Privacy Policy
The protection of your data is important to us. As a result, and to comply with all legal information obligations, we will inform you below how we process your data and what rights you have with regard to data processing.
The TestTrainer was developed and operated by us, CYQUEST GmbH, Heußweg 25, D-20255 Hamburg. As a result, we will hereby inform you about which data we collect via the TestTrainer and how we process this data.
1. Subject of data protection
The subject of data protection is personal data. In accordance with Art. 4 GDPR personal data means all information relating to an identified or identifiable natural person. This includes e.g. information such as names, postal addresses, e-mail addresses or telephone numbers, but also usage data such as your IP address or content data such as the answers you provide within the online assessment and the resulting test results.
2. Scope and purposes of data processing
In the following, we will inform you about the scope of the data collection and storage as well as their use and the purpose of the respective data collection in the context of the online assessment. (Hereinafter referred to as "data processing", used within the meaning of Article 4 (2) GDPR).
When registering for the TestTrainer and when using the TestTrainer, we do not collect any personal data of the customer with the exception of the respective IP address of the customer using the TestTrainer; please read section 2.1.
As part of the transaction process, PayPal (see section 4.1.8 of our General Terms and Conditions) provides us with the transaction ID and your email address, which has already been verified by PayPal; please read section 2.2.
When you use the TestTrainer, we process data that enables you to complete the test or that is generated when you complete the test; please read section 2.3 for more information on this and the reference to individuals in this data.
Finally, we process personal data when we provide technical support to a user; please refer to section 2.3.7.
In addition, we use Google Analytics in order to be able to recognise which parts of the TestTrainer are of most interest to you as an entire user group and, if necessary, to align the TestTrainer with the interests of the entire user group and thus to be able to optimise it for them; please read section 2.5 for more information.
2.1 IP addresses
Without Internet protocol addresses, in short "IP addresses", the Internet simply would not work. An IP address represents an address in computer networks so that web servers and / or individual end devices can be addressed and accessed. Without an IP address, the web server and the end device cannot communicate - and thus show no contents. The web server hosting the TestTrainer will be pinged by a data request - from you, because you, after all, want to use the TestTrainer. In order to provide you with the data, the web server needs to know your IP address. As a result, the web server must process your IP address at this moment of the data query. For this, the web server receives the information, which website or file is retrieved, which browser and which operating system was used. Usually, this data is stored long-term in the so-called web server log files. Usually. The CYQUEST GmbH does not store the IP addresses in the log files, except for the time of the necessary processing described above. Instead with IPv4 addresses the last block is replaced by “0” and with IPv6 addresses only the first two blocks are stored and the last six blocks changed to “::”.
This data processing is carried out on the legal basis of Art. 6 I b) GDPR. The IP address is absolutely necessary for the purpose of communication of the end devices at the time of online communication, otherwise we would not be able to offer or provide you with the service of the TestTrainer.
2.2. Data processed as part of the transaction process
We do not collect any personal data in the registration process itself. However, as part of the transaction process, we receive the already verified email address and the transaction ID from PayPal.
The customer's e-mail address, which has already been verified by PayPal, is used exclusively for sending the test links. The test links will be sent by e-mail in addition to the immediate retrieval after the order so that the test links can also be easily retrieved and called up and/or forwarded by the customer at a later date.
The email address is not collected directly from the customer via the TestTrainer platform, as this would then require a (further) verification process via double opt-in in order to avoid unwanted registrations of the email address(es) by third parties. The processing of the e-mail address in the aforementioned context is based on Art. 6 I b) DSGVO for the fulfilment of the contract.
We receive the transaction ID from PayPal in order to be able to properly record the payment transactions for accounting purposes. The transaction ID is processed on the basis of Art. 6 I b) GDPR and Art. 6 I c) GDPR.
2.3 Data processed within the framework of the TestTrainer
Within the framework of the TestTrainer, we process the following data for the purposes and on the basis of the legal basis stated below:
2.3.1 Test ID
The test ID is an ID assigned to the respective test run. This test ID is assigned once per test link and serves the purpose of recognising whether or not this test has already been completed once and therefore cannot be completed again. On the other hand, the test ID is used to assign the user to a specific test run in the event of support.
2.3.2 Question-ID and timestamps
Question IDs are IDs that are assigned to the individual tests or test procedures. Together with the timestamp and the test ID, the current processing status of a TestTrainer run can be recorded and saved. This serves the purpose of offering the user the possibility of interrupting the test run and continuing it at a later point in time.
2.3.3 Content data (user input into the test procedures, test results)
Of course, the input of the users into the test procedures is processed. Otherwise it would not be possible to prepare and send test results to users after they have gone through the TestTrainer.
2.3.4 Optional: hashed password to protect results
In order to protect one's own test results from access by third parties, the user can – optionally – set a password before retrieving the test results. The test results can then only be accessed with the test link in conjunction with the password.
2.3.5 Optional: Statistical questions
The user can – optionally – answer two statistical questions that are helpful to CYQUEST GmbH in the further scientific validation and improvement of the test procedures:
- What kind of job are you currently applying for?
- Which professional direction matches your application?
2.3.6 Personal referenceability of the aforementioned data
The data mentioned in the paragraphs above are collected and processed by us without any specific reference to a person.
Although we can view the purchased test links/test IDs of the customers via the transaction ID transmitted by PayPal in the PayPal account, this does not indicate whether the customer who purchased the test(s) is also the participant in the respective test run.
2.3.7 Personal data processed in the support case
We offer users technical support in the event of technical difficulties with the TestTrainer. In the event of any queries from users, we always use only the test ID to identify the test run concerned, which we determine on the basis of the invitation link purchased.
In these cases, however, it may happen that you as a user contact CYQUEST GmbH by telephone, stating your name, or by e-mail in order to receive these direct support services. In this case, we receive from you in addition to the test ID, a telephone number or an e-mail address and regularly a name. In this case, the personal data is then naturally briefly linked with the content data in order to be able to recognise how far the respective user has progressed in the TestTrainer and how remedial action can be taken as quickly as possible.
In the case of telephone support, this temporary link will not be stored by CYQUEST GmbH beyond the support case and will not be processed in any other way.
In the case of support by e-mail, the support case is stored in the ticketing system for six months and then anonymised and deleted in accordance with the GDPR.
2.3.8 Legal basis for data processing pursuant to section 2.3
Insofar as there is any personal reference at all and thus personal data within the meaning of the GDPR, the processing is carried out on the basis of Art. 6 I b) GDPR, as this data is necessary for the performance of the contract.
2.4 Google Analytics
The Google Analytics tracking service is integrated on our website. We explain the specific nature of the integration, use and function of this service in the following.
Google Analytics ist ein Webanalysedienst der Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (künftig: Google). Google ermittelt als Dienstleister das Nutzungsverhalten von Besuchern einer Webseite und ermöglicht uns zu erkennen, ob und wie wir unsere Webseite und deren Nutzerführung verbessern können, welche Teile besonders relevant sind, welche weniger. Somit können wir Inhalte und Funktionen der Webseite für Sie – und uns – optimieren. Hierzu werden von Google Cookies gesetzt.
We process the following data during your visit via Google Analytics:
- IP-address (shortened)
- Browser type
- Length of stay on our site
- Operating system used
- Pages viewed on our website
- Click and scroll behaviour on our pages
- Source of origin of the visit (other website, advertising media)
- Time of server request
- Your approximate location (based on IP address), for example, at city/county level
On our behalf, Google will use the above information for the purpose of evaluating your use of the website and compiling reports on website activity for us. No user ID is activated and used for this purpose. Cross-device tracking via a user ID is therefore not possible.
In addition, we have prohibited Google from using the data obtained as part of the commissioned data processing for its own analysis. Google cannot use our data to analyse and evaluate online behaviour for product improvement or benchmarking (industry analysis). Similarly, we have prohibited technical support and key accounts from accessing our data.
This form of data processing is based on legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. We have a legitimate interest in being able to track the basic usage behaviour of visitors to the website. This includes being able to recognise which offers are particularly heavily or less heavily frequented by users or from where users come to our website. We need these insights to optimise the offers on the website according to user behaviour and thus to strengthen our own business. Since we - unlike service providers with a trade fair stand, for example - do not visually observe the streams of visitors and can thus recognise which areas of our offer are particularly interesting, we use Google Analytics in order to be able to carry out this observation and evaluation of the streams of visitors (not: of the individual, identifiable visitor). A conflicting, legitimate, overriding interest of the users in having their non-personal usage behaviour on the website analysed is not apparent. The cookies are set on the basis of § 25 para. 2 TTDSG (German Telecommunications-Telemedia Data Protection Act).
The data processed within the framework of Google Analytics is stored for two months and then deleted, provided you do not visit our website again during this period; in this case, the two-month period begins again.
The cookies used are deleted after 13 months at the latest.
Objection
If you wish to object to this data processing, you can do so in a very simple way:
You can object by by clicking on this link. By clicking on the link, an opt-out information will be stored in your browser. Your wish not to participate in website/reach analysis is only recognisable as long as this information is stored in your browser. Your objection only applies to the browser with which you clicked on the link. If you have multiple devices and/or browsers, you would need to express your objection with each device individually.
You can also install a browser plug-in that prevents data processing with Google Analytics.
In addition, you can prevent the storage of cookies from Google Analytics (as well as other cookies) by making the appropriate basic settings in your browser software (to be found under "Settings" in most browsers).
3. Duration of processing of personal data
Compliance with the principle of data minimization is a matter of course.
We store the transaction ID, with which we can access the data stored at PayPal regarding your order, for 10 years in accordance with the provisions of commercial and tax law.
We store the e-mail address to which the test link(s) was/are sent for the period during which the test links are valid, i.e. for three years from the sending date.
In all other respects, the data will be stored in accordance with the information provided here on data processing.
4. Assigned data use, recipient, transfer of data
The principle of assigned data use is strictly observed. All of the aforementioned data will only be processed for the purposes stated in this privacy statement.
5. Rights of affected persons (amongst others information, revocation, objection and cancellation)
Regardless of the foregoing, we must clarify that you may object to the use of your information at any time according to Art. 21 GDPR and revoke any consent to use your information according to Art. 7 (3) GDPR at any time. Furthermore, you can at any time correct, block or delete the data collected and stored by us (according to Art. 16, 17 GDPR). We expressly point out that there may be legal obligations to retain data, in which case the data can only be blocked.
Furthermore, we must clarify that you also have the right of data transferability under Art. 20 GDPR and the right to lodge a complaint with a supervisory authority according to Art. 77 GDPR.
Please contact support@cyquest.net to exercise the above rights.