Privacy policy
This policy applies to the websites sorqa.de, the sign-in page sorqa.app and the knowledge portal sorqa.info. Use of the app itself is governed by the privacy notice of the respective installation (in the app under “Privacy”).
1. Controller
Patrick Himmelhaus
Marketing, vertrieb & Digitalisierung
Georg-Fendt-Straße 28
86316 Friedberg
Germany
Email: info@sorqa.de
No data protection officer has been appointed, as there is no legal obligation to do so. We answer questions about data protection at datenschutz@sorqa.de.
2. Visiting the website
When the website is accessed, the web server processes technically necessary data: IP address, time, requested address, amount of data transferred, browser identifier and the previously visited page. Purpose: delivering the website and detecting attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Storage period: for a short time according to the hosting provider's rules; we do not analyse the logs or combine them with other data.
Hosting: ALL-INKL.COM – Neue Medien Münnich, Inhaber René Münnich, Hauptstraße 68, 02742 Friedersdorf, data centres in Germany, as our processor (Art. 28 GDPR).
No cookies for analysis, no third-party content: These pages do not set any cookies for visitors on their own and do not load fonts, scripts, videos, maps or counters from third parties. There is no tracking of page visits and no audience measurement. The only exception is the read receipt for the white paper email, only with your consent (section 5). Only the sign-in to the administration, which is used solely by the provider, sets a technically necessary session cookie.
Language choice and company address: If you switch the language yourself at the top (DE/EN), your browser remembers this choice in the cookie “sorqa_sprache” (content only “de” or “en”, valid for one year). On sorqa.app your browser remembers the company address you entered in the browser's own storage (localStorage) so that you do not have to type it every time; “Other company” deletes it. Both stay on your device, are not analysed by us and are strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG). You can delete both in your browser at any time.
3. Contact form and email
What: If you write to us via the contact form (on the home page or in the legal notice) or by email, we process your name, your email address, optionally your company and your message. Purpose: answering your enquiry. Legal basis: Art. 6(1)(b) GDPR if your enquiry is aimed at a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
The data from the form is sent as an email to our mailbox; it is not stored in a database of the app. To protect against misuse, the server counts requests per sender; for this the IP address is only used as a check value that changes daily and cannot be traced back, in a short-lived file (at most two days).
Storage period: We keep your message for as long as necessary to answer it and for a possible cooperation; it is then deleted unless statutory retention obligations apply (e.g. 6 years for business letters under § 257 HGB, § 147 AO). Recipients: our hosting provider and email provider as processors.
4. Booking a video call
What: If you book an appointment on the home page, we store your name, your email address, optionally your company and your message, the date and time of the appointment and the language of the booking. Purpose: arranging the appointment, sending you and us the confirmation with a calendar invitation, and rescheduling or cancelling the appointment at your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request).
Storage period: The data is deleted automatically 90 days after the appointment. If you cancel the appointment, we delete your name, email address, company and message immediately. The emails with the invitation are also kept in our mailbox and calendar for as long as they are needed for our cooperation; they are then deleted unless statutory retention obligations apply. The data may remain in the daily backups for up to 14 days longer.
With the confirmation we send you our short information sheets as PDF (e.g. on data protection and IT security) and a reminder by email one day before the appointment. Both are part of arranging the appointment; no further data is stored for this.
Available times: To offer only free times, the app reads the busy times from our own calendar. No data of yours is transferred to the calendar provider in the process.
Video call: The appointment takes place via Microsoft Teams. The provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, acting as our processor. Microsoft processes the data necessary for participation (e.g. displayed name, IP address, device information, audio and video while you switch them on). A transfer to Microsoft Corporation in the USA cannot be ruled out; it is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Microsoft is certified, and additionally by the European Commission's standard contractual clauses. You can take part in the browser without an account and switch your camera and microphone on and off yourself. We do not record video calls. Legal basis: Art. 6(1)(b) GDPR.
Protection against misuse: As with the contact form, the app checks whether the form was filled in by a human. To limit booking attempts, the IP address is only stored as a check value that cannot be traced back, for at most one day.
5. White paper request
What: If you request a white paper, we store your name, your company, your email address, your phone number (optional), which white paper you would like and the language of your request. As evidence we also store the time of the request and of the confirmation as well as the wording of your consent. We do not store an IP address in this process.
Procedure (confirmation by email): After you submit the form, we send you an email with a confirmation link (valid for 48 hours). Only after you confirm do we send you the white paper with a personal link that is valid for 7 days. This ensures that nobody enters someone else's address.
White paper in return for contact: You receive the white paper free of charge. In return, you consent to SORQA contacting you about SORQA by email and, if you provide a phone number, by phone. The checkbox for this is never pre-ticked. If you do not wish to consent, we are happy to answer your questions via the contact form (section 3).
Legal basis: for contacting you, your consent (Art. 6(1)(a) GDPR, § 7(2) UWG); for the confirmation email and sending the white paper, Art. 6(1)(b) GDPR; for documenting the consent, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
Withdrawal: You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), via the unsubscribe link in the email with the white paper or by email to datenschutz@sorqa.de. The lawfulness of processing until the withdrawal remains unaffected.
Storage period: We delete unconfirmed requests after 7 days. We store confirmed requests until you withdraw your consent, at most 2 years after confirmation. After a withdrawal, we delete the phone number immediately and the rest of the request after 30 days (the time we need to remove you from our mailbox and address book as well). Emails exchanged with you are also kept in our mailbox for as long as they are needed for our cooperation. The data may remain in the daily backups for up to 14 days longer. Recipients: our hosting provider and email provider as processors.
Read receipt (condition for sending the white paper, since October 2026): With a separate, not pre-ticked checkbox in the form you consent that the email with the white paper contains an invisible image (1 × 1 pixel) loaded from our server. If your email program loads this image, we store with your request when you opened the email for the first and the last time and how often, and when you first downloaded the white paper. We do not store an IP address or details about your device or email program (for the server log see section 2). Purpose: We can see whether the white paper arrived and is being read, and can get in touch with you at a suitable time. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The white paper is a free offer that we only send together with this consent. Without the checkbox we do not send it; we are still happy to answer your questions via the contact form or by email. No other offer depends on it. Withdrawal: at any time via the unsubscribe link in the email (where you can also choose “Stop the read receipt only”) or by email to datenschutz@sorqa.de; we then delete the recorded times immediately. Storage period: as for the request. Many email programs load images only on request or as soon as the email is received; “opened” is therefore only an indication.
Protection against misuse: As with the contact form, the server checks whether the form was filled in by a human and limits requests per sender using a check value that changes daily and cannot be traced back.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21). An email to datenschutz@sorqa.de is sufficient.
Complaints: You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for the controller is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.
Obligation to provide data: You do not have to give us any data. Without a name and email address, however, we cannot answer an enquiry or confirm an appointment. There is no automated decision-making or profiling.