Introduction

Welcome to Q15's Privacy Policy. This policy outlines how we collect, use, and protect the personal data of our clients and website visitors. Our commitment to your privacy is paramount, and we ensure that all data handling practices comply with the General Data Protection Regulation (GDPR).

As the provider of career coaching services for web developers, Q15 collects personal data primarily to offer and enhance our coaching services. This includes data obtained directly from clients, as well as information received through OAuth providers like GitHub, LinkedIn, and Discord for authentication and service improvement purposes.

Data Controller:
Quietscheentchen (Q15) - A. van der Bergh
Am Püttkamp 37

40629 Düsseldorf

Email: hello@q15.co
Phone: +49 211 1594 7925

For more details on how to contact us regarding your data privacy concerns, please refer to our Impressum.

User Rights

Under the GDPR, you as a user have several rights regarding your personal data. These rights ensure that you have control over your information and how it is used.

Rights include:

• Right to Access: You can request access to your personal data that we process.
• Right to Rectification: You have the right to correct any inaccurate or incomplete personal data.
• Right to Erasure: Also known as the 'right to be forgotten', allowing you to request the deletion of your data under certain conditions.
• Right to Restrict Processing: You may request the limitation of processing of your personal data.
• Right to Object: You have the right to object to the processing of your personal data in certain circumstances.
• Right to Data Portability: You can request your data in a structured, commonly used and machine-readable format.

Additionally, you have the right to lodge a complaint with a supervisory authority about the processing of your personal data. In Germany, the supervisory authority responsible for data protection is:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Husarenstraße 30 D-53117 Bonn

Phone: +49 (0)228-997799-0
Fax: +49 (0)228-997799-5550
E-Mail: poststelle@bfdi.bund.de

Data Collection on Website Visit

Our website, hosted on Vercel, collects certain information during your visit. This is necessary to provide and improve the website, set the appropriate locale, and ensure its security and stability. The data collection complies with Article 6(1)(f) of the GDPR.

Collected data includes:

• IP Address (used anonymously for analytics)
• Date and time of the request
• 'Accept Language' header for setting user locale
• Content of the request (specific page)
• Access status/HTTP status code
• Information related to page views and website interactions (via Vercel Analytics)

Vercel Analytics collects data in an anonymized form, primarily for understanding website traffic and usage patterns.

Use of Cookies and Tracking Technologies

Our website uses cookies to enhance user experience and ensure website functionality. This section explains what cookies are, how we use them, and your options regarding cookies.

What are cookies?

A cookie is a small text file stored on your computer or mobile device when you visit a site. Our website uses two types of cookies:

• First-party cookies: These are set by our website and are necessary for its functioning and for remembering your preferences, like language settings.
• Persistent cookies: These remain on your device and are not deleted when you close your browser. They are used to remember your preferences over time.

How do we use cookies?

1. Visitor Preferences: These cookies remember your settings and preferences for a better user experience.
2. Operational Cookies: Essential for website functionality, these cookies do not require your consent. They include cookies necessary for authentication and locale settings.

We also use Vercel Analytics, which utilizes cookies for aggregated, anonymized web traffic analysis. These analytics cookies help us understand user behavior on our site.

Your choices regarding cookies

You can control and manage cookies through your browser settings. You can view, block, or delete cookies as you wish. However, please note that disabling cookies might affect the functionality of our website.

Services and Offers on the Website

Alongside the general use of our website, we provide various services and offers that you can engage with. To use these services, you might need to provide additional personal data, which we process for the purpose of delivering these services.

Details on our services:

• Coaching Services: We collect information such as names, email addresses, and skill levels for providing personalized coaching.
• SkillSync Pathways: This feature leverages job descriptions to create interactive queries about specific job duties, allowing users to express their interests and self-rate their skills. It helps users rank jobs based on their preferences and skill assessments. User accounts are required to access this personalized feature.
• OAuth Providers: For user authentication, we utilize OAuth providers such as GitHub, LinkedIn, and Discord. This includes collecting data like names, email addresses, and professional experience from these platforms.
• Data Sharing: We may share data with external entities like the Bundesagentur für Arbeit or Jobcenter in Germany for clients using AVGS vouchers and with Certqua during AZAV audits.

All personal data collected for these services are handled in compliance with GDPR guidelines and are used strictly for the intended purposes.

External Service Providers and Sub-Processors

To provide our services effectively, we partner with external service providers who assist us in processing data in various capacities.

Primary External Service Providers:

• Daily.co: Used for video call services. Daily.co offers a transcription feature for video calls, which utilizes Deepgram.com for processing these transcriptions. This transcription service is a vital component of our coaching services, enabling the detailed analysis necessary for personalized feedback.

• Deepgram.com: Engaged through Daily.co for transcription services. Deepgram.com processes the audio from our video calls to provide text transcriptions.

• OpenAI: Utilized for generating summaries and insights from the transcribed text. OpenAI's advanced AI models help us to analyze and summarize the content of coaching sessions, enhancing the personalized coaching experience.

• Vercel: Hosts our website and related services, including database storage and analytics. Vercel's role is crucial for the smooth operation and security of our digital infrastructure.

These providers are carefully selected and bound by our instructions, ensuring the security and privacy of your data. We ensure that our agreements with these providers comply with GDPR standards, and they are responsible for the compliance of any sub-processors they may use.

Note on Sub-Processors:

• Vercel may utilize its own sub-processors to deliver the services. While these entities are not directly engaged by us, they play a part in the overall provision of Vercel's services. We ensure that our agreements with Vercel uphold the standards of GDPR, and Vercel is responsible for the compliance of their sub-processors.

We have carefully selected these providers for their commitment to privacy and data security. They are contractually bound to our instructions and are regularly assessed to ensure compliance with our data protection standards and GDPR regulations.

Data Security Measures

At Q15, we are committed to protecting the personal data we collect and process. We employ a range of security measures to ensure data safety and compliance with GDPR.

Our security measures include:

• Access Control: Managed by Vercel via GitHub OAuth, with strict access controls in place to ensure only authorized personnel can access sensitive data.
• Two-Factor Authentication: We use two-factor authentication for enhanced account security.
• Data Encryption: Our local development machines are secured with LUKS2 encryption, and keys are stored on TPM2. We also use secure boot features to ensure data safety.
• Regular Security Assessments: We conduct regular assessments and updates to our security practices to stay ahead of potential threats.

We are continuously monitoring and updating our security practices to ensure the highest level of data protection and to comply with evolving data protection regulations.

Data Retention and Deletion

Our policy on data retention and deletion is designed to respect user privacy while complying with legal obligations and operational requirements.

Data Retention Policy:

• Active Accounts: Personal data is retained as long as the user's account remains active on our platform.
• Inactivity: In case of prolonged inactivity, we may delete accounts and associated data after a period of one year.
• Backups: We maintain regular backups of our database for operational integrity. Personal data in backups are handled in compliance with GDPR, ensuring they are properly secured and deleted in accordance with our retention schedule.

Data Deletion:

• User Request: Users can request the deletion of their accounts and associated data at any time via a dedicated option in their account settings.
• Backup Data: While we endeavor to delete personal data from backups, there are technical limitations. In instances where deletion from backups is not feasible, we ensure that the data is not restored to active databases and is deleted as per our backup retention schedule.

Our data retention and deletion practices are regularly reviewed to ensure compliance with GDPR and other relevant data protection regulations.

Policy Changes and Updates

We may update this privacy policy from time to time to reflect changes in our practices, service offerings, or legal requirements.

Notification of Changes:

• Email Notifications: In the event of any significant changes to our privacy policy, we will notify our users via email. This ensures that all users are informed promptly and can review the changes.
• Website Updates: Additionally, the latest version of the policy will always be accessible on our website.

We encourage users to review the updated policy to stay informed about how their personal data is handled. Our commitment to transparency and compliance with GDPR and other data protection laws is reflected in our communication of these changes.

Contact Information

For any questions or concerns regarding your personal data, our privacy practices, or this privacy policy, please contact us at:

Email: hello@q15.co
Phone: +49 211 1594 7925

We are committed to addressing any inquiries or concerns you may have about your data privacy and our handling of personal information.

Your privacy is of utmost importance to us, and we are here to ensure that your data is handled with the highest standards of security and confidentiality.