Controller
Qntum21 UG (limited liability)
An der Talle 97
33102 Paderborn
Germany
Represented by the managing directors Taylan Surmann, Marcel Meyer and Adrian Kittner.
Email: info(at)qntum21.com
This policy applies where QNTUM21 determines the purposes and means of processing. Apple, Google or Microsoft may be independent controllers for individual platform services.
Purposes and legal bases
We process personal data only where this is necessary to provide our website, applications, contractual services, support and security functions, or where consent has been given.
- Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures, especially registration, licensing, delivery and support.
- Art. 6(1)(c) GDPR: compliance with statutory retention, evidence and security obligations.
- Art. 6(1)(f) GDPR: legitimate interests in secure operation, error analysis, prevention of misuse and fraud, and product development.
- Art. 6(1)(a) GDPR: consent where processing is optional. Consent may be withdrawn at any time with future effect.
Website, hosting and local settings
Hosting by goneo
The website is hosted by goneo Internet GmbH, Dresdener Straße 18, 32423 Minden, Germany. When the website is accessed, server logs may process the IP address, time, requested address, HTTP status, referrer, browser and device data, and user agent. This is necessary for delivery, stability, error analysis and defence against attacks (Art. 6(1)(f) GDPR).
According to goneo, its servers are operated in Germany. Log data is stored for no more than seven days. It is retained longer only where necessary to investigate a specific security incident; in that case, IP addresses are removed or altered so that they can no longer be assigned to the originating connection.
Theme setting
Only the qntum-theme setting is stored locally in the browser for the light or dark appearance expressly selected by you. It provides a function requested by you and is not used for advertising. The legal basis is Section 25(2)(2) TDDDG; any subsequent processing is based on Art. 6(1)(f) GDPR.
Contact
If you contact us, we process your contact details and the content of your message to handle your request. The legal basis is Art. 6(1)(b) or (f) GDPR. Statutory retention obligations remain unaffected.
Pre-registration via Microsoft Forms
The pre-registration button opens an external Microsoft Forms page. Microsoft's privacy terms apply only after that page has been opened. Depending on the configuration, Microsoft processes technical access data and the information entered in the form; QNTUM21 receives the submitted responses.
The processing is used to handle your pre-registration and provide product information at your request (Art. 6(1)(b) GDPR) or, where expressly requested, on the basis of your consent (Art. 6(1)(a) GDPR).
QNTUM21 is responsible for the information entered in the form and transmitted to QNTUM21. Microsoft processes form data as part of Microsoft 365 under the applicable data-protection agreements. Where Microsoft processes account, security, diagnostic or usage data for its own purposes, Microsoft provides information about that processing under its own responsibility.
Microsoft states that Forms data is encrypted in transit and at rest. Processing and storage depend on the Microsoft 365 tenant configured for QNTUM21 and the data locations agreed with Microsoft.
Further information: Microsoft Privacy Statement and Security and privacy in Microsoft Forms.
QNTUM21 applications
Depending on the product purchased and the function used, the following categories of data may be processed:
- Account and tenant data: name, email address, user ID, role, permissions, settings and authentication data.
- Contract and licence data: product, licence status, purchase and activation status, vouchers, transaction references and support history.
- Vehicle and control-unit data: vehicle identifiers, model and equipment data, ECU and TCU information, software and data versions, and compatibility data.
- Diagnostic and telemetry data: fault codes, freeze frames, readings, minimum and maximum values, live logs, CSV exports, dyno runs and timestamps.
- Device and connection data: application version, operating system, device and session identifiers, network and interface information, connection logs and error logs.
- Remote and support data: only where remote assistance is actively requested; session data, approvals, steps performed and security logs.
Data is processed for account administration, licence checks, vehicle compatibility, performance of selected functions, technical security, diagnostics, export, support and prevention of misuse. The primary legal basis is Art. 6(1)(b) GDPR; security logs may be based on Art. 6(1)(f) GDPR.
Permissions and local data
The application requests access to Bluetooth or nearby devices, the local network, USB or vehicle interfaces, or files only where required for a selected function. The specific permission depends on the operating system and function and is displayed by the relevant system before access. CSV, diagnostic or dyno exports may be stored locally on the device and shared by the user.
Data required to provide the service
Account, licence, vehicle and control-unit data must be provided where required for registration, conclusion of a contract, licence or compatibility checks, or the requested function. Without this information, the service may not be offered, activated or performed safely. Voluntary information is identified as such.
Automated decisions
We do not use solely automated decision-making, including profiling within the meaning of Art. 22 GDPR, that produces legal effects or similarly significantly affects you. Automated technical plausibility, licence and compatibility checks support safe operation; safety-related rejections can be referred to support for human review.
Account deletion
Applications that allow account creation provide an easily accessible option to request deletion of the account and associated data. Deletion can also be requested via info(at)qntum21.com. Data subject to statutory retention obligations or required to defend legal claims is restricted until the applicable period expires and is then deleted.
Apple App Store, Google Play and Microsoft Store
Apple App Store
When an application is downloaded, purchased, updated or a subscription is managed through the Apple App Store, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland independently processes Apple account, device, purchase, payment, download and store-usage data. Depending on the distribution model, QNTUM21 does not receive complete payment data, but may receive product or subscription status, transaction or receipt references, country or region, and technical data needed to validate the purchase.
Apple's processing is governed by its App Store & Privacy information and Privacy Policy.
Google Play
When an application is downloaded, purchased, updated or a subscription is managed through Google Play, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland independently processes Google account, device, purchase, payment, download and Play-usage data. Depending on the distribution model, QNTUM21 does not receive complete payment data, but may receive product or subscription status, transaction or order references, country or region, and technical data needed to validate the purchase.
Google's processing is governed by the Google Privacy Policy.
Microsoft Store
When an application is downloaded, purchased, updated or a subscription is managed through the Microsoft Store, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland independently processes Microsoft account, device, purchase, payment, download and store-usage data. Depending on the distribution model, QNTUM21 does not receive complete payment data, but may receive product or subscription status, transaction or order references, country or region, and technical data needed to validate the purchase.
Microsoft's processing is governed by the Microsoft Privacy Statement. This QNTUM21 Privacy Policy remains applicable to processing within the QNTUM21 Windows application.
Important: The privacy disclosures in the Apple App Store, the Data safety section in Google Play, and the disclosures in Microsoft Partner Center must match the actual application code and every third-party SDK used. Store disclosures do not replace this Privacy Policy.
Recipients and international transfers
Within QNTUM21, access is limited to persons who need the data to perform their duties. External recipients may include hosting, cloud, form, distribution, payment, support and IT-security providers, and public authorities where required by law.
Processors are contractually bound under Art. 28 GDPR where required. Where QNTUM21 initiates a transfer outside the European Economic Area, an adequate level of protection is ensured in particular by an adequacy decision, EU Standard Contractual Clauses and, where necessary, supplementary safeguards. Transfers independently made by Apple, Google or Microsoft as part of their store services are governed by their respective privacy notices and transfer mechanisms.
We do not intend to disclose personal data for third-party advertising or to sell personal data.
Retention and security
We retain personal data only for as long as necessary for the relevant purpose. It is then deleted or anonymised unless statutory retention obligations, evidence-preservation interests or unresolved claims require otherwise. Commercial and tax records may be retained for the statutory periods.
Account, vehicle, diagnostic and telemetry data is generally retained until deletion by the user, deletion of the account, or the end of the relevant contract, licence or support purpose. It is then deleted or restricted where still needed to comply with retention obligations or establish, exercise or defend legal claims.
We use technical and organisational measures appropriate to the risk, including access restrictions, role and permission models, transport encryption, security-event logging, backups and regular updates. Absolute security of electronic communications cannot be guaranteed.
Your data-protection rights
Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent may be withdrawn at any time with future effect.
Right to object: Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without stating specific grounds.
To exercise your rights, contact info(at)qntum21.com. You also have the right to lodge a complaint with a data-protection supervisory authority. The authority particularly responsible for QNTUM21 is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
Minors and changes
Vehicle-related QNTUM21 services are generally not directed at children. Where a contract or consent requires a particular minimum age, that requirement is stated in the relevant offer.
We update this Privacy Policy when functions, service providers or the law change. The version published on the website and in the application is authoritative.