurance agencies, tax advisors/payroll accounting, tax administration

5.6.5 Legal basis and Purpose

The legal basis is Art. 6 Para. 1 Letter b) GDPR (contract fulfilment) and Art. 6 Para. 1 Letter c) (legal obligation).  

5.6.6 Duration of the storage

Personal data is stored for the duration of the employment relationship and for a further four years, provided that no legal requirements or legal disputes prevent deletion.

5.7 Processing: Mediathek 

5.7.1 Contents of the processing

With access to our Mediathek you can download many files such as presentations, product documentation, images, roadshow content and similar. These are naturally reserved for our customers and those interested in QUNDIS products, which is why we require registration to verify this. Your details will be used exclusively for access to the Mediathek and will not be used for any other purpose.

5.7.2 Categories of data subject

The following groups of people are affected by the processing:

• All Mediathek users.

5.7.3 Categories of personal data processed

The following data is stored, if available and applicable: 

• Basic data: surname, first name, company
• Communication data: email
• Access data: password

5.7.4 Recipients of the data

The following bodies are recipients of the data processed: 

• Only internal departments at QUNDIS, in particular our sales and IT departments.

5.7.5 Legal basis and Purpose

The legal basis is Art. 6 Para. 1 Letter a) GDPR (your consent).

5.7.6 Duration of the storage

The storage period is as long as you wish to use the Mediathek. If you wish to terminate access and delete your data, please inform us and the deletion will be carried out immediately. The data will not be stored any longer.

6. Transfer of data to non-EU countries or an international Organisation

We endeavour to carry out all processing in the European Union (EU) or countries covered by the Adequacy Decision of the EU Commission (Art. 45 of the GDPR). However, in some cases, e.g. when we employ external service providers, we may also transfer personal data to service providers in non-EU countries.

Subject to legal or contractual permissions, we process personal data through the use of service providers in a non-EU country only if the specific requirements of Art. 44 et seq. of the GDPR are met. The data is then processed on the basis of appropriate safeguards (Art. 46 of the GDPR), mandatory internal data protection rules (Art. 47 of the GDPR) special safeguards, or your consent (Art. 49 Para. 1 a of the GDPR).

If we transfer data to service providers in non-EU countries, we disclose this in the respective processing.
In summary, we carry out the following transfers to non-EU countries:

• to the USA in connection of the use of the job application portal (own privacy policy, see the site) as well as the customer portal (own privacy policy, see the site) and in the use of YouTube, but then only in anonymised form.

7. No automated decision-making or profiling

Profiling (Art. 4 No. 4 of the GDPR) describes a type of automated processing of personal data that consists of evaluating, analysing or predicting certain personal aspects such as the work performance, economic situation, health or personal preferences of individuals. We do not use automated decision-making and profiling.

8. Rights of the data subject and right of complaint

As a data subject affected by the processing of personal data, you have a number of rights arising from Articles 7 and 15 to 22 of the GDPR. You have the following rights:

• in accordance with Art. 7 of the GDPR: a right to revoke the processing if it is based on your consent in accordance with Art. 6. Para. 1 Sentence 1 a) of the GDPR. The revocation is free of charge and can be made without any formalities, if possible by email to the address given above. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected. Please also note that we may have to retain certain data for various periods in order to comply with legal requirements, e.g. for statutory retention obligations
• in accordance with Art. 15 of the GDPR: a right to receive information about the data we process
• in accordance with Art. 16 of the GDPR: a right of correction if we process incorrect data about you
• in accordance with Art. 17 of the GDPR: a right to deletion, unless exceptions apply to the grounds on which we are still storing the data, e.g. retention obligations or statutory periods of limitation
• in accordance with Art. 18 of the GDPR: a right to restriction of processing 
• in accordance with Art. 19 of the GDPR: the right to be informed about the correction, deletion or restriction of the processing of your personal data. If you request this, we will inform you as the data subject
• in accordance with Art. 20 of the GDPR: a right to data portability if we are to transfer your data to another data controller and this is technically feasible.
• in accordance with Art. 21 of the GDPR: a right to object to processing in the public or legitimate interest, i.e. on the basis of Art. 6 Para. 1 Sentence 1 e) or f) of the GDPR. We will no longer process your data if we cannot demonstrate compelling legitimate grounds for doing so. In the case of direct marketing or profiling, you do not need to give reasons for your objection (Art. 21 Para. 2 of the GDPR), otherwise a justification based on your personal circumstances is required.

In accordance with Art. 77 of the GDPR, you can contact a data protection supervisory authority if you believe that we are not processing your data properly. The authority which is responsible for our company is the Thuringian State Commissioner for Data Protection and Freedom of Information (https://www.tlfdi.de/). 

Valid from: November 2024.