Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

For questions about data protection and to exercise your rights, a message to this address is sufficient.

Where this Privacy Policy says "we", "us" or "our", it means q-b Mediatektur Holding GmbH.

2. Provision of the website and technical access data

We use Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA, as our hosting provider to host and deliver the website. In doing so, Webflow processes technical access data on our behalf.

These data include the information your browser transmits when it requests a page:

• IP address;

• date and time of the request;

• the page or file requested;

• the referrer URL and other HTTP headers, in particular browser type and version, operating system (user agent), browser language and the file formats your browser accepts.

The website does not run scripts that read further characteristics of your device, such as screen resolution, installed fonts or plug-ins.

The processing serves to deliver the website, to keep it stable and secure, to analyse errors and prevent abuse, and for the hosting provider to measure the visitor volume that determines our hosting plan.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests lie in providing the website securely, stably and at a controllable cost. You are neither legally nor contractually required to provide the technical access data; your browser sends them automatically when you visit, and without them the website cannot be delivered.

The hosting provider stores the access data in log files to which we have no direct access. Webflow does not publish a separate retention period for the access logs of hosted websites. According to its security documentation, log data are held in Webflow's logging system for 15 days and archived for up to 12 months; under the data processing agreement, data processed on our behalf are stored for the term of the agreement and then deleted or returned. We therefore expect the access data of this website to be deleted no later than 12 months after the request. We keep data we receive to investigate a security incident or to pursue legal claims only until the investigation and any proceedings have concluded.

Where Webflow processes access data for its own purposes — measuring visitor volume to bill our hosting plan, and its own security and analytics purposes — Webflow is itself the controller for that processing. Information is available in Webflow's privacy policy at webflow.com/legal/privacy.

3. Cookies and access to your device

When you visit the website, the content delivery network of our hosting provider sets the session cookie _cfuvid. It comes from Cloudflare, Inc., which operates the content delivery network for Webflow, and according to Cloudflare's documentation it is set only where a rule limiting abusive request volumes (rate limiting) is active. Its sole purpose is to distinguish individual users behind the same IP address, so that legitimate visits are not blocked because of other users of that address. The rule is part of Webflow's hosting platform; we have no access to that setting and cannot switch the cookie off. The cookie applies only to our domain and is HttpOnly and Secure. It contains an identifier without any information about you and is deleted when your browser session ends.

Storing this cookie is strictly necessary for the secure delivery of the website you requested and rests on § 25(2) no. 2 TDDDG: the cookie is set only when you visit, applies only to the current session, contains only an identifier and can be read only when content is delivered for our domain. The subsequent processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in defending against abusive requests and in keeping the website available. Cloudflare may process the data associated with the cookie in the United States; for the basis of that transfer, see section 6.

No other information is stored on your device: the website writes nothing to localStorage, sessionStorage, IndexedDB or service workers. When the page loads, the hosting provider's runtime script merely checks whether an editing mode is active; to do so it reads a single localStorage entry that does not exist for visitors. Nothing is stored and nothing is transmitted to a server; this is not access to stored information within the meaning of § 25(1) TDDDG. Even if one assumed such access, it would be strictly necessary under § 25(2) no. 2 TDDDG, because the check is part of the runtime script without which the website would not be displayed.

We use no analytics or tracking services, marketing pixels, targeted advertising or social media plug-ins. The website offers no contact forms, newsletter sign-ups, user accounts, comment or community features. Consent under § 25 TDDDG is therefore not required, and no consent banner is shown.

4. Contact by email

If you contact us by email, we process your email address, your name if you give it, the content of your message and the technical metadata needed to transmit and handle your message.

We process these data to answer your enquiry and to document the correspondence. If your message concerns a contract or pre-contractual steps taken at your request, the legal basis is Art. 6(1)(b) GDPR. For other substantive enquiries, the processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in handling the communication addressed to us. Where we must keep correspondence under commercial or tax law, the legal basis is Art. 6(1)(c) GDPR in conjunction with the respective provision.

You are neither legally nor contractually required to provide these data. Without a working sender address, however, we cannot answer your enquiry.

Once a year we review general enquiries that neither concern a contract nor fall under a statutory retention duty, and delete correspondence whose final handling was more than a year ago. Data needed to establish, exercise or defend legal claims are kept until the end of the relevant limitation period; the standard period is three years and begins at the end of the year in which the claim arose. Where emails are commercial or business letters, the statutory retention period is six years; for accounting records eight years and for books and financial statements ten years. We store data for longer only where a specific statutory or procedural reason exists.

For email communication we use mailbox.org, operated by Heinlein Hosting GmbH, Berlin, Germany. Heinlein Hosting processes the email data on our behalf; according to the provider, its servers are located in Berlin. The provider states that it deletes access and connection logs after four to seven days; backups of mailboxes, where the tariff includes them, are kept for at most seven days.

5. Recipients

We do not sell personal data, do not trade in addresses and do not pass personal data to third parties for advertising purposes.

Personal data are received only by parties that need them for the purposes described:

• Webflow, Inc. as processor for hosting and delivering the website;

• sub-processors engaged by Webflow, in particular Amazon Web Services, Inc. (cloud infrastructure) and Cloudflare, Inc. (delivery via the content delivery network, including the cookie described in section 3);

• Fastly, Inc. (USA) as operator of a further content delivery network, through which the website's font files are delivered: when the page loads, Fastly receives your IP address and the request data for the font files. The company is not listed in Webflow's published list of sub-processors (as of 9 July 2026). It is, however, certified under the EU-US Data Privacy Framework (section 6);

• Heinlein Hosting GmbH as processor for email communication;

• public authorities, courts or legal advisers where a legal obligation exists or where this is necessary to establish, exercise or defend legal claims.

Data processing agreements under Art. 28 GDPR are in place with the processors. Webflow's current list of sub-processors is available at webflow.com/legal/subprocessors.

6. Transfer to the United States

Webflow, Inc. is based in the United States and processes the data described in sections 2 and 3 there. Providing the website therefore involves a transfer of personal data to a third country; the same applies to the services of Amazon Web Services, Inc., Cloudflare, Inc. and Fastly, Inc. described in sections 3 and 5. The data processing agreement with Webflow obliges Webflow to impose the same data protection obligations on its sub-processors.

The transfer is based on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (Art. 45(1) GDPR). Webflow, Inc. is certified under that framework for non-HR data; the current status can be checked in the register of the US Department of Commerce. Cloudflare, Inc. and Fastly, Inc. are likewise listed there as certified (as of 16 September 2026: active, re-certification under review). The adequacy decision was upheld by the General Court of the European Union on 3 September 2025 (T-553/23); an appeal against that judgment is pending before the Court of Justice (C-703/25 P). We follow the proceedings and will amend this policy if the basis changes.

Should the adequacy decision cease to apply, the data processing agreement with Webflow, Inc. provides for the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Module 2) as the transfer instrument. We will provide a copy on request via the address given in section 1.

7. No automated decision-making

We make no decisions based solely on automated processing that produce legal effects or similarly significant effects, and we do not carry out profiling.

8. Your rights

Subject to the statutory conditions, you have the right to

• access (Art. 15 GDPR),

• rectification (Art. 16 GDPR),

• erasure (Art. 17 GDPR),

• restriction of processing (Art. 18 GDPR), and

• data portability (Art. 20 GDPR).

Your right to object under Art. 21 GDPR is set out separately in section 9.

To exercise your rights, a message to the address given in section 1 is sufficient.

Independently of this, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority responsible for q-b Mediatektur Holding GmbH is:

You may also contact the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

9. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR.

If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

No particular form is required. A message to the address given in section 1 is sufficient.

10. Changes to this Privacy Policy

We update this Privacy Policy when the website, the service providers we use or the legal requirements change. The version published on this page is the one that applies; the date is given at the top.