Privacy Policy

The controller responsible for processing personal data on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:

Qcentic GmbH
Grüner Weg 28
50825 Köln, Germany
Represented by: Siamak Mehraghdam
Phone: +49 (0)221-63061911-0
Email: contact@colleo.team

Colleo is a brand of Qcentic GmbH. This privacy policy applies to all websites operated by Qcentic GmbH, including those for Colleo, and to all communication with us.

We are not legally required to appoint a data protection officer. For all questions about data protection, please contact us at contact@colleo.team.

This privacy policy explains which personal data we process when you visit our website, submit a form or communicate with us, for what purposes, on which legal basis, and which rights you have. "Personal data" means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

We process personal data on the following legal bases:

• Art. 6(1)(a) GDPR – your consent
• Art. 6(1)(b) GDPR – performance of a contract or steps taken at your request before entering into a contract
• Art. 6(1)(c) GDPR – compliance with a legal obligation, e.g. statutory retention duties
• Art. 6(1)(f) GDPR – our legitimate interests, provided your interests or fundamental rights do not override them
• § 25(1) TDDDG – your consent to storing or accessing information on your device (e.g. cookies); § 25(2) TDDDG where this is strictly necessary to provide the service you requested

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Our website is hosted by an external hosting provider that processes data on our behalf. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.

When you visit our website, the hosting provider automatically collects the following data in server log files:

• IP address of the requesting device
• Date and time of access
• Page or file requested
• Referrer URL (the page from which you came)
• Browser type and version, operating system

We process this data to deliver the website, ensure its stability and security, and detect misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of our website. Log files are deleted after 7 days, unless longer storage is required to investigate a specific security incident.

Our website uses SSL/TLS encryption to protect the data you transmit. You can recognise an encrypted connection by "https://" in your browser's address bar.

Cookies are small text files stored on your device by your browser. Similar technologies, such as tracking scripts, read or store information on your device in the same way. We use them in two categories:

• Strictly necessary: cookies needed for the technical operation of our website, and the cookie “colleo_consent”, which stores your cookie choice for 12 months. The legal basis is § 25(2) TDDDG and Art. 6(1)(f) GDPR; our legitimate interest is a working website that remembers your choice.
• Analytics (only with your consent): the HubSpot tracking code of HubSpot Ireland Limited (see section 5). It is loaded only after you click “Accept analytics” in our cookie banner. HubSpot then sets the cookies __hstc and hubspotutk (to recognise your browser, 6 months), __hssc (current visit, 30 minutes) and __hssrc (to detect a new visit, deleted when you close the browser), and records the pages of our website you visit, the referring page, the time of your visits and your IP address. If you also submit our contact form, the submission is linked to these visits in our HubSpot CRM. We use this to understand how visitors find and use our website and to see which pages led to an enquiry. The data is stored in HubSpot’s data centre in the European Union; see section 8 for access from outside the EU. The legal basis is § 25(1) TDDDG and Art. 6(1)(a) GDPR. We keep this data for as long as we keep the related contact (section 5), otherwise for no longer than 24 months.

When you first visit our website, a cookie banner asks for your choice. Until you click “Accept analytics”, the HubSpot tracking code is not loaded and no analytics cookies are set; “Only necessary” keeps it that way. You can change or withdraw your consent at any time, with effect for the future, under “Cookie settings” at the bottom of every page; when you withdraw it, we stop loading the tracking code and delete the HubSpot cookies from your browser.

You can also delete or block cookies in your browser settings at any time. If you block all cookies, some functions of the website may not work.

When you submit our contact or demo request form, we process the following data:

• First name, last name and work email address
• Company website, industry and country
• Your main challenges, how you heard about us and your message (where provided)
• Your consent choices and the time of submission
• Technical data: IP address, the page on which you submitted the form, and date and time

Purpose: We use this data to respond to your enquiry, contact you, prepare and schedule a product demo, and assess whether our services fit your needs.

Legal basis: Art. 6(1)(b) GDPR, where your enquiry relates to concluding a contract with us; otherwise Art. 6(1)(a) GDPR, based on the consent you give by ticking the checkbox in the form. Storing and managing business contacts in our CRM is also based on Art. 6(1)(f) GDPR; our legitimate interest is organising our customer communication efficiently. You can withdraw your consent at any time with effect for the future.

Fields marked as required are needed to process your enquiry. Without them, we cannot respond to your request.

HubSpot: We store and manage form submissions and contact data in the HubSpot CRM, provided by HubSpot Ireland Limited, One Sir John Rogerson's Quay, Dublin 2, Ireland, a subsidiary of HubSpot, Inc., USA. Your data is stored in HubSpot's data centre in the European Union. We have concluded a data processing agreement with HubSpot in accordance with Art. 28 GDPR. HubSpot uses sub-processors, some of which may process data outside the EU (see section 8). More information: HubSpot Privacy Policy.

Internal notification: When you submit a form, our team receives an internal notification by email and in Microsoft Teams so that we can respond quickly (see section 7).

Storage period: We store your data for as long as needed to handle your enquiry. If no business relationship results, we delete your data no later than 24 months after our last contact, unless statutory retention obligations apply (e.g. under § 257 HGB and § 147 AO for business correspondence, for up to 6 or 10 years).

We only send you product updates and news by email if you have actively ticked the optional checkbox in our form. The legal basis is your consent under Art. 6(1)(a) GDPR.

We send these emails via HubSpot (see section 5). To improve our content, we may measure whether emails are opened and which links are clicked. This is covered by your consent.

You can unsubscribe at any time using the link at the end of every email or by writing to contact@colleo.team. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal. After you unsubscribe, we keep your email address on a suppression list so that we do not contact you again; the legal basis is Art. 6(1)(f) GDPR, our legitimate interest being to respect your objection.

If you contact us by email or phone, we process the data you provide (e.g. name, contact details, content of your request) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is responding to enquiries.

For email, internal communication, internal notifications about form submissions and online meetings, we use Microsoft 365 (including Outlook, Microsoft Teams and Power Automate), provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We have concluded a data processing agreement with Microsoft in accordance with Art. 28 GDPR.

If you take part in an online demo via Microsoft Teams, we process your name, email address, meeting metadata (e.g. time and duration) and, if you enable them, audio, video and screen-sharing content. We do not record meetings unless we inform you in advance and you agree. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR where no contract is involved; our legitimate interest is presenting our services efficiently.

Some of our service providers, namely HubSpot and Microsoft, belong to groups based in the United States. Personal data may therefore be accessed from or transferred to the USA. Such transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR), where the recipient is certified under it, and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Unless a more specific storage period is stated in this policy, we delete your personal data as soon as it is no longer needed for the purpose for which it was collected, you withdraw your consent, or you object to the processing, unless statutory retention obligations require us to keep it. In that case, we restrict processing until the retention period ends.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data based on Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to the use of your data for direct marketing at any time; we will then no longer use your data for this purpose.

To exercise your rights, contact us at contact@colleo.team.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

We may update this privacy policy when our services or legal requirements change. The current version is always available on this page.