Privacy notice

1. Controller

The controller for the processing of personal data on this website and in QCRM is Medcycle UG (haftungsbeschränkt), Kolonnenstraße 8, 10827 Berlin, Germany, represented by its managing director Eik-Robert Burggraf, e-mail: info@medcycle.eu (“we”). We have not appointed a data protection officer, as there is no legal obligation to do so. Please send data protection requests to the address above.

2. Scope and roles

This notice covers the website q-crm.com and the data we process ourselves as the provider of QCRM, such as customer accounts, users and billing. Data that customers store in their QCRM workspace (e.g. contacts, leads, e-mails, documents) we process as a processor on the instructions of the respective customer (Art. 28 GDPR); for that data the customer is the controller. The data processing agreement governs the details. Please address requests about that data to the respective customer; we support them in answering.

3. Visiting the website

The website runs on servers of Hetzner Online GmbH in Germany. When it is accessed, the server processes technically necessary data: IP address, time, page requested, amount of data transferred, referring page and browser and operating system details. This serves the delivery, stability and security of the website (Art. 6(1)(f) GDPR; our legitimate interest is secure and functioning operation). Server logs are deleted after 30 days at the latest.

The website sets no cookies, uses no analytics or marketing services and loads no third-party content such as fonts, maps or videos.

4. Contacting us

If you write to us by e-mail, we process your details to handle your request (Art. 6(1)(b) GDPR where it concerns a contract, otherwise point (f)). We delete the correspondence once it has been dealt with and no retention obligation applies.

5. Registration and use of QCRM

For the account and the contract we process name, e-mail address, company name and company details, the password (only as a cryptographic hash), role and organisation membership, language setting, chosen plan and the times of sign-in and of confirming legal texts (Art. 6(1)(b) GDPR). To protect accounts we log sign-ins and security-relevant events (Art. 6(1)(f) GDPR). Without these details we cannot provide an account.

If a customer's administrator invites a person, we receive that person's e-mail address, role and, where given, name from the customer; the person receives a one-time password by e-mail.

To keep you signed in, the application stores sign-in tokens and some settings in your browser's local storage. This is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG). We use no tracking or advertising cookies.

6. System e-mails

We send invitations, one-time passwords, password resets and notifications through a mail server of IONOS SE, Montabaur, Germany (Art. 6(1)(b) GDPR).

7. Subscription and payment

QCRM and the AI telephony service Omnesto are taken out under one shared subscription, managed in the customer account at Omnesto; we operate both services ourselves. Payments are handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Stripe receives name, e-mail address, billing address, payment details and amount; we do not receive full card details. Stripe also processes data in the USA (section 11). The legal basis is Art. 6(1)(b) and (c) GDPR. More information: stripe.com/privacy.

8. Omnesto AI telephony

If a customer uses Omnesto, which is integrated into QCRM, QCRM sends Omnesto the name, e-mail address, role and organisation of the authorised users, so that they can access it without a further password, as well as usage data for charging AI credits. Appointments booked by the phone assistant are entered in QCRM's calendar. Omnesto runs on servers of Hetzner Online GmbH in Helsinki, Finland. For telephony and voice AI, Omnesto uses further providers (Telnyx, ElevenLabs, OpenAI), listed in the data processing agreement. Details on call data are in the privacy notice at omnesto.pro. The legal basis is Art. 6(1)(b) GDPR.

9. AI features

QCRM offers AI features such as lead scoring, reply drafts, e-mail summaries and deal analyses. Only when a user starts such a feature is the content it needs sent to Google's paid Gemini API (Google Ireland Limited, Dublin, Ireland, involving Google LLC, USA). Google does not use inputs and outputs of this paid service to improve its products and stores them only for a limited time to detect abuse. AI results are suggestions; the user makes the decision. No automated decision-making within the meaning of Art. 22 GDPR takes place.

10. Mailboxes and outreach

Customers can connect their own mailboxes via IMAP/SMTP. The access data is stored encrypted; messages are fetched and sent through the provider chosen by the customer, whose privacy terms also apply.

If a customer sends e-mails to their contacts with the outreach feature, every e-mail contains an unsubscribe link. On the customer's behalf, QCRM records whether an e-mail was opened (through an invisible image) and which links were clicked, and shows this to the sending customer. If images are not loaded, no open is counted. An unsubscribe is stored and prevents further outreach e-mails from that customer. The sending customer is responsible for the lawfulness of these e-mails, in particular any consent required from the recipients.

11. Transfers to third countries

Our servers are in Germany (QCRM) and Finland (Omnesto). Stripe, Google, Telnyx, ElevenLabs and OpenAI also process data in the USA. Transfers take place only under Art. 44 et seq. GDPR: on the basis of the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of the European Commission's standard contractual clauses.

12. Retention

We keep account data for the term of the contract. If a subscription ends without renewal, the CRM features are locked; the data remains stored, is reviewed after 30 days and is deleted only after prior notice to the customer. At the customer's request we delete it earlier. We keep invoices and accounting records for the statutory periods (Section 147 AO, Section 257 HGB; up to ten years). Database backups are made daily and deleted or overwritten no later than 30 days after they were made; deleted data may therefore remain in backups for up to 30 days. We delete server logs after 30 days at the latest.

13. Security

We protect data with technical and organisational measures under Art. 32 GDPR, including encrypted transmission (TLS), hashed passwords, encrypted storage of access data to third-party systems, separate workspaces with roles and permissions, restricted administrative access and daily backups. The annex to the data processing agreement gives the details.

14. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

15. Persons and customers in Switzerland

For persons in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. Germany and Finland provide adequate protection under Annex 1 of the Data Protection Ordinance; disclosure to them is permitted under Art. 16(1) FADP. For recipients in the USA, the Swiss-U.S. Data Privacy Framework applies where the recipient is certified, otherwise standard contractual clauses recognised by the FDPIC. Complaints can be lodged with the Federal Data Protection and Information Commissioner (FDPIC).

16. Changes

We update this notice when our processing or the law changes. The version published here applies.