Privacy
Privacy Policy
Information on the processing of personal data pursuant to Art. 13 GDPR when using this website and the contact form.
1. Controller
Controller within the meaning of the GDPR: Marcus Lindner, Illoherweg 3, 84036 Landshut, Germany.
Contact for privacy matters: info@global-qhse.com. No data protection officer has been appointed; direct enquiries to info@global-qhse.com.
2. Hosting and access data
When this website is accessed, the hosting provider processes technically necessary data (server logs) to ensure delivery and security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable operation).
- Hosting and server logs: Hostinger International Ltd. – hosting of this website including technically required server logs (IP address, date and time, requested page, status message); retention of at most 14 days.
- Legal basis and safeguards: Processing under a data-processing agreement pursuant to Art. 28 GDPR; server location within the European Union; no third-country transfer via Hostinger.
3. Contact inquiries
When you use the contact form, we process name, email address, organisation and message solely to handle your inquiry.
Legal bases: Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR (legitimate interest in efficient handling). Retention: Deletion after completion of processing, at the latest six months after the last correspondence, unless statutory retention obligations apply. Submitting the form does not establish a contractual relationship.
Transmission is encrypted to the same origin as this website. No external CRM, no attachment processing and no automated confirmation emails are involved.
4. Abuse protection – Cloudflare Turnstile
To protect against automated abuse we use Cloudflare Turnstile. The service is loaded only after deliberate interaction with the contact form (focus, click, touch); without successful verification sending remains disabled.
For abuse prevention, a hash of the IP address (max. 10 minutes) and a replay-token hash (max. 5 minutes) are kept in memory only and are not stored as a contact inquiry.
- Provider, role and logs: Cloudflare, Inc. – operator of Turnstile, used to protect the contact form against automated abuse; no profiling.
- International transfers and safeguards: Processing under a data-processing agreement pursuant to Art. 28 GDPR, the adequacy decision of the European Commission (EU-US Data Privacy Framework, DPF), and supplementary EU standard contractual clauses for third-country transfers.
- Legal assessment under TDDDG: Storage on the terminal device is strictly necessary under §25(2) no. 2 TDDDG to prevent abuse of the contact form; consent is therefore not required.
5. Email delivery
Contact inquiries are delivered by email via a processor.
- Provider and role: Resend – delivery of the contact inquiry by email to the internal receiving address; storage of message content and delivery logs in the United States for up to 30 days.
- Safeguards for transfers: Processing under a data-processing agreement pursuant to Art. 28 GDPR, the adequacy decision of the European Commission (EU-US Data Privacy Framework), and supplementary EU standard contractual clauses for third-country transfers.
6. Cookies, local storage and settings
This website does not use analytics, marketing or profiling technologies. A cookie banner and consent management are therefore not required.
A language or appearance preference is stored in local storage only after your explicit choice and can be deleted at any time via “Privacy settings”. Technically necessary delivery and form protection are explained there transparently.
7. Your rights and right to lodge a complaint
Under the GDPR you have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). Please contact us at the address above.
Right to Object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on our legitimate interests (Art. 6(1)(f) GDPR). We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
Competent supervisory authority: Bavarian State Office for the Supervision of Data Protection (BayLDA), Promenade 18, 91522 Ansbach, Germany.
8. Language version and effective date
The German version of this privacy policy is the sole legally binding version; this English version is provided for convenience only.
Effective from: 2026-08-14. Last reviewed: 2026-10-05.