{"id":2735,"date":"2024-01-23T14:09:03","date_gmt":"2024-01-23T13:09:03","guid":{"rendered":"https:\/\/www.acqa.eu\/data-protection\/"},"modified":"2026-07-03T14:56:42","modified_gmt":"2026-07-03T13:56:42","slug":"data-protection","status":"publish","type":"page","link":"https:\/\/www.acqa.eu\/en\/data-protection\/","title":{"rendered":"Data Protection"},"content":{"rendered":"

Privacy Policy<\/h1>\n

<\/strong><\/p>\n

Thank you for your interest in our association. Protecting your personal data is of paramount importance to ACQA e.V.
As a general rule, you may use our website without providing any personal data. However, if you wish to make use of specific services offered through our website, the processing of personal data may become necessary. Where there is no legal basis for such processing, we will always obtain your explicit consent.
This Privacy Policy informs you about the nature, scope, and purpose of the collection and use of personal data on our website. We process personal data solely in accordance with applicable data protection laws, in particular the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). <\/p>\n

\u00a7 1 Data Controller within the Meaning of the GDPR<\/h2>\n

Agency for Accreditation and Quality Assurance (ACQA) e.V.<\/p>\n

Steinheilstra\u00dfe 4<\/p>\n

85737 Ismaning<\/p>\n

Telefon: +49 89 999796769<\/p>\n

E-Mail: info@acqa.eu<\/p>\n

\u00a7 2 Definitions<\/h2>\n

This Privacy Policy is based on the terminology used by the European legislator in adopting the EU General Data Protection Regulation (GDPR). To ensure that this Privacy Policy is easy to read and understand, the key terms used are explained below: <\/p>\n

    \n
  1. a) Personal Data means any information relating to an identified or identifiable natural person (hereinafter referred to as the \u201cdata subject\u201d). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. <\/li>\n
  2. b) Data Subject means any identified or identifiable natural person whose personal data are processed by the controller responsible for the processing.<\/li>\n
  3. c) Processing means any operation or set of operations performed on personal data, whether or not by automated means. This includes, but is not limited to, the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.<\/li>\n
  4. d) Profiling means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that person’s job performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.<\/li>\n
  5. e) Pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures designed to ensure that the personal data cannot be attributed to an identified or identifiable natural person.<\/li>\n
  6. f) Controller or Data Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States. <\/li>\n
  7. g) Processor means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.<\/li>\n
  8. h) Recipient means a natural or legal person, public authority, agency, or other body to which personal data are disclosed, regardless of whether it is a third party or not. However, public authorities that may receive personal data in the context of a particular inquiry in accordance with Union law or the law of the Member States shall not be regarded as recipients. <\/li>\n
  9. i) Third Party means a natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.<\/li>\n
  10. j) Consent means any freely given, specific, informed, and unambiguous indication of the data subject\u2019s wishes by which the data subject, through a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.<\/li>\n<\/ol>\n

    \u00a7 3 Provision of the Website and Creation of Log Files<\/h2>\n

    (1) When using the website for informational purposes only\u2014that is, if you do not register or otherwise transmit information to us\u2014we automatically collect the following data and information from the computer system of the accessing device each time the website is accessed:<\/p>\n

      \n
    • The IP address of the user<\/li>\n
    • Information about the browser type and version used.<\/li>\n
    • The operating system of the user<\/li>\n
    • The user\u2019s Internet service provider<\/li>\n
    • Date and time of access<\/li>\n
    • Websites from which the user\u2019s system accesses our website.<\/li>\n
    • Websites that are accessed by the user\u2019s system via our website.<\/li>\n
    • Content of the requests (specific pages accessed)<\/li>\n
    • The volume of data transmitted in each case<\/li>\n
    • Language and version of the browser software<\/li>\n<\/ul>\n

      The data are also stored in our system\u2019s log files. These data are not stored together with any other personal data of the user. <\/p>\n

      (2) The legal basis for the temporary storage of log files is Article 6(1)(f) GDPR, which permits processing that is necessary for the purposes of the legitimate interests pursued by the controller. <\/p>\n

      (3) The temporary storage of the IP address by the system is necessary in order<\/p>\n

        \n
      • to enable the delivery of the website to the user\u2019s device. For this purpose, the user\u2019s IP address must remain stored for the duration of the session. <\/li>\n
      • to optimize the content of our website and the advertising for it.<\/li>\n
      • to ensure the functionality of our information technology systems and the technical operation of our website<\/li>\n
      • to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack<\/li>\n<\/ul>\n

        The storage of data in log files is carried out to ensure the functionality of the website. In addition, the data help us optimize the website and maintain the security of our information technology systems. In this context, the data are not analyzed for marketing purposes <\/p>\n

        These purposes also constitute our legitimate interest in processing the data pursuant to Article 6(1)(f) of the GDPR <\/p>\n

        (4) The data are deleted as soon as they are no longer required for the purpose for which they were collected\u2014in this case, at the end of the respective usage session. Where the data are stored in log files, they are deleted no later than seven days after collection.
        Storage beyond this period is possible. In such cases, the IP addresses are deleted or anonymized so that the accessing client can no longer be identified. <\/p>\n

        (5) The collection of data for the provision of the website and the storage of data in log files are strictly necessary for the operation of the website. Therefore, users have no right to object to such processing.<\/p>\n

        \u00a7 4 Use of Cookies<\/h2>\n

        (1) This website uses cookies. Cookies are small text files that are sent by a web server to your browser when you visit a website and are stored locally on your device (e.g., PC, laptop, tablet, smartphone). They are placed on your device and enable the website operator (i.e., us) to obtain certain information.
        Cookies are used to make the website more user-friendly and secure, particularly by collecting usage-related information such as the frequency of use, the number of users visiting the pages, and patterns of website usage. Cookies do not cause any damage to your device and do not contain viruses.
        Each cookie contains a unique character string (known as a cookie ID) that allows the browser to be uniquely identified when the website is visited again. <\/p>\n

        (2) Cookies remain stored even after the browser session has ended and can be retrieved when you revisit the website. However, cookies are stored on your device and transmitted from it to our website. Therefore, you have full control over the use of cookies.
        If you do not wish data to be collected through cookies, you can configure your browser settings to notify you whenever cookies are set, to block cookies altogether, or to delete individual cookies. Please note, however, that disabling cookies may limit the functionality of this website.
        Session cookies, insofar as they are used, are automatically deleted when you leave the website. <\/p>\n

        \u00a7 5 Weitergabe personenbezogener Daten an Dritte<\/h2>\n

        Links to External Websites<\/p>\n

        This website contains links to external websites. We are responsible for our own content; however, we have no control over the content of external websites and therefore assume no responsibility or liability for them. In particular, we do not adopt the content of external websites as our own.
        If you are redirected to an external website, the privacy policy provided on that website will apply. Should you become aware of any unlawful activities or content on a linked website, we would appreciate your informing us. We will then review the matter and take appropriate action, including the removal of the relevant content or link where necessary (notice-and-takedown procedure). <\/p>\n

        \u00a7 6 Contacting Us in Specific Cases<\/h2>\n

        (1) If you contact us by email, the personal data transmitted with your email will be stored.<\/p>\n

        (2) If you contact us using the contact form provided on our website and provide your contact details (such as your email address or telephone number), you consent to our contacting you through these communication channels for the purpose of responding to your inquiry.
        In this context, your data will not be disclosed to any third parties. The data will be used exclusively for processing and responding to your request and for the related communication. <\/p>\n

        (3) Where the user has given consent, the legal basis for the processing of personal data is Article 6(1)(a) GDPR.
        The legal basis for the processing of data transmitted in the course of sending an email or completing the contact form is Article 6(1)(f) GDPR, which permits processing based on the controller\u2019s legitimate interests.
        Where the purpose of the contact is the initiation or conclusion of a contract, the additional legal basis for processing is Article 6(1)(b) GDPR, which permits processing necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract. <\/p>\n

        (4) We will, of course, use the data provided in your inquiries exclusively for the purpose for which you supplied them when contacting us. In the case of communication by email, our legitimate interest in processing the data also lies in responding to your inquiry. <\/p>\n

        (5) The data will be deleted as soon as they are no longer required for the purpose for which they were collected. For personal data transmitted by email, this is the case when the respective conversation with the user has been concluded. A conversation is considered concluded when the circumstances indicate that the matter in question has been fully resolved.
        Any additional personal data collected during the process of submitting the inquiry will be deleted no later than seven days thereafter. <\/p>\n

        (6) You have the right to withdraw your consent to the processing of your personal data at any time. In such a case, the communication cannot be continued.
        To withdraw your consent or object to the storage of your data, please contact the Controller as specified in \u00a7 1. In this event, all personal data stored in the course of your communication with us will be deleted. <\/p>\n

        \u00a7 7 Rights of the Data Subject<\/h2>\n

        If your personal data are processed, you are considered a data subject within the meaning of the GDPR and are entitled to the following rights vis-\u00e0-vis the Controller:<\/p>\n

          \n
        1. Right of Access.<\/li>\n
        2. Right to Rectification.<\/li>\n
        3. Right to Restriction of Processing.<\/li>\n
        4. Right to Erasure<\/li>\n
        5. Right to Notification<\/li>\n
        6. Right to Data Portability<\/li>\n
        7. Right to Object to Processing<\/li>\n
        8. Right to Withdraw Consent Under Data Protection Law<\/li>\n
        9. Right Not to Be Subject to Automated Decision-Making<\/li>\n
        10. Right to Lodge a Complaint with a Supervisory Authority<\/li>\n<\/ol>\n
            \n
          1. Right of Access to Personal Data<\/strong><\/li>\n<\/ol>\n

            You may request confirmation from the Controller as to whether personal data concerning you are being processed by us. Where such processing takes place, you may, at any time and free of charge, obtain from the Controller access to the personal data stored about you, as well as the following information: <\/p>\n

              \n
            • the purposes of the processing<\/li>\n
            • the categories of personal data concerned;<\/li>\n
            • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;<\/li>\n
            • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;<\/li>\n
            • the existence of the right to request rectification or erasure of personal data, restriction of processing by the Controller, or to object to such processing;<\/li>\n
            • the existence of the right to lodge a complaint with a supervisory authority;<\/li>\n
            • where the personal data are not collected from you, any available information as to their source;<\/li>\n
            • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you. <\/li>\n<\/ul>\n

              You also have the right to obtain information as to whether personal data concerning you are transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to such transfer. <\/p>\n

                \n
              1. Right to Rectification<\/strong><\/li>\n<\/ol>\n

                You have the right to obtain from the Controller the prompt rectification and\/or completion of personal data concerning you if the personal data being processed are inaccurate or incomplete. The Controller shall make such correction without undue delay.<\/p>\n

                  \n
                1. Recht auf Einschr\u00e4nkung der Verarbeitung<\/strong><\/li>\n<\/ol>\n

                  You have the right to obtain from the Controller the restriction of processing of your personal data where one of the following conditions applies:<\/p>\n

                    \n
                  • you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;<\/li>\n
                  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;<\/li>\n
                  • the Controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims; or<\/li>\n
                  • you have objected to processing pursuant to Article 21(1) GDPR and verification is pending as to whether the legitimate grounds of the Controller override your interests. <\/li>\n<\/ul>\n

                    Where the processing of personal data concerning you has been restricted, such data may\u2014apart from being stored\u2014only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.
                    If the restriction of processing has been imposed under the above conditions, you will be informed by the Controller before the restriction is lifted. <\/p>\n

                      \n
                    1. Right to Erasure<\/strong><\/li>\n<\/ol>\n

                      You have the right to obtain from the Controller the erasure of personal data concerning you without undue delay where one of the grounds provided for under applicable data protection law applies. In particular, you may request the deletion of your personal data where:<\/p>\n

                        \n
                      • the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;<\/li>\n
                      • You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for the processing. <\/li>\n
                      • You object to the processing pursuant to Article 21(1) GDPR, and there are no overriding legitimate grounds for the processing; or you object to the processing pursuant to Article 21(2) GDPR. <\/li>\n
                      • the personal data have been processed unlawfully;<\/li>\n
                      • The erasure of personal data concerning you is required for compliance with a legal obligation under Union law or the law of a Member State to which the Controller is subject.<\/li>\n
                      • The personal data concerning you were collected in relation to the offer of information society services pursuant to Article 8(1) GDPR. <\/li>\n<\/ul>\n

                        Where the Controller has made the personal data concerning you public and is obliged pursuant to Article 17(1) GDPR to erase such data, the Controller shall, taking account of available technology and the cost of implementation, take reasonable measures, including technical measures, to inform other controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, copies of, or replications of those personal data. <\/p>\n

                        The right to erasure does not apply where processing is necessary:<\/p>\n

                          \n
                        • for exercising the right to freedom of expression and information;<\/li>\n
                        • for compliance with a legal obligation that requires processing under Union law or the law of a Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;<\/li>\n
                        • for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i), and Article 9(3) GDPR; <\/li>\n
                        • for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or <\/li>\n
                        • for the establishment, exercise, or defense of legal claims.<\/li>\n<\/ul>\n
                            \n
                          1. Right to Notification<\/strong><\/li>\n<\/ol>\n

                            If you have exercised your right to rectification, erasure, or restriction of processing vis-\u00e0-vis the Controller, the Controller is required to communicate such rectification, erasure, or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves a disproportionate effort.
                            You have the right to be informed by the Controller about those recipients. <\/p>\n

                              \n
                            1. Right to Data Portability<\/strong><\/li>\n<\/ol>\n

                              You have the right to receive the personal data concerning you that you have provided to the Controller in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the Controller to whom the personal data were provided, where: <\/p>\n

                                \n
                              • the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR; and <\/li>\n
                              • the processing is carried out by automated means.<\/li>\n<\/ul>\n

                                In exercising your right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right must not adversely affect the rights and freedoms of others. <\/p>\n

                                The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.<\/p>\n

                                To exercise the right to data portability, the data subject may contact the Controller at any time.<\/p>\n

                                  \n
                                1. Right to Object<\/strong><\/li>\n<\/ol>\n

                                  You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you that is based on Article 6(1)(e) or Article 6(1)(f) GDPR, including profiling based on those provisions. <\/p>\n

                                  The Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims.<\/p>\n

                                  Where personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling to the extent that it is related to such direct marketing.
                                  If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for those purposes. <\/p>\n

                                  In connection with the use of information society services, you have the option to exercise your right to object by automated means, regardless of Directive 2002\/58\/EC, using technical specifications.<\/p>\n

                                  To exercise the right to object, the data subject may contact the Controller directly at any time.<\/p>\n

                                    \n
                                  1. Right to Withdraw Consent Under Data Protection Law<\/strong><\/li>\n<\/ol>\n

                                    You have the right to withdraw your consent to the processing of personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
                                    To exercise your right to withdraw consent, the data subject may contact the Controller at any time. <\/p>\n

                                      \n
                                    1. Automated Individual Decision-Making, Including Profiling<\/strong><\/li>\n<\/ol>\n

                                      You have the right not to be subject to a decision based solely on automated processing\u2014including profiling\u2014that produces legal effects concerning you or similarly significantly affects you.
                                      This right shall not apply where the decision: <\/p>\n

                                        \n
                                      • is necessary for entering into, or the performance of, a contract between you and the Controller;<\/li>\n
                                      • is authorized by Union law or the law of a Member State to which the Controller is subject and which also lays down suitable measures to safeguard your rights, freedoms, and legitimate interests; or<\/li>\n
                                      • is based on your explicit consent.<\/li>\n<\/ul>\n

                                        However, such decisions may not be based on special categories of personal data as defined in Article 9(1) GDPR, unless Article 9(2)(a) or Article 9(2)(g) GDPR applies and appropriate measures have been taken to safeguard your rights and freedoms as well as your legitimate interests. <\/p>\n

                                        With regard to the cases described above, the Controller shall implement appropriate measures to safeguard your rights and freedoms as well as your legitimate interests. Such measures shall include, at a minimum, the right to obtain human intervention on the part of the Controller, to express your own point of view, and to contest the decision.<\/p>\n

                                        If the data subject wishes to exercise rights relating to automated decision-making, he or she may contact the Controller at any time for this purpose.<\/p>\n

                                          \n
                                        1. Right to Lodge a Complaint with a Supervisory Authority<\/strong><\/li>\n<\/ol>\n

                                          Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of personal data concerning you infringes the GDPR.
                                          The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR. <\/p>\n

                                          \u00a7 8 SSL-Encryption<\/h2>\n

                                          For security reasons and to protect the transmission of confidential content, such as inquiries that you send to us as the website operator, this website uses SSL encryption. An encrypted connection can be recognized by the change in the browser\u2019s address bar from \u201chttp:\/\/\u201d to \u201chttps:\/\/\u201d and by the padlock icon displayed in your browser\u2019s address bar. <\/p>\n

                                          If SSL encryption is activated, the data you transmit to us cannot be read by third parties.<\/p>\n

                                          \u00a7 9 Changes to the Privacy Policy<\/h2>\n

                                          We reserve the right to modify our data protection practices and this Privacy Policy from time to time in order to comply with changes in applicable laws and regulations or to better meet your needs. Any changes to our data protection practices will be announced on this page accordingly. Please refer to the current version date of this Privacy Policy to determine whether any updates have been made. <\/p>\n<\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-2735","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.acqa.eu\/en\/wp-json\/wp\/v2\/pages\/2735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.acqa.eu\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.acqa.eu\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.acqa.eu\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.acqa.eu\/en\/wp-json\/wp\/v2\/comments?post=2735"}],"version-history":[{"count":2,"href":"https:\/\/www.acqa.eu\/en\/wp-json\/wp\/v2\/pages\/2735\/revisions"}],"predecessor-version":[{"id":2737,"href":"https:\/\/www.acqa.eu\/en\/wp-json\/wp\/v2\/pages\/2735\/revisions\/2737"}],"wp:attachment":[{"href":"https:\/\/www.acqa.eu\/en\/wp-json\/wp\/v2\/media?parent=2735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}