Questel Data Privacy Policy

This Data Privacy Policy is drawn up in English. It may be translated in other languages for convenience purposes. In case of a conflict with the translated version, the English version shall prevail.

Questel reserves the right to change its Privacy Policy. You can find the latest version on this webpage. Any changes will be effective when we post on the website the revised Privacy Policy. This Privacy Policy was last updated as of the date listed above (“updated date”). We encourage you to review this page regularly for the latest information on our privacy practices. 

Questel is a global leader in providing trusted information and analysis on intellectual property services and software solutions, as well as the provider of a unique collection of IP databases. 

Questel attaches the greatest importance and care to the protection of privacy and Personal Data, as well as to the respect of the provisions of the applicable legislation. The General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR"), as well as local data privacy laws, state that Personal Data must be processed lawfully, fairly, and transparently. Thus, this Policy aims to provide you with simple, clear information on the processing of Personal Data concerning you, in the context of your browsing and the operations carried out on our website.

This Policy describes how Questel SAS and its affiliates (hereinafter “Questel”, “we”, “us” and “our”) collect, use, process and secure your Personal Data when visiting our websites, SaaS platforms or other offline business contact with us, in the context of our business relations with our clients or fellow professionals, or in the context of all other occasions on which you provide Questel with your Personal Data, especially when you subscribe to our newsletters or at professional events. The present Personal Data Privacy Policy concerns innosabi's website. innosabi is a subsidiary of Questel Group.

For your information, some Questel websites may have their own privacy policy that describes how Personal Data for those websites are handled specifically. In case of conflict between the specific privacy notice and this Policy, the specific one prevails.

Questel has appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to data privacy. If you have any questions, including any requests to exercise any of your privacy rights, please contact our DPO at [email protected].

1- What Personal Data do we collect and how?

2- Why do we collect your Personal Data?

• 2.1    Execution of the contract
• 2.2    Consent
• 2.3    Legitimate interest
• 2.4    Legal rights

3- How long do we keep your Personal Data?  

4- Do we share your Personal Data?

5- How do we ensure the security of your Personal Data?

6- Is your Personal Data transferred to third countries?

7- How do we use cookies and tracking technologies?

8- What third-party tools are employed on the website?

• 8.1    Google Tag Manager   
• 8.2    Google Ads   
• 8.3    Google Analytics   
• 8.4    Google reCaptcha
• 8.5    Microsoft (Bing) Ads
• 8.6    Clarity
• 8.7    LinkedIn Ads
• 8.8    Marketing Cloud Account Engagement (formerly Pardot)   
• 8.9    Gartner Conversion Tracking Snippet   
• 8.10    Claspo   
• 8.11    Zapier   
• 8.12    Adroll   
• 8.13    GoToWebinar   
• 8.14    SEMRush    

9- What are your privacy rights?

10- How to exercise your privacy rights?

11- How to contact us?

Personal information (“Personal Data”) generally means information that identifies, relates to, is about you, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal Data does not include publicly available, anonymized or aggregated data.

1. Questel collects your Personal Data interacting with you directly:
2. Questel may also collect your Personal Data, indirectly, from third parties:

• When you purchase or have access to our services:
  • You are usually required to provide us with your name and email address.
  • You may also be required to provide other information necessary for your use of our services or additional information that you choose to disclose to us, such as your professional details or your user preferences.
  • When you come to our offices or take part in events organized by Questel or other professional events.
• When you interact with us:
  • When you fill in a form online.
  • When you contact us or request information from us.
  • When you send us applications or reply to job advertisements.
  • Through cookies and similar technologies included in our services:
  • When you access our services, we collect device and information relating to your usage of our services. 

For more information on how we use these standard technologies, please see Questel Cookie Policy, click here 

• Our partners and service providers:
  • Technology providers in connection with your use of our services.
  • Market research agencies.
  • Content providers.
• Our customers:
  • Our customers may provide us with Personal Data to integrate with our services, your employer, or the institution you are affiliated with may provide us with contact information so that we can set up your login, etc.
  • Publicly available sources:
  • Academic or scientific publications.
  • Patent & trademark offices and regulatory agencies.
  • Court files.
  • Public websites, social media or from data suppliers.

The Personal Data which we collect may consist of the following:

Personal identifiers, e.g., name, username, e-mail address, phone number, signatures, etc.

• Contact information, e.g., e-mail, phone, address, title, function, etc.
• Demographic information, e.g., gender, location, language, etc.
• Authentication data, e.g., Internet Protocol (IP) address, etc.
• Professional information, e.g., publications, employer, location, licensure, credentials, professional identification number, work history/resume, education history, specialties, expertise, availability, etc.
• Indirect identifiers, e.g., study ID, cookies, IP address, computer device information, etc.
• Knowledge, belief & preference data, e.g., thoughts, concerns, preferences, feedback, opinions and other information provided through surveys, interviews, etc.
• Usage data, e.g., information about your use of our services, such as date and time of visits, the pages viewed, time spent at one of our websites, etc.
• Financial information, e.g., payment information and related bank details, etc.
• Commercial information, e.g., purchase history, subscription information, transaction details, information about sanctions and restrictions, etc.
• Communication data, e.g., information communicated from or to you through telephone recordings, voicemail, email, etc.
• Sensory data, e.g., photographs, audio, video or other similar electronic recordings, etc.

Questel does not collect any Personal Data in the special categories (sensitive information) listed Article 9 of the GDPR, i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Personal Data collected by Questel undergo computer processing so that we can manage your request and ensure that it is followed up. We collect your Personal Data for specific purposes and on the below different legal grounds.  

2.1         Execution of the contract

In the context of the execution of the contract or pre-contractual measures, your Data is processed for the following purposes: 

• Managing information requests
  • Manage requests for information about our services.
  • Manage customer information across our websites.
  • Communicate product usage information to our customers, business partners, content and technology providers.
• Contract management
• Order management, purchasing.
• Create software accounts.
• Contract management.
• Provide user and technical support.
• Perform other related administrative tasks.
• Customer relationship management
• Enforce our terms of business.
• Management of your customer account. 
• Contact you about renewal of your subscriptions.
• Complaints and after-sales service management.
• If you answer a job advertisement or send an application, so that Questel can reply and potentially reuse those data at the time of the recruitment procedure.

2.2         Consent

Based on your consent, your Data is processed for the following purposes:  

- Business development

• Carrying out commercial and marketing prospecting operations.
• Transmission of your Data to our commercial partners.
• Administer events we host or attend (e.g., conferences, webinars, etc.).
• Management of cookies requiring your consent. 
• Management of the newsletter.
• Provide you with advertising based on your activity on our websites and services and on third-party websites. 

You can opt out of our marketing communications at any time – all Questel marketing e-mails contain an “unsubscribe” or “manage my preferences” link. If you have questions regarding our use of your information for marketing purposes, please contact [email protected]. See section 8 “What are your privacy rights?”. 

• Product customization and development
• Deliver personalized functionality and content in our services, for instance we may retain your browsing and usage information to make your searches within our services more relevant.
• Analyze product usage information to understand which content and tools are most useful for our users and to allow us to deliver and suggest tailored content, features and other services that we believe may interest you.
• Use information collected on our services to improve the functionalities, the design and content of our services (including sharing your Personal Data across our group which allows us to facilitate the use of these services).

You can withdraw your consent at any time. We will ensure that we provide the opportunity for you to opt out at any time and in an easy manner. See section 8 “What are your privacy rights?”. 

2.3         Legitimate interest

In the framework of the legitimate interest of Questel, your Personal Data are processed for the following purposes: 

• Management and development of the relationship with clients.
• Establishment of statistics for the improvement of products and services.
• Marketing activities.
• Security measures
• Manage access to our premises and for security purposes.
• Protect the security of our IT systems, architecture and networks.
• Prevent misuses of our services.

2.4         Legal rights 

-Management of pre-litigation and litigation. 

-Fight against Fraud. 

-Fight against money laundering and the financing of Terrorism.  

Within the framework of legal and regulatory obligations to which Questel is subject, your Personal Data are processed for the following purposes:  

• General and auxiliary accounting.
• Respond to a court order or a regulator.
• Comply with legal obligations.

Those legal obligations are defined in national and/or international law and in national rules issued by the competent national supervisory authorities and can include maintaining records, compliance checks, or screening and recording for tax, social, or security objectives.

Questel stores your Personal Data throughout the period of your relationship with us and retains it for as long as necessary to fulfil the purposes for which Questel collect it, including for the purposes of satisfying legal, accounting, or reporting obligations or to resolve disputes.  For more information on how long we store your Personal Data, please contact us at [email protected].

The data recipients are the people responsible for managing the contract between you and us and / or the people receiving requests sent to Questel via our websites, and /or  the people best able to respond to your request, depending on the kind of request.

As a global firm, Questel may share the Personal Data it collects via its websites internally with its offices and affiliates or with third parties service providers. Your Personal data may, depending on the purposes of processing, be disclosed to different individuals and organizations, including:

• Employees and contractors of Questel group whose roles require access to your data. 

Our personnel are bound to confidentiality terms which cover their obligations to protect personal data.

• Services providers who process personal data on our behalf (“processors/vendors”).

Questel may employ the services of third parties to support us with certain tasks, such as internet technical support, marketing automation, designers, website developers, translation services, etc. 

• We may share your data with these third-party service providers, so that they can perform services on our behalf. They process the Personal Data strictly necessary to carry out the services we ask them. Such vendors are contractually bound to protect your data to the same standard as set out in this Policy.   Duly authorized public authorities (judicial, control...), in the framework of our legal and regulatory obligations. 
• Regulated professions (lawyers, bailiffs, etc...) who may intervene in the context of the implementation of guarantees, collection or litigation. 
• Subscribers and members. If your Personal Data is collected from public sources for inclusion in our product databases and any Personal Data you choose to provide to us for display in our services (for example, in profiles and when using online forums), your personal data may be accessed by users of our services. Additionally, if you or your organization register for one of our membership-based communities or products, we may make information about you (including contact and institutional information) available to other members through online and offline services.

Questel does not sell OR lease your personal data to third parties.

Questel takes care to protect and secure your personal data to ensure that they are kept confidential, and to prevent them from being distorted, damaged, destroyed or disclosed to unauthorized third parties. To do so, Questel maintains appropriate administrative, technical, and physical security measures. It may include encryption, firewalls, roles-based data access, intrusion-detection software, and physical access controls to data centers.  In addition, our practices, and policies and physical and logical security measures (secure access, authentication process, backup, software, internal trainings, etc.) are regularly reviewed and updated as necessary. See Questel IT Security Policy. 

Under the applicable European rules, if a Personal Data breach is found which can cause a high risk to the rights and freedoms of data subjects, Questel will notify that breach to the competent national supervisory authority and, where required by the regulation, to the data subjects (individually or collectively depending on the circumstances).

Questel keeps your Personal Data for the time necessary to perform the agreed purposes, subject to its legal rights to archive some data, its obligations to keep certain data and/or to the fact that it can anonymize data.

In addition, Questel’s websites may offer links to third-party websites which may be of interest to you. Questel has no control over the contents of those third-party websites or what those third parties do with any personal data they may gather. Questel therefore cannot be held liable for the processing of your personal data by those third parties, which is not subject to this Policy. You are responsible for finding out about those third parties' data protection policies.

Questel is a global business, and your data may be transferred to countries with different privacy and data protection laws than your own.

We protect our transfers from the European Union to non-EU countries with approved legal safeguards that may include: 

• Questel’s intra-group Agreements incorporating the Standard Contractual Clauses approved by the European Commission (“Standard Contractual Clauses”); 
• Standard Contractual Clauses and other contract terms executed between Questel and applicable third parties that ensure personal data remains protected in accordance with applicable laws.

Please read Questel Cookies Policy for detailed information about the cookies and other tracking technologies used on our websites and services. The Cookie Policy includes information on how you may disable these technologies. You can indeed change the personal configuration of your navigator to prevent cookies registration. Please be aware that if you choose not to accept cookies, you will be able to navigate in the freely accessible public part of the Questel web sites only.

8.1    Google Tag Manager
For reasons of transparency, we would like to point out that we use Google Tag Manager. This is a tag management system for managing JavaScript and HTML tags, which is used to implement tracking and analysis tools. It is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The controller in the EU/EEA is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

The Tag Manager makes it easier for us to integrate and manage our tags. Tags are small code elements that serve, among other things, to measure traffic and visitor behavior, to capture the impact of online advertising and social channels, to set up remarketing and targeting, and to test and optimize websites. The Google Tag Manager itself does not actively collect any personal data, but may transmit the IP address to Google for technical reasons when loaded. If you have opted out, Google Tag Manager will honor that opt-out.
The recipients of the data are:

Google Ireland Limited, EU,
Google LLC, USA,
Alphabet Inc., USA.

This service may process data outside the European Union and the European Economic Area (EEA) and transfer it to a country that does not offer an adequate level of data protection. If the data is transferred to the USA, there is a risk that your data may be processed by US authorities for control and monitoring purposes, without you having any legal recourse.

If Google stores personal data, this data is stored on the Google servers. The storage period for the data processed by the individual tracking tools can be found in our individual data protection notices for the individual tools.

The legal basis for this data processing is your consent Art. 6 sec. 1 lit. a GDPR and, if you are located in Germany, pursuant to § 25 (1) S. 1 TDDDG). You have the option to revoke consent you have previously granted with future effect by changing your settings [here |link to Consent tool]. The legality of the data processing up to the point of revocation remains unaffected.

For more information about Google Tag Manager, please visit this site.

8.2    Google Ads
We use the Google Ads service. Google Ads is an online advertising program from Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The controller for users in the EU/EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’).

This means that we place Google Ads and also use Google Remarketing and Conversion Tracking. The ads are displayed on websites in the Google advertising network based on search queries. We also use Ads remarketing lists for search ads. This allows us to customize search ad campaigns for users who have visited our website before. The services enable us to combine our ads with certain search terms or to display ads for previous visitors in which, for example, services that the visitors have viewed on our website are advertised. This means that we can display interest-based advertising to users of our website on other websites within the Google advertising network (as a ‘Google ad’ in the context of a Google search or on other websites).

An analysis of online user behavior is necessary for interest-based offers. Google uses cookies to carry out this analysis. When you click on an advert or visit our website, Google sets a cookie on your computer. These cookies have a lifespan of 90 days. The information collected by means of the respective cookies is used to be able to address the visitor specifically in a later search query. Further information on the cookie technology used can be found in Google's notes on website statistics and in the data protection regulations, as well as our Cookie Policy. With the help of this technology, Google and we as a customer receive information that a user has clicked on an ad and been redirected to our web pages. The information obtained in this way is used exclusively for statistical evaluation to optimize advertising. We do not receive any information that can be used to personally identify visitors. Your IP address is transmitted to Google, but it is anonymized because we use Google's IP masking on this website as part of our use of Google Analytics. The statistics provided to us by Google include the total number of users who have clicked on one of our ads and, if applicable, whether they were redirected to a page of our website that has a conversion tag. These statistics help us to understand which search terms were clicked on our ad particularly often and which ads led to a user contacting us via the contact form.

Insofar as data is processed outside the EEA, where there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish a secure level of data protection. Google has also joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. Data transfers to the USA are thus secured in accordance with Art. 45 GDPR.

You can find more information about data protection in the context of Google Ads at: https://policies.google.com/technologies/ads?hl=en 

If you do not want the processing, you can prevent the cookies required for these technologies from being stored, for example, by changing your browser settings. In this case, your visit will not be included in the user statistics
.
You can also use the ad settings ( https://adssettings.google.com/authenticated?hl=en ) to select the types of Google ads or to disable interest-based ads on Google. Alternatively, you can disable the use of cookies by third parties by accessing the opt-out tool of the Network Advertising Initiative ( https://optout.networkadvertising.org/?c=1 ) .

However, we and Google will continue to receive statistical information about how many users have visited this page and when. If you do not want to be included in these statistics either, you can prevent this by usin g additional programs for your browser (e.g. the Privacy Badger add-on).

The legal basis for this data processing is your consent, Art. 6 (1) p. 1 lit. a GDPR and, if you are located in Germany, pursuant to § 25 Sec. 1 TDDDG. You can revoke your once made consent at any time with effect for the future by accessing the cookie settings on our consent management platform (‘Change cookie settings’ at the bottom of the page) and changing your selection there.

8.3    Google Analytics
If you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Google Analytics 4 uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.

We use the User ID function. User ID allows us to assign a unique, persistent ID to one or more sessions (and the activities within those sessions) and to analyse user behavior across devices.

We use Google Signals. This allows Google Analytics to collect additional information about users who have personalized ads enabled (interests and demographics) and ads can be delivered to these users in cross-device remarketing campaigns.

Google Analytics 4 has IP anonymization enabled by default and we make use of this feature . Due to IP anonymization, your IP address will be shortened by Google within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. According to Google, the IP address transferred by your browser as part of Google Analytics will not be merged with other Google data.

During your website visit, your user behavior is recorded in the form of "events". Events can be:
•    page views,
•    first visit to the website,
•    start of session,
•    web pages visited,
•    your "click path", interaction with the website,
•    scrolls (whenever a user scrolls to the bottom of the page (90%)),
•    clicks on external links,
•    internal search queries,
•    interaction with videos,
•    file downloads,
•    seen or clicked ads.

Also may be recorded:
•    Your approximate location (region),
•    date and time of your visit,
•    your IP address (in shortened form),
•    technical information about your browser and the end devices you use (e.g. language setting, screen resolution),
•    your internet service provider and
•    the referrer URL (via which website/advertising medium you came to this website).

On behalf of the operator Google will use this information to evaluate your pseudonymous or user_id use of the website and to compile reports on website activity. The reports provided by Google Analytics 4 serve to analyse the performance of our website and the success of our marketing campaigns.

Recipients of the data are/may be:
-    Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor under Art. 28 DSGVO). We have concluded a data processing agreement with Google for this purpose;
-    Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA;
-    and, if applicable, US authorities can access the data stored by Google.

Transfer of data in the USA is possible. For the USA, the European Commission adopted a news adequacy decision on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider to establish an appropriate level of data protection in those countries.

The data sent by us and linked to cookies are automatically deleted after 12 months.  The maximum lifespan of Google Analytics cookies is 2 years. The deletion of data whose retention period has been reached occurs automatically once a month.

The legal basis for this data processing is your consent pursuant to Art. 6 (1) p.1 lit. a GDPR and § 25 (1) p.1 TDDDG. You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, and the processing of this data by Google, by not giving your consent to the setting of the cookie.

For more information on Google Analytics' terms of use and Google's privacy policy, please visit https://policies.google.com/terms?hl=en and at https://policies.google.com/?hl=en. 

8.4    Google reCaptcha 
We use reCaptcha v2 on our websites. reCaptcha is a service provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The responsible body for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

ReCaptcha is used to prevent abusive automated entries in web forms and thus to protect the technical systems of the hoster.

When you visit one of our websites in which reCaptcha is integrated, a connection to the Google servers is established. A reCaptcha cookie is set. Your IP address is transmitted to Google.

In addition, reCaptcha uses ‘fingerprinting’ to collect the following data:
•    browser plugins used,
•    cookies set by Google in the last 6 months,
•    the number of mouse clicks and touches you have made on this screen,
•    CSS information for the page accessed,
•    Javascript objects,
•    the date and
•    the browser language.

You can prevent the storage of cookies and fingerprinting by selecting the appropriate technical settings on your browser software; however, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent.
Insofar as data is processed outside the EEA, where there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish a secure level of data protection.
You can find Google's privacy policy and terms of service here: https://www.google.com/policies/privacy/ and here: https://policies.google.com/terms. 

The legal basis for this data processing is your consent, Art. 6 (1) p. 1 lit. a) GDPR and § 25 (1) p. 1 TDDDG. You can revoke your consent at any time with effect for the future by opening the data protection settings at the bottom left (‘shield’) and moving the slider there accordingly. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

8.5    Microsoft (Bing) Ads
We use Bing Ads (a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA) to draw attention to our services. These ads appear in the Bing, Yahoo! and MSN search engines after searches are conducted via the Yahoo!-Bing network. This also allows us to combine our ads with certain search terms, thereby ensuring that we are present on all major search engines.

Bing Ads also uses cookies to analyze user behavior. When a user clicks on an ad or visits our website, a cookie is set by Bing Ads on the user's computer, provided that the user's consent has been documented. This information is used to enable the visitor to be addressed specifically in a subsequent search query. Further information can be found in Microsoft's privacy policy and in the data security guidelines and privacy policy.

In addition, we use Bing Ads Conversion Tracking as part of Bing Ads to show you interest-based advertising. This requires an analysis of user behavior. We only receive information from Bing about the fact that a user has clicked on an ad and been redirected to our websites. We use the information obtained in this way exclusively for statistical evaluation to optimize our ads. We are not able to identify the visitor based on the data collected. The statistics provided to us by Bing include the total number of users who clicked on one of our ads. We also receive information about whether these visitors were redirected to a page of our website that had a conversion tag. These statistics help us to understand which search terms were clicked on most often in our ad and which ads led to users contacting us via the contact form. The purpose of Bing Ads Conversion Tracking is to show you interest-based advertising, to make our website more interesting for you and to achieve a more economical assessment of our advertising costs.

Information on the duration of storage can be found at: https://privacy.microsoft.com/privacystatement. 

Insofar as data is processed outside the EU/EEA, we have concluded the standard data protection clauses adopted by the EU Commission in accordance with Art. 46 GDPR, which allow the transfer of personal data to a third country in individual cases. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level on the basis of an adequacy decision by the European Commission.

The legal basis for the data processing described is your consent, § 25 (1) p 1 TDDDG, Art. 6 (1) p. 1 lit. a GDPR. You can revoke consent that you have given at any time with effect for the future by changing your selection in the cookie settings (see above, section 7. Cookies). Alternatively, you can delete your cookies (all cookies or just those from this website). The banner with the options will then be displayed again.
You can also disable interest-based ads on Bing via the ad settings.

8.6    Clarity
We use the tool "Microsoft Clarity" from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA on our website. The controller for users in the EU/EEA is Microsoft Ireland Ltd. One Microsoft Place, South County Business Park, Carmanhall and Leopardstown, Dublin, D18 P521, Irland. Microsoft Clarity is a so-called screen recording tool, which records the activities of a user on our websites during a session and processes them for us in a comprehensible way. The recording and evaluation of website activities serves to improve the user-friendliness of our websites and helps with troubleshooting.

In addition, your personal data is processed for the following purposes:

•    Tracking (e.g. interest/behavior-based profiling, use of cookies)
•    Remarketing and conversion measurement (measuring the effectiveness of marketing measures)
•    Interest-based and behavioral marketing
•    Profiling (creation of user profiles)
•    Reach measurement (e.g. access statistics, recognition of returning users)
•    Cross-device tracking (processing of user data across devices for marketing purposes).
•    Creating behavioral patterns, heat maps and session recordings.

While using Microsoft Clarity, various personal information is collected. This concerns in particular:

•    Usage data (e.g. Internet presentations visited, interest in content, access times)
•    Meta/communication data (e.g. information about page views, UserID, SessionID)
•    Location data (information about the geographical position of a device),
•    Analytics data (information about user interactions on the website, e.g. clicks, scrolls, mouse movements)
•    Diagnostic data, e.g. script and image errors, faulty interactions with buttons (deadclicks).

Click data is stored for up to 12 months.

Further information on the information collected can be found at the following website: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data 

Data processing is carried out by Microsoft Corporation, which is based in the USA. Microsoft Corporation is certified according to the Data Privacy Framework, so that for data transfers to Microsoft Corporation an adequacy decision of the European Commission in the sense of Art. 45 DSGVO is available. The status of the certification can be accessed via the following website: https://www.dataprivacyframework.gov/s/. 

The legal basis for the processing of your personal data for the specified purposes is your consent (§ 25 (1) p. 1 TDDDG and Art. 6 (1) p. 1 lit. a GDPR). You can revoke your consent at any time with effect for the future. To revoke your consent, you can simply adjust your cookie settings accordingly via our privacy policy [set link]. You can also revoke your consent for data processing to Microsoft at any time: https://account.microsoft.com/privacy/ad-settings/signedout 

The data is also transmitted to Microsoft. We would like to point out that Microsoft sees itself as its own controller here. Microsoft may process your personal data for its own purposes, e.g. for product improvement and advertising purposes. We do not know which data is processed for which specific purposes. We have no influence on this.

Further information on how the tool works can be found on the following website: https://clarity.microsoft.com/. For information on how Microsoft processes personal data, please refer to Microsoft's privacy policy: https://privacy.microsoft.com/privacystatement. 

8.7    LinkedIn Ads
If you have given your consent, we use the online marketing tool LinkedIn Ads from LinkedIn Corporation, 599 N Mathilda Ave, Sunnyvale, CA 94085, USA. The responsible service provider in the EU is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

For this purpose, we use the LinkedIn Campaign Manager to define target user groups based on certain characteristics, who will subsequently be shown advertisements within the LinkedIn network. Users are selected by LinkedIn based on the profile information they provide and other data provided when using LinkedIn. If a user clicks on an ad and then visits our website, LinkedIn receives information via the conversion tag embedded on our website that the user clicked on the ad.

The LinkedIn tag thus enables the collection of information about visited websites, including the URL, referrer ID, IP address, device and browser properties, and timestamp. The IP addresses are shortened or hashed (if used across devices) by LinkedIn. LinkedIn stores the data in accordance with its own guidelines, over which we have no direct influence. The members' direct identifiers are removed within seven days in order to pseudonymize the data. This remaining pseudonymized data is then deleted within 180 days. You can find even more information on this at: https://www.linkedin.com/help/linkedin/answer/a427660/?lang=en-US. 

The LinkedIn pixel allows us to show personalized ads outside of our website without identifying individual members. It also uses data that does not identify you to improve ad relevance and reach LinkedIn members across devices. LinkedIn members can control the use of their personal data for advertising purposes through their account settings. LinkedIn refers to the following link for customizing advertising preferences: https://www.linkedin.com/psettings/advertising/actions-that-showed-interest. 

It is possible that the LinkedIn Corporation has access to your data, i.e. that your personal data could also be transferred to servers in the USA and processed there. The USA is considered an unsafe third country under data protection law, where there is no level of data protection comparable to that in the EU.
The LinkedIn Corporation has certified itself in accordance with the EU-US Data Privacy Framework (DPF). This means that the company has publicly committed to complying with the DPF obligations. This means that data transfer to the USA is already secured on the basis of the current adequacy decision of the European Commission in accordance with Art. 45 GDPR. According to LinkedIn's own information on its website, standard contractual clauses (SCC) are used for data transfers from the EU/EEA to the USA and other countries. LinkedIn also provides a Data Processing Agreement, which becomes part of the contractual terms by reference. This includes, among other things, the SCC in accordance with Art. 46 GDPR to secure data transfers to third countries, in particular to the LinkedIn Corporation in the USA.

We process this data to evaluate our advertising campaigns.
Further information about the purpose and scope of the data collection and the further processing and use of the data by LinkedIn, as well as your settings options for protecting your privacy, can also be found in LinkedIn's data protection declaration.

Further information about LinkedIn Conversion Tracking can be found at: https://business.linkedin.com/marketing-solutions/conversion-tracking?ss=1.   
Further information on data processing and storage duration can be found at https://www.linkedin.com/help/linkedin/answer/a427660/?lang=en-US. 

The data collected as part of LinkedIn tracking is stored by us only for as long as necessary to achieve the stated purposes, and generally no longer than 12 months. In individual cases, a longer retention period may apply, for example for campaign analysis or to comply with legal obligations. After the retention period expires, the data is either deleted or anonymized in such a way that no personal reference is possible. Aggregated, anonymized data may be retained for a longer period to improve the effectiveness of future campaigns.

The legal basis for this data processing is your consent, Art. 6 (1) p. 1 lit. a) GDPR and § 25 (1) p. 1 TDDDG. You can revoke your consent at any time with effect for the future by opening the data protection settings (“Website Cookies”) and making the appropriate changes there.

8.8    Marketing Cloud Account Engagement (formerly Pardot)
We use Salesforce Marketing Cloud Account Engagement  (in short MCAE and formerly known as Pardot), a marketing automation tool provided by Salesforce.com Inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA.

The scope of the processing is to manage, automate and analyze our marketing and sales activities . The marketing platform uses persistent cookies and assigns cookie IDs  to individual users for this purpose in order to process and analyze the user behavior of our website visitors and to be able to display advertising in line with user behavior. The analysis is carried out across all devices.

This tool collects, stores and evaluates personal data such as 
-    IP-adress
-    interaction data based on user behavior (e.g., clicked content, form submissions).

Access to data stored in Salesforce is restricted to: 
-    Authorized entities within the Questel-Group,
-    And contracted agencies who access Salesforce as part of their work on our behalf. Other agencies do not have access.

If you have given your consent to the Salesforce cookies, your data collected will also be transferred to the USA and analyzed there. Salesforce is certified under the Data Privacy Framework (DPF) and is listed in the Data Privacy Framework list of the International Trade Administration (ITA), ensuring an adequate level of protection under Art. 45 GDPR. 
As Salesforce servers are distributed worldwide and a transfer to other third countries cannot be completely ruled out without an adequacy decision, we have also concluded the EU standard contractual clauses  with the provider. In addition, Salesforce has binding internal data protection regulations within the meaning of Art. 47 GDPR, so-called binding corporate rules. You can find out more about data transfer by Salesforce here: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/data-transfer-mechanisms-FAQ.pdf. 

We only store your data for as long as is necessary for the stated purposes. The persistent cookie with your user ID (visitor_id) is stored for 90 days and will then be deleted from your device.

The legal basis for this data processing is your consent, Art. 6 (1) p. 1 lit. a) GDPR and § 25 (1) p. 1 TDDDG. You can revoke your consent at any time with effect for the future.

For more information on Salesforce Privacy Policy, please visit https://www.salesforce.com/company/privacy/ 

8.9    Claspo 
We use the Claspo widget platform, a service offered by Claspo Inc., 3524 Silverside Road, Suite 35B, Wilmington, DE 19810, USA (“Claspo”). 

Claspo enables us to create and display interactive elements on our website, such as pop-ups that allow users e.g. to sign up for webinars or subscribe to newsletters.

When you interact with a Claspo pop-up or form (e.g., by entering your email address to register for a webinar), a tracking script collects and transmits certain data to Claspo’s servers.
The data transmitted to Claspo includes:
-    Email address or contact details, if submitted via a form
-    Geolocation data, derived from the IP address for content targeting
-    Click and interaction data, such as impressions, form submissions, and widget engagement

This data is transmitted to and stored on Claspo’s servers, which may be located in the United States or other countries outside the European Economic Area (EEA). According to Claspo, data is retained only for as long as necessary to fulfill the purposes described above and is deleted or anonymized upon request in accordance with the controller’s instructions. Some data may be retained longer for technical troubleshooting or performance analysis.

Please note that the data may be processed in countries that do not provide a level of data protection equivalent to the European Union. If personal data is transferred to such third countries, Claspo applies appropriate safeguards such as Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR. Claspo acts as a data processor on our behalf under a Data Processing Agreement (DPA).

Although Claspo collects and processes the data listed above, we only have access to the information you actively submit to us via forms. This data is stored for up to 12 months  after submission, unless a longer retention period is necessary to fulfill a contractual relationship (e.g. for webinar participation, follow-up communication or documentation purposes). After that, the data is deleted or anonymized unless legal retention obligations require otherwise

The legal basis for this data processing is your consent, Art. 6 (1) p. 1 lit. a) GDPR and § 25 (1) p. 1 TDDDG. You can revoke your consent at any time with effect for the future by opening the data protection settings (“Website Cookies”) and making the appropriate changes there.

8.10    Zapier 
We use Zapier, a service offered by Zapier Inc., 548 Market St. #62411, San Francisco, CA 94104-5401, USA (“Zapier”), to automate the transfer of data between different systems we use for marketing and sales operations.

Zapier is not directly connected to our website and does not collect personal data from website visitors. Instead, Zapier is used as a connector between our CRM system and platforms such as Google Ads or LinkedIn Ads. This allows us to measure the effectiveness of our ad campaigns beyond simple click data. The further use of this data for interest-based advertising and campaign optimization is carried out within Google Ads and is described in the corresponding section of this privacy policy.

The data transmitted through Zapier may includes: 
-    Google Click ID (GCLID) to associate a conversion with a specific ad interaction
-    Opportunity or lead status information such as the type of conversion (e.g. demo request, signup), campaign assignment or creation timestamp
-    Additional data (e.g. email addresses)

All data processed via Zapier originates from our internal systems and is fully accessible to us. Zapier processes this data solely on our behalf and does not use it for its own purposes.

Zapier processes data in the United States. It has certified itself in accordance with the EU-US Data Privacy Framework (DPF). This means that the company has publicly committed to complying with the DPF obligations. This means that data transfer to the USA is already secured on the basis of the current adequacy decision of the European Commission in accordance with Art. 45 GDPR. In addition, according to Zapier’s own information, data transfers from the EU/EEA to the United States are secured by Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR. Zapier provides a Data Processing Addendum (DPA ) which forms part of its contractual terms. These clauses serve as safeguards for the protection of personal data transferred to third countries, in particular to Zapier Inc. in the United States.

The legal basis for this processing is our legitimate interest pursuant to Art. 6 (1) p. 1 lit. f GDPR, in accurately measuring and optimizing our advertising campaigns. The data is not collected via cookies or tracking technologies on our website but instead transferred from internal systems via server-side workflows. Any further data processing within Google Ads or LinkedIn Ads is governed by the respective sections of this privacy policy.

For further information on Zapier's data protection practices, you can refer to their Data Privacy Overview: https://zapier.com/legal/data-privacy.

8.11    Adroll 
We use the retargeting technology “AdRoll” from the provider NextRoll Inc. based at 2300 Harrison Street, Floor 2, San Francisco, CA 94110, United States on this website.

This enables us to target users who have already shown an interest in a particular or similar product on our website with advertising. In retargeting, advertising material is displayed on the basis of a cookie-based analysis of previous user behavior. This means that the user is likely to see advertising that matches their product and information interests.

The following data is being collected and processed by NextRoll:
•    page views,
•    first visit to the website,
•    start of session,
•    web pages visited,
•    your "click path", interaction with the website,
•    scrolls (whenever a user scrolls to the bottom of the page (90%)),
•    clicks on external links,
•    internal search queries,
•    interaction with videos,
•    file downloads,
•    seen or clicked ads.

Also may be recorded:
•    Your approximate location (region),
•    date and time of your visit,
•    your IP address (in shortened form),
•    technical information about your browser and the end devices you use (e.g. language setting, screen resolution),
•    your internet service provider and
•    the referrer URL (via which website/advertising medium you came to this website).

The data is also processed within the USA and thus outside the European Economic Area. For the USA, the European Commission adopted its sectoral adequacy decision on July 10, 2023. This means that only data transfers to US companies that have certified themselves under the EU-US Data Privacy Framework (DPF) are considered unobjectionable. NextRoll has not currently made a public commitment to comply with the DPF obligations. Therefore, we have concluded EU standard contractual clauses with the service provider to establish an adequate level of data protection and have taken additional measures, such as the encryption and anonymization of data.

Your data collected by NextRoll will be deleted after 12 months.

Further information and the data protection provisions of the “NextRoll” service can be viewed here: https://www.nextroll.com/privacy.  

Data collection and storage only takes place after express consent has been given in accordance with Art. 6 (1) p. 1 lit. a) GDPR and § 25 (1) p. 1 TDDDG. This can be revoked at any time with effect for the future.

This processing includes profiling, which enables us to show users personalized advertising based on their previous interactions with our website.

8.12    GoToWebinar
We use the webinar platform GoToWebinar, a service provided by GoTo Technologies Ireland Unlimited Company, with its registered office at 77 Sir John Rogerson’s Quay, Block C, Suite 207, Grand Canal Docklands, Dublin 2, D02 VK60, Ireland, for hosting online events and webinars.

Participants register for webinars via dedicated GoToWebinar registration pages. The data entered on those pages is collected directly by the service provider and made available to us as the organizer for further processing. The data is processed for the purposes of registration and participation for webinars, sending confirmation, reminder and follow-up emails, providing access to webinar content (live and/or recorded), follow-up communication where relevant.

This typically includes:
-    First and last name
-    E-Mail address
-    Depending on the registration form: Company name, job title, country

GoToWebinar also provides technical hosting of the webinar and delivers service-related communication on our behalf. All data submitted during the registration process is stored by GoToWebinar and is accessible both to us and to the provider.
It’s possible that GoTo Technologies may process personal data on servers located outside the European Economic Area, including in the United States. In such cases, appropriate safeguards are in place. GoTo Technologies has certified itself under the EU-U.S. Data Privacy Framework (DPF), which provides an adequacy decision by the European Commission pursuant to Art. 45 GDPR. Additionally, GoTo Technologies uses Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR to provide additional safeguards for internation data transfers.

A Data Processing Addendum (DPA forms part of the contractual relationship between us and GoTo Technologies.

The data collected via GoToWebinar will be deleted after fulfilling the purposes described above. Typically, this includes a retention period of up to 12 months  after the webinar has taken place, unless a longer retention period is required for documentation, follow-up communication, or legal obligations.

Data collection and storage only takes place after express consent has been given in accordance with Art. 6 (1) p. 1 lit. a) GDPR and § 25 (1) p. 1 TDDDG. This can be revoked at any time with effect for the future.

For more information on how GoToWebinar handles data, please refer to:
https://www.goto.com/company/legal/privacy/us, 

8.13    SEMRush
We use the analytics and SEO platform SEMRush, a service provided by Semrush Inc., 800 Boylston Street, Suite 2475, Boston, MA 02199, United States, in order to monitor and improve the visibility and performance of our websites in search engines.

SEMRush is not directly integrated into our website and does not set cookies or track users on our site itself. Instead SEMRush is connected to out Google Analytics 4 (GA4) account, which allow it to retrieve traffic data and other metrics related to website visits. Through this connection, we gain insights into organic search behavior, such as:
-    Which Google searches our websites appear in and at what position
-    Which keywords drive traffic to our website
-    Where our competitors rank in comparison
-    In which search queries competitors appear, but we do not

The data provided via SEMRush is based on anonymized, aggregated information from connected analytics tools such as GA4. SEMRush does not process any personally identifiable information of website users on our behalf and does not have independent access to website visitor’s data.

Personal data is not transferred to SEMRush as part of this setup. However, SEMRush Inc. is based in the US. Where processing of any data relevant under data protection law occurs, we rely on Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR as safeguards for any potential international data transfers.
SEMRush also provides a Data Processing Agreement (DPA) as part of its terms with business customers.

The legal basis for the processing of any connected traffic data through SEMRush is out legitimate interest in understanding and improving our website performance and online visibility, pursuant to Art. 6 (1) p. 1 lit. f GDPR.

For more information on how SEMRush processes data, please refer to:
https://de.semrush.com/company/legal/privacy-policy/ 
 

The following privacy rights are available to all individuals. The rights may differ based upon local data protection laws. Please contact us through [email protected] if you have further questions about your privacy rights.

• Right to information on the processing of your Personal Data. Questel endeavors to provide you with concise, comprehensible, and easily accessible information in clear and simple terms about how your Personal Data are processed.
• Right of access of your Personal Data. The right of access enables you to obtain confirmation from Questel that your Personal Data are or are not processed, and where they are, to access them or obtain a copy of them.
• Right to rectification of your Personal Data. You may request that we correct inaccurate Personal Data we hold about you. You may also have the right to have incomplete Personal Data completed.
• Right to restriction of processing your Personal Data. You may ask us to restrict further processing your Personal Data.
• Right to erasure. The right, under certain conditions, to have the Personal Data erased or deleted, unless Questel has a legitimate interest in keeping it. Subject to the exceptions under the applicable law (e.g. retention of data necessary to comply with a legal obligation), you are entitled to request Questel to erase your Personal Data as soon as possible, where one of the following grounds applies:

             -the Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed;

             -you wish to withdraw your consent where that consent was the basis for processing your Personal Data when there is no other basis justifying that processing;

             -You wish to object to the processing of your Personal Data for direct marketing purposes;

             -You believe your Personal Data have been processed unlawfully;

             -Your Personal Data must be erased pursuant to a legal obligation.

• Right to personal data portability. The right to request that Personal Data be transmitted in a reusable format that allows it to be used in another database.
• Right to object to the processing of personal data for reasons related to your particular situation (under conditions).
• Right to withdraw consent to the processing of personal data. Where Questel processes your Personal Data based on your consent, you can withdraw that consent at any time using the means made available to you for that purpose. Under the applicable law, however, withdrawing your consent is not retrospective and cannot therefore affect the lawfulness of processing carried out before the withdrawal.
• Right to define post-mortem directives. The right to define directives concerning the fate of Personal Data after your death is granted under French law and applies only to individuals residing in France.
• Right to make a complaint to a supervisory data protection authority. If, notwithstanding Questel's efforts to keep your Personal Data confidential, you believe that your rights have not been complied with, you have a right to lodge a complaint to the Data Protection Authority, ie for France: CNIL, 3 Place de Fontenoy – TSA 80715 – 75334, PARIS CEDEX 07, France

You can email [email protected] specifying in the subject line of the email "Data subject rights". Upon receiving your request, we will first verify your identity by matching the information you provide (including your name, email address, and phone number) with what we have on file for you. We may ask you for additional information to verify your identity or to comply with your request. We will complete your request in the timeline prescribed by the applicable privacy laws.

Depending on where you are located or where you reside, you may have certain rights granted to you over your personal data under local data protection laws. 

Responding to your requests. Questel undertakes to respond promptly, and in any event within the specific timeframe required by the laws applicable to personal data about you. When necessary, that period may be extended, having regard for the number and complexity of the request you sent. Where that occurs, you will be informed of that extension and the reasons for it.