
Privacy policy
Controller
IQstruct Engineering GmbHZum Carl-Alexander-Park 6
52499 Baesweiler
Germany
Phone +49 2401 399 103 - 0
info@iqs-e.de
Represented by the managing directors Martin Esser and Philipp Niemann-Stryczek. No data protection officer is appointed. Please send questions about data protection to the address above.
Provision of the website
- Purpose: delivery of the pages, security and stability of operation
- Data: IP address, requested address, time, browser and operating system, as your browser sends them with every request
- Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure operation of the site
- Recipients: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, as processor under Art. 28 GDPR. The server is located in Europe
- Retention: The connection data is processed for delivery and not stored in an access log. We keep a log only of operational faults; it contains no IP addresses of visitors
- Objection: The processing is required to display the pages. Without it the website cannot be shown
The connection is encrypted with TLS. The certificate is issued by Let's Encrypt; only the names of the site are transmitted for this, no visitor data.
All fonts, scripts and images are stored on our server. When a page is opened, no content is loaded from another provider.
Backup
We back up the data of the site once a day. The backup stays on the server for 30 days and as a copy on a storage device on our premises for 30 days. What was deleted from live operation therefore disappears from the backup no later than 30 days afterwards. The legal basis is Art. 6 (1) (f) GDPR, from the interest in restoring operation after a failure, together with Art. 32 GDPR.
Contact by e-mail or telephone
- Purpose: answering your enquiry
- Data: name, contact details and the content of the message, for a call the phone number, time and duration
- Legal basis: Art. 6 (1) (b) GDPR if you personally seek to enter into or are a party to a contract; otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in answering enquiries and communicating with business contacts
- Recipients: For e-mail: Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland, as operator of our mailbox (Microsoft 365) and processor. For telephone: Placetel GmbH, Im Mediapark 5, 50670 Cologne, Germany, as operator of our telephone system and processor
- Retention: until the enquiry is settled, subject to necessary retention for legal defence and statutory retention obligations described below
- Objection: informally to the address above
Contact form
- Purpose: answering the enquiry received through the contact form
- Data: salutation, first name, last name, company, e-mail address, phone number, chosen subject and the content of the message (at most 2,000 characters), plus the time of sending
- Legal basis: Art. 6 (1) (b) GDPR if you personally seek to enter into or are a party to a contract; otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in answering enquiries and communicating with business contacts. Handling the enquiry does not require data protection consent
- Recipients: staff handling the enquiry; Hetzner for our form server and internal form mailbox; Microsoft also receives data where delivery or further handling uses our Microsoft 365 mailbox, see above. No transfer to an external CRM takes place
- Retention: The temporary server copy is deleted after 14 days at the next hourly cleanup. We delete the mailbox message once settled, no later than after six months, subject to statutory retention obligations or necessary legal defence
- Objection: informally to the address above
To protect against mass submissions, we limit enquiries per submitted e-mail address. The related counter data is deleted after one hour at the next cleanup, no later than after two hours during operation. We use an invisible text field, an invisible checkbox and a completion-time check. The form requires JavaScript. The mandatory privacy checkbox acknowledges receipt of the privacy information; it does not give consent to data processing. The server issues a signed verification token valid for one hour, containing a timestamp and a random value, without an IP address or device identifier. Used tokens are held only in server memory until expiry plus at most one minute to prevent reuse. No cookies or external services are used for this check. Contact and application forms do not create separate consent records containing IP addresses or browser identifiers. The legal basis for abuse prevention is Art. 6 (1) (f) GDPR, based on our interest in secure form operation.
Required fields are marked. Without the information needed to handle your enquiry, we cannot process it; additional information is voluntary.
We do not send a confirmation of receipt by e-mail.
Applications
- Purpose: conducting the application procedure through the form for a speculative application or by e-mail to bewerbung@iqs-e.de
- Data: salutation, first name, last name, e-mail address, phone number, desired position, your message and up to three attachments of at most 10 MB in total, such as cover letter, CV and certificates
- Legal basis: section 26 (1) BDSG and Art. 6 (1) (b) GDPR for the decision on an employment relationship. Retention after a rejection is based on Art. 6 (1) (f) GDPR: we must be able to defend ourselves against claims under the German General Equal Treatment Act (AGG)
- Recipients: management and staff handling the procedure; Hetzner for the form server and internal form mailbox; Microsoft also receives data where delivery or further handling uses our Microsoft 365 mailbox, see above. No transfer to an external CRM takes place
- Retention: The temporary server copy including attachments is deleted after 14 days at the next hourly cleanup. Application records are normally deleted six months after the procedure ends, subject to necessary longer retention for legal defence. On hiring, required records are added to the personnel file
- Objection: informally to the address above. You can withdraw your application at any time
Please do not include information under Art. 9 GDPR in your application, such as health, religion or trade union membership. We do not need it for the decision. We do not keep a talent pool. Required fields are marked; without the necessary information we cannot process your application. Additional information is voluntary. The abuse prevention described above also applies to the application form.
We do not send a confirmation of receipt by e-mail.
Retention of business records
Records subject to statutory retention are kept for the prescribed period, in particular business correspondence for six years, accounting vouchers for eight years, and commercial books and annual accounts for ten years. Statutory starting dates and extensions apply. Other data is deleted when its purpose ceases, subject to necessary legal defence. Backup copies are covered by the Backup section.
Newsletter
Newsletter registration and distribution are currently not offered through this website.
Consent management
- Purpose: recording your decision on audience measurement and on the language choice, so that it holds beyond the next visit
- Data: the decision per category, the time, the version of the text and a consent ID generated in the browser. The entry lies as the cookie
iqse_consenton your device and is read on every visit - Legal basis: section 25 (2) no. 2 TDDDG for storing your decision including a refusal; Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR for proof of consent and Art. 6 (1) (f) GDPR for reliably respecting your settings
- Recipients: IQstruct Engineering and our hosting processor Hetzner. Your browser transmits the cookie to our server with matching requests; the website uses it to respect your privacy settings
- Retention: six months, after which the notice appears again
- Objection: You change the decision at any time through the Privacy settings control at the bottom left, which accompanies every page
If you allow the group Preferences and switch the language, the site additionally stores the cookie iqse_sprache with the language code, retention 29 days. The legal basis is your consent under section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Which entries arise in detail is stated in the cookie policy.
Audience measurement with Matomo
- Purpose: counting which pages are opened and by which routes visitors reach us, in order to improve the site
- Data: page opened, time and duration of the visit, referring page, type of device, browser, operating system, screen size, country of origin and the shortened IP address
- Tool: Matomo on our own server at Hetzner in Europe. Measurement starts only after your consent. Matomo does not set its own analytics cookies; the listed device and usage information is processed
- Legal basis: your consent under section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. No audience measurement takes place without consent
- Recipients: IQstruct Engineering and Hetzner as hosting processor; no sharing with external analytics services
- Retention: raw data 90 days, after which only the aggregated reports remain, without reference to a single visit
- Objection: You can withdraw your consent at any time through Privacy settings. The page reloads and further measurement stops. Withdrawal does not affect the lawfulness of processing before withdrawal
The IP address is shortened by its last two bytes before storage. If your browser sends the Do Not Track signal, we do not count the visit. No merging with other data takes place, and we do not attempt to infer a person from the measurement data.
Links to other websites
The site links to pages of other providers, such as project sites and partners. When you follow a link you leave our site; for the processing there, the privacy policy of the respective provider applies. Merely viewing our pages transmits no data to these providers.
Our presences on social networks
We maintain pages on LinkedIn, Xing, Facebook, Instagram, YouTube and X. Our site links to them in the footer of every page; they are not embedded. Only when you follow a link does the respective provider process your data under its terms.
| Network | Provider | Provider's notice |
|---|---|---|
| LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland | Notes from LinkedIn | |
| New Work SE, Am Strandkai 1, 20457 Hamburg, Germany | Notes from Xing | |
| Facebook and Instagram | Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland | Notes from Meta |
| YouTube | Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland | Notes from Google |
| X | Twitter International Unlimited Company, One Cumberland Place, Dublin 1, Ireland | Notes from X |
On our pages at Facebook, Instagram and LinkedIn the providers make statistics on usage available to us (page insights). For their collection we are jointly responsible with the provider under Art. 26 GDPR; the agreements are published by Meta at Agreement with Meta and by LinkedIn at Agreement with LinkedIn. We receive the statistics only in aggregated form without reference to a person. The legal basis for our presence on the networks is Art. 6 (1) (f) GDPR, from the interest in being reachable there. You may exercise your rights with the provider or with us; we forward them.
The providers also process data in the USA. LinkedIn, Meta and Google are certified under the EU-US Data Privacy Framework; for X the standard contractual clauses of the European Commission apply.
Your rights
You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7 (3)).
Please contact the address above for this. You may also lodge a complaint with a supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-WestfalenKavalleriestraße 2-4
40213 Düsseldorf
Germany
Phone +49 211 38424-0
poststelle@ldi.nrw.de
Automated decisions
No automated individual decision-making or profiling under Art. 22 GDPR takes place.
Version
15 September 2026.