1. Data Controller

Alliance for Qualification (A4Q) GmbH
Keltenring 15, 82041 Oberhaching, Germany
Email: info@a4q.com

2. What Data We Collect and Why

2.1 Server Log Files

When you visit our website, our web server automatically records: browser type and version, operating system, referrer URL, hostname and IP address, date and time of request, and HTTP status code. This data is processed under Art. 6(1)(f) GDPR (legitimate interests) for security and error-free operation. Log files are deleted after 30 days.

2.2 Contact Forms & Email

Data submitted via contact forms (name, email, message) is stored solely to process your enquiry under Art. 6(1)(b) GDPR (contract performance / pre-contractual measures). Data is deleted once the enquiry is conclusively resolved, unless legal retention obligations apply.

2.3 User Accounts & Membership

Registration data (name, email, password) is processed under Art. 6(1)(b) GDPR. Account data is retained for as long as your account is active. You may request deletion at any time by emailing info@a4q.com.

2.4 Payment Processing

Purchase transactions are handled by third-party payment processors. We do not store full payment card details. Processing is based on Art. 6(1)(b) GDPR. Please consult your payment provider's privacy policy for details.

2.5 Cookies

We use the following types of cookies:

• Strictly necessary cookies — required for core site functionality (session, login state). Legal basis: Art. 6(1)(f) GDPR.
• Functional cookies — remember your preferences. Legal basis: Art. 6(1)(a) GDPR (consent).
• Analytics cookies — help us understand site usage. Legal basis: Art. 6(1)(a) GDPR (consent).

You may withdraw consent at any time through your browser settings or our cookie preferences panel.

3. Third-Party Services

3.1 Hosting

This website is hosted on servers with appropriate security controls. Hosting is based on Art. 6(1)(f) GDPR.

3.2 Google Fonts

We use Google Fonts for web typography. Loading fonts may transmit your IP address to Google's servers. Basis: Art. 6(1)(f) GDPR. See Google's Privacy Policy.

3.3 Embedded Content

Pages may include embedded content from third parties (e.g. video, social media). Such content behaves as if you visited those sites directly and may collect data about you. Please review the privacy policies of the relevant third parties.

4. Legal Bases for Processing

• Art. 6(1)(a) — Your consent
• Art. 6(1)(b) — Performance of a contract with you
• Art. 6(1)(c) — Compliance with a legal obligation
• Art. 6(1)(f) — Our legitimate interests (where not overridden by your rights)

5. International Data Transfers

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses per Art. 46 GDPR).

6. Data Retention

We retain personal data only as long as necessary to fulfil the stated purposes or as required by law (e.g. German commercial and tax records for up to 10 years). Data is securely deleted or anonymised when no longer needed.

7. Your Rights Under GDPR

You have the following rights as a data subject:

• Right of access (Art. 15) — Request a copy of the data we hold about you.
• Right to rectification (Art. 16) — Ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — Request deletion of your personal data.
• Right to restriction (Art. 18) — Ask us to limit how we use your data.
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — Object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent — You may withdraw consent at any time without affecting prior processing.

To exercise these rights, email info@a4q.com with subject line "Privacy / GDPR". We will respond within 30 days. You also have the right to lodge a complaint with the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), the competent supervisory authority.

8. Data Security

We implement appropriate technical and organisational security measures, including TLS/HTTPS encryption, to protect your personal data against unauthorised access, alteration, disclosure or destruction.

9. Children's Privacy

Our website is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently done so, please contact us and we will delete the data promptly.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal obligations. The current version is always available on this page. Material changes will be communicated via a notice on our website.

11. Contact