Privacy
How QSUU processes your data and how to exercise your rights.
Controller
Frankvestor GmbH · Andreas Frank · Pestalozzistrasse 25 · 22305 Hamburg · Deutschland/Germany/Alemania. af@selr.de· +49 7961 5000721. Last updated: September 2026.
Vibemerce newsletter and automatic demo access
You can subscribe to the Vibemerce newsletter on the QSUU access page. We send your email address, optional name, consent text with language and version, form source and request IP to Vibemerce through an encrypted, signed server connection. Vibemerce handles mail delivery, email confirmation and evidence including time and confirmation IP. QSUU does not maintain a second newsletter recipient list for this. After confirmation or a paid Vibemerce purchase, QSUU receives your name, email and demo account entitlement. Personal invitation links expire after 48 hours and are used once to create the account. Password hashes stay in QSUU and are not transferred. Vibemerce can retrieve registration details and the counts and last times of sign-ins, shop and admin visits. Unsubscribing ends only newsletter access; purchase access remains. See the Vibemerce privacy notice.
Hosting and technical logs
Hosting is provided by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Delivery and security of the website involve connection data such as IP address, time, requested resource and browser information. Our legitimate interest in reliable and secure operation is the legal basis (Article 6(1)(f) GDPR). Hosting log retention follows the configured operational and security requirements. Authorised technical service providers assist with hosting and email delivery.
Sessions and customer functions
A necessary session cookie supports login, basket, language, delivery country and form security. Wishlists remain in the session or, after login, in the customer account. Passwords and access keys are checked using hashes. These functions are based on the service you request (Article 6(1)(b)), security interests (Article 6(1)(f)) and necessary device access under section 25(2)(2) TDDDG.
Applications and accounts
We process contact and company details, messages and information about proposed partnerships, social channels and audiences to handle your access, B2B, creator or partner application. The basis is Article 6(1)(b) GDPR for requested or pre-contractual services and Article 6(1)(f) for general correspondence. Required fields are needed to handle the request. Account data, demo orders, addresses, course access and service descriptions or photos support the functions you choose. Demo orders are not sent to payment or delivery providers. Accounts are retained for the duration of access; requests are retained until resolved and any necessary evidence period ends. You can request deletion, subject to applicable retention grounds.
Newsletter and recommendations
Newsletters require consent and a separate email confirmation (Article 6(1)(a) GDPR). We retain the email address, optional name and interests, subscription source, request and confirmation times, consent wording and delivery evidence. Emails use the configured ALL-INKL mailbox. You may withdraw consent using the unsubscribe link or by contacting us. A suppression entry and necessary consent evidence may remain to respect your request and defend legal claims (Article 6(1)(f)). With newsletter consent, recommendations can be scheduled based on demo purchases and product relationships; rules exclude already purchased products. No opening pixels or individual click-tracking links are used. These recommendations make no legally significant automated decision.
Statistics and access security
When enabled, QSUU aggregates daily pageviews, estimated visits, source categories and selected general catalogue search terms. The shop statistics store no IP addresses, permanent visitor IDs or full referring URLs. Recognisable bots, DNT and GPC are considered. Totals are removed after 395 days. The basis is our legitimate interest in limited, aggregate measurement. Search Console imports are separate from explicitly labelled fictional keyword examples. Successful login counts, the first shop/admin entry per session and the latest entry time are recorded to support the requested demonstration. Only the superadmin sees real prospect access data. Short-lived hashed technical identifiers limit abuse. Account counters are removed with the account; security data follow the applicable blocking period.
Popup and local storage
A vibemerce promotion may appear in the shop. Without additional consent, display state remains only in the memory of the open page. Selecting “Remember on this device” allows the campaign identifier and expiry to be stored in your browser for up to 30 days or until the offer expires. This uses consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. It is not cross-site tracking. Use the button below to remove the local reminder. External purchase pages open only after you click.
External services
Regular images, scripts and fonts are served locally. Maps, social profiles and external offers open when you follow their links. An external video player, if selected, may receive connection data. Optional AI advice sends your question and product information to OpenAI only after your express selection; it does not attach customer files or order history. Do not submit confidential information. Processing outside the EEA may occur; see OpenAI privacy information. The local product finder is available without AI.
Retention, recipients and rights
Only authorised personnel and necessary technical service providers receive access; addresses are not sold to advertisers. Data are deleted or restricted once no longer needed, unless retention duties or legal claims require continued storage. Backup copies follow their retention cycles. You may request access, correction, deletion, restriction and portability under Articles 15–20 GDPR, withdraw consent prospectively and object under Article 21. You may object to direct marketing at any time without giving reasons. Contact af@selr.de. You can complain to a supervisory authority, including Hamburg’s data protection authority or the authority where you live. No decisions with legal or similarly significant effects are made solely by automation.