Privacy Policy

Privacy Policy

The protection of your data is important to us. As a result, and to comply with all legal information obligations, we will inform you below how we process your data and what rights you have with regard to data processing.

The TestTrainer was developed and operated by us, CYQUEST GmbH, Heußweg 25, D-20255 Hamburg. As a result, we will hereby inform you about which data we collect via the TestTrainer and how we process this data.

1. Subject of data protection

The subject of data protection is personal data. In accordance with Art. 4 GDPR personal data means all information relating to an identified or identifiable natural person. This includes e.g. information such as names, postal addresses, e-mail addresses or telephone numbers, but also usage data such as your IP address or content data such as the answers you provide within the online assessment and the resulting test results.

2. Scope and purposes of data processing

In the following, we will inform you about the scope of the data collection and storage as well as their use and the purpose of the respective data collection in the context of the online assessment. (Hereinafter referred to as "data processing", used within the meaning of Article 4 (2) GDPR).

When registering for the TestTrainer and when using the TestTrainer, we do not collect any personal data of the customer with the exception of the respective IP address of the customer using the TestTrainer; please read section 2.1.

As part of the transaction process, PayPal (see section 4.1.8 of our General Terms and Conditions) provides us with the transaction ID and your email address, which has already been verified by PayPal; please read section 2.2.

When you use the TestTrainer, we process data that enables you to complete the test or that is generated when you complete the test; please read section 2.3 for more information on this and the reference to individuals in this data.

Finally, we process personal data when we provide technical support to a user; please refer to section 2.3.7.

In addition, we use Google Analytics in order to be able to recognise which parts of the TestTrainer are of most interest to you as an entire user group and, if necessary, to align the TestTrainer with the interests of the entire user group and thus to be able to optimise it for them; please read section 2.5 for more information.

2.1 IP addresses

Without Internet protocol addresses, in short "IP addresses", the Internet simply would not work. An IP address represents an address in computer networks so that web servers and / or individual end devices can be addressed and accessed. Without an IP address, the web server and the end device cannot communicate - and thus show no contents. The web server hosting the TestTrainer will be pinged by a data request - from you, because you, after all, want to use the TestTrainer. In order to provide you with the data, the web server needs to know your IP address. As a result, the web server must process your IP address at this moment of the data query. For this, the web server receives the information, which website or file is retrieved, which browser and which operating system was used. Usually, this data is stored long-term in the so-called web server log files. Usually. The CYQUEST GmbH does not store the IP addresses in the log files, except for the time of the necessary processing described above. Instead with IPv4 addresses the last block is replaced by “0” and with IPv6 addresses only the first two blocks are stored and the last six blocks changed to “::”.

This data processing is carried out on the legal basis of Art. 6 I b) GDPR. The IP address is absolutely necessary for the purpose of communication of the end devices at the time of online communication, otherwise we would not be able to offer or provide you with the service of the TestTrainer. 

2.2. Data processed as part of the transaction process

We do not collect any personal data in the registration process itself. However, as part of the transaction process, we receive the already verified email address and the transaction ID from PayPal. 

The customer's e-mail address, which has already been verified by PayPal, is used exclusively for sending the test links. The test links will be sent by e-mail in addition to the immediate retrieval after the order so that the test links can also be easily retrieved and called up and/or forwarded by the customer at a later date. 

The email address is not collected directly from the customer via the TestTrainer platform, as this would then require a (further) verification process via double opt-in in order to avoid unwanted registrations of the email address(es) by third parties. The processing of the e-mail address in the aforementioned context is based on Art. 6 I b) DSGVO for the fulfilment of the contract.  

We receive the transaction ID from PayPal in order to be able to properly record the payment transactions for accounting purposes. The transaction ID is processed on the basis of Art. 6 I b) GDPR and Art. 6 I c) GDPR. 

2.3 Data processed within the framework of the TestTrainer 

Within the framework of the TestTrainer, we process the following data for the purposes and on the basis of the legal basis stated below: 

2.3.1 Test ID

The test ID is an ID assigned to the respective test run. This test ID is assigned once per test link and serves the purpose of recognising whether or not this test has already been completed once and therefore cannot be completed again. On the other hand, the test ID is used to assign the user to a specific test run in the event of support. 

2.3.2 Question-ID and timestamps

Question IDs are IDs that are assigned to the individual tests or test procedures. Together with the timestamp and the test ID, the current processing status of a TestTrainer run can be recorded and saved. This serves the purpose of offering the user the possibility of interrupting the test run and continuing it at a later point in time. 

2.3.3 Content data (user input into the test procedures, test results)

Of course, the input of the users into the test procedures is processed. Otherwise it would not be possible to prepare and send test results to users after they have gone through the TestTrainer. 

2.3.4 Optional: hashed password to protect results 

In order to protect one's own test results from access by third parties, the user can – optionally – set a password before retrieving the test results. The test results can then only be accessed with the test link in conjunction with the password. 

2.3.5 Optional: Statistical questions 

The user can – optionally – answer two statistical questions that are helpful to CYQUEST GmbH in the further scientific validation and improvement of the test procedures: 

  • What kind of job are you currently applying for?
  • Which professional direction matches your application?

2.3.6 Personal referenceability of the aforementioned data 

The data mentioned in the paragraphs above are collected and processed by us without any specific reference to a person.

Although we can view the purchased test links/test IDs of the customers via the transaction ID transmitted by PayPal in the PayPal account, this does not indicate whether the customer who purchased the test(s) is also the participant in the respective test run. 

2.3.7 Personal data processed in the support case 

We offer users technical support in the event of technical difficulties with the TestTrainer. In the event of any queries from users, we always use only the test ID to identify the test run concerned, which we determine on the basis of the invitation link purchased.

In these cases, however, it may happen that you as a user contact CYQUEST GmbH by telephone, stating your name, or by e-mail in order to receive these direct support services. In this case, we receive from you in addition to the test ID, a telephone number or an e-mail address and regularly a name. In this case, the personal data is then naturally briefly linked with the content data in order to be able to recognise how far the respective user has progressed in the TestTrainer and how remedial action can be taken as quickly as possible.

In the case of telephone support, this temporary link will not be stored by CYQUEST GmbH beyond the support case and will not be processed in any other way. 

In the case of support by e-mail, the support case is stored in the ticketing system for six months and then anonymised and deleted in accordance with the GDPR.

2.3.8 Legal basis for data processing pursuant to section 2.3  

Insofar as there is any personal reference at all and thus personal data within the meaning of the GDPR, the processing is carried out on the basis of Art. 6 I b) GDPR, as this data is necessary for the performance of the contract. 

2.4 Google Analytics

The Google Analytics tracking service is integrated on our website. We explain the specific nature of the integration, use and function of this service in the following.

Google Analytics ist ein Webanalysedienst der Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (künftig: Google). Google Analytics ist ein Webanalyse-Tool, mit dessen Hilfe die Interaktion der Besucher mit unserer Webeseite analysiert und diese somit weiter verbessert werden kann. Hierzu werden von Google zwei Cookies gesetzt (Textdateien, die auf dem Computer gespeichert werden und die eine Analyse der Benutzung der Website durch den Nutzer ermöglichen). Diese Cookies verarbeiten die folgenden Daten:

  • IP-address (shortened)
  • Browser type 
  • used operating system 
  • Pages accessed
  • Click behaviour on the pages
  • Source of origin of the visit (other website, advertising media)
  • Time of server request

The information generated by the cookies about the use of this online platform is usually transmitted to a Google server in Ireland and stored there. However, we have enabled IP anonymization on our online platform. As a result, the IP address will be shortened before transmission to Google. Only in exceptional cases will the full IP address be sent to a Google server and shortened there. On our behalf, Google will use the above information to evaluate the use of the website and to compile reports on website activity. 

No user ID is activated and used. Cross-device tracking via a user ID is therefore not possible. Furthermore, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

In addition, Google was prohibited from using the data obtained as part of the commissioned data processing for its own analysis. Google cannot use our data to analyse and evaluate online behaviour for product improvement or benchmarking (industry analysis). Likewise, technical support and key accounts have been prohibited from accessing our data. You can get more information about this here directly from Google.  

All these measures mean that we can only recognise the usage behaviour of users or user streams that are anonymous for us, but not of individual concrete or identifiable persons on our website. It is not possible for us to identify individual persons.

This data processing is based on legitimate interest within the meaning of Art. 6 I f) GDPR. As a provider of online tests, we have a legitimate interest in being able to track the basic usage behaviour on the online test website. This includes being able to recognise which offers are particularly heavily or less heavily frequented by users or from where users reach our offers. We need these insights to optimise the offers on the website according to user behaviour and thus to strengthen our own business. Since we - unlike analogue exhibitors, for example - do not visually observe the streams of visitors and can thus recognise which areas of our offer are particularly interesting, we make use of Google Analytics in order to be able to carry out this observation and evaluation of the streams of visitors (not: of the individual, identifiable visitor). An opposing legitimate, overwhelming interest of the users in having their non-personal usage behaviour on the website analysed is not apparent.

Likewise, the processing of this data is technically necessary within the meaning of Article 5 (3) sentence 2 of the EU Data Protection Directive (so-called "Cookie Directive"), as we would otherwise not be able to provide you with the offer in this way.

Google Ireland Ltd. is obligated to CYQUEST by an agreement on data processing together with an SCC.

The cookies are only set for one session at a time. 

The data processed within the scope of Google Analytics will be deleted after 14 months.

If you wish to object to this data processing, you can do so specifically in very simple ways: 

You can prevent the storage of Google Analytics cookies (as well as other cookies) by changing the basic settings of your browser software (available under "Settings" in most browsers).

Furthermore, you can prevent the collection of the data generated by the cookie and related to the use of the website (incl. the IP address) to Google as well as the processing of this data by Google by downloading and installing the browser plug-in available under the following link .

Und wenn Sie die Seite über ein Tablet oder ein Mobiltelefon nutzen und die Erfassung der Besuche auf dieser Webseite von Google Analytics zukünftig verhindern möchten, dann klicken Sie bitte diesen Link. Durch das Klicken des Links wird ein Opt-Out-Cookie im mobilen Browser hinterlegt. Wird dieser Cookie gelöscht, muss der Link erneut geklickt werden. 

3. Duration of processing of personal data

Compliance with the principle of data minimization is a matter of course.

We store the transaction ID, with which we can access the data stored at PayPal regarding your order, for 10 years in accordance with the provisions of commercial and tax law. 

We store the e-mail address to which the test link(s) was/are sent for the period during which the test links are valid, i.e. for three years from the sending date. 

In all other respects, the data will be stored in accordance with the information provided here on data processing. 

4. Assigned data use, recipient, transfer of data

The principle of assigned data use is strictly observed. All of the aforementioned data will only be processed for the purposes stated in this privacy statement.

5. Rights of affected persons (amongst others information, revocation, objection and cancellation)

Regardless of the foregoing, we must clarify that you may object to the use of your information at any time according to Art. 21 GDPR and revoke any consent to use your information according to Art. 7 (3) GDPR at any time. Furthermore, you can at any time correct, block or delete the data collected and stored by us (according to Art. 16, 17 GDPR). We expressly point out that there may be legal obligations to retain data, in which case the data can only be blocked.

Furthermore, we must clarify that you also have the right of data transferability under Art. 20 GDPR and the right to lodge a complaint with a supervisory authority according to Art. 77 GDPR.

Please contact support@cyquest.net to exercise the above rights.