Privacy Policy

Last updated: February 27, 2026
Version: 2.2


for the websites:

  • hummel-engineering.de
  • qubeec.de
  • qubeec.com
  • qubeec.app

1. Data Protection at a Glance

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you could be personally identified. Detailed information can be found in the following chapters.

Who is responsible for data collection on this website?

Data processing is carried out by the website operator. You can find their contact details below and in the Imprint of this website.

How do we collect your data?

Your data is collected on the one hand when you provide it to us via email. Other data is collected automatically by our IT systems when you visit the website (e.g., technical data such as browser, operating system, time).

What do we use your data for?

  • To provide and optimize the website
  • To process your inquiries
  • To fulfill legal obligations
  • To provide services upon order placement

What rights do you have regarding your data?

You have the right to free information, correction, deletion, restriction, and data portability at any time, as well as the right to lodge a complaint with a supervisory authority.

2. Responsible Entity

AttributeValue
NameDipl.-Ing. Quirin Hummel
ActivityFreelance Consultant and Coach, Graduate Engineer in Mechanical Engineering
BrandsHummel Engineering, qubeec
AddressAm Elzufer 9b, 79183 Waldkirch, Germany
Phone+49 (0) 179 9487713
Emailweb@qubeec.com

Data Protection Officer: Due to the size of the company, an appointment is not required. Please contact the above contact details directly with any questions.

3. General Information on Data Processing

We process your data exclusively within the framework of the applicable data protection regulations (GDPR, BDSG, Digital Services Act, EU AI Act).

Processing Purposes:

  • Provision and operation of the website
  • Communication and processing of inquiries
  • Provision of consulting services
  • Fulfillment of legal requirements

Legal Bases:

  • Art. 6 (1) lit. a GDPR (Consent)
  • Art. 6 (1) lit. b GDPR (Performance of a contract/pre-contractual measures)
  • Art. 6 (1) lit. c GDPR (Legal obligation)
  • Art. 6 (1) lit. f GDPR (Legitimate interest)

4. Hosting and Technical Provision

Web Hosting

AttributeValue
Providernetcup GmbH
AddressEmmy-Noether-Straße 10, 76131 Karlsruhe, Germany
Websitehttps://www.netcup.com
Legal BasisArt. 6 (1) lit. f GDPR (Technical operation)
DPAAvailable (Art. 28 GDPR)
Third-Country TransferNone (Servers in Germany)

Domain Hosting

AttributeValue
ProviderPorkbun LLC
Address21370 SW Langer Farms Parkway, Suite 142-429, Sherwood, OR 97140, USA
Websitehttps://porkbun.com
Legal BasisArt. 6 (1) lit. b GDPR (Performance of a contract)
Third-Country TransferUSA (Standard Contractual Clauses)

Processed Data (Server Log Files):

  • IP address (anonymized)
  • Date/time of access
  • Pages accessed
  • Referrer URL
  • Browser data
  • Operating system
  • Internet provider

Storage Duration: 30 days

SSL/TLS Encryption: For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

5. Contacting Us

If you contact us by email (e.g., at web@qubeec.com), we collect:

  • Name
  • Email address
  • Message content
  • Time

Purpose: Processing your inquiry/communication and consulting purposes

Legal Basis: Art. 6 (1) lit. b (pre-contractual/contractual) or lit. f GDPR (Contacting)

Storage Duration: Max. 3 years after completion, provided there is no contractual relationship. For contracts: Storage according to statutory retention obligations up to 10 years.

Data Transfer: Only occurs with your consent or if legally required.

6. Use of Cookies

Technically necessary cookies (session management, security):

  • Legal basis: Legitimate interest (Art. 6 (1) lit. f GDPR)
  • Duration: Session

Analysis and marketing cookies are not used on this website.

You can disable cookies in your browser. This may restrict functionality.

7. Web Analysis

No web analysis (e.g., Google Analytics) takes place.

8. Email Communication

AttributeValue
ProviderMicrosoft 365
OperatorMicrosoft Ireland Operations Limited, Dublin/Ireland & Microsoft Corp., USA
DPAAvailable (Art. 28 GDPR)
Third-Country TransferUSA (EU-US Data Privacy Framework)

9. Video Conferencing Tools

For online consulting and virtual meetings, we use:

Microsoft Teams

AttributeValue
ProviderMicrosoft Corporation
AddressOne Microsoft Way, Redmond, WA 98052-6399, USA
Third-Country TransferUSA (EU-US Data Privacy Framework)

Zoom

AttributeValue
ProviderZoom Video Communications, Inc.
Address55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA
Third-Country TransferUSA (EU-US Data Privacy Framework)

Processed Data: Name, email address, IP address, audio/video/text data

Recordings: If meetings are to be recorded, this will only be done with prior express consent and announcement; the fact of the recording will be displayed immediately visibly.

10. Appointment Booking (optional)

AttributeValue
ProviderMicrosoft Bookings (Microsoft Corporation)
Processed DataName, email, appointment details
Third-Country TransferUSA (EU-US Data Privacy Framework)

Appointment booking legal basis: Art. 6 (1) lit. b GDPR (pre-contractual/contractual measures)

Processed Data: Name, email address, phone number, purpose of the meeting request

11. Newsletter (optional)

If you register for our newsletter, we process your email address for the purpose of sending the newsletter.

  • Registration Procedure: Double-Opt-In
  • Legal Basis: Art. 6 (1) lit. a GDPR (Consent)
  • Revocation: You can revoke your consent at any time (e.g., via the unsubscribe link in the newsletter)

12. AI-Generated Content and EU AI Act

AttributeSystems Used
Text OptimizationOpenAI, Manus, Claude (Anthropic)
IllustrationsOpenAI, Manus, Midjourney, nanobanana
TranslationsOpenAI, Manus, DeepL

Data Protection: Personal data of website visitors is not processed for AI purposes.

Automated Decision-Making: There is no automated decision-making or profiling.

Compliance: Use is in accordance with the principles of the GDPR and taking into account the EU AI Act.

Third-Country Transfer: Data transfers may occur to the USA or other third countries. The respective guarantees (EU-US Data Privacy Framework or Standard Contractual Clauses) are listed in Section 15.

13. Social Media and External Content

Social media plugins or tracking are not used.

External fonts (e.g., Google Fonts) are hosted locally.

14. Order Processing and Third-Party Providers

The provision of our services involves the use of carefully selected external services. We distinguish between providers who process personal data on our behalf and those we use exclusively for internal purposes without processing customer data.

14.1 Data Processors (with DPA pursuant to Art. 28 GDPR)

Data Processing Agreements (DPA) that meet the requirements of Art. 28 GDPR exist with the following providers:

Service ProviderPurposeLocationThird-Country TransferBasis
netcup GmbHWeb HostingGermanyNoneDPA pursuant to Art. 28 GDPR
Porkbun LLCDomain HostingUSAUSA (SCCs)DPA in GTC
Microsoft CorporationEmail, Teams, BookingsUSA/IrelandUSA (EU-US Data Privacy Framework)Microsoft DPA
Zoom Video Communications, Inc.Video ConferencesUSAUSA (EU-US Data Privacy Framework + SCCs)Zoom DPA
Anthropic Ireland, LimitedAI Text Processing/Coding (Claude)IrelandUSA (SCCs)Anthropic DPA
n8n GmbHProcess AutomationGermanyNone (EU Servers)Individual DPA
OpenAIAI Text Optimization; ResearchUSAUSA (EU-US Data Privacy Framework)OpenAI DPA

14.2 Independently Used Services (no customer data)

The following services are used exclusively for internal purposes — no personal data of customers or website visitors is processed or transmitted:

Service ProviderPurposeLocationNote
Perplexity AI, Inc.Research and Information GatheringUSANo customer data; use as an independent service
Midjourney LLCCreation of IllustrationsUSANo customer data; purely internal image generation
Butterfly Effect Pte. Ltd. (Manus.im)AI AssistanceSingaporeNo customer data; internal use
nano bananaPresentation CreationChinaNo customer data; internal use
DeepL SETranslationGermanyNo customer data; purely internal use for own texts

All mentioned providers have been checked for their data protection practices. If you have any questions about data processing by these services, please contact us at web@qubeec.com.

15. International Data Transfers

Transfers to the USA

For transfers to the USA, we use the following guarantees:

  • EU-US Data Privacy Framework (DPF) – for certified companies
  • Standard Contractual Clauses (SCCs) of the EU Commission
  • Additional protective measures (encryption, pseudonymization)

Affected Services

ServiceGuarantee
Microsoft 365 / Teams / BookingsDPF-certified
ZoomDPF-certified
OpenAIDPF-certified
Anthropic (Claude)Standard Contractual Clauses (SCCs)
PorkbunStandard Contractual Clauses (SCCs)
Perplexity AIDPF-certified + SCCs
Midjourney LLCStandard Contractual Clauses (SCCs)

Transfers to Singapore

For the use of Manus.im (Butterfly Effect Pte. Ltd.), data may be transferred to Singapore. This transfer is secured by Standard Contractual Clauses (SCCs) of the EU Commission.

16. Data Processing in the Context of Consulting Services

Data collected within the consulting relationship:

  • Name, contact details, communication content
  • Company data (company name, industry, organizational structure)
  • Analysis data (potential analyses, strategy development)
  • Project results and documentation

Purposes of data processing:

  • Provision of the agreed consulting services
  • Quality assurance and follow-up
  • Fulfillment of contractual obligations
  • Proof of proper service provision

Legal Basis: Art. 6 (1) lit. b GDPR (Performance of a contract)

Storage Duration: For the duration of the consulting relationship plus statutory retention periods (up to 10 years)

17. Reporting of Data Breaches

In the event of data breaches, we inform:

  • The competent supervisory authority within 72 hours
  • Affected persons immediately if there is a high risk

We have implemented an Incident Response Plan to respond appropriately to data breaches and minimize damage.

18. Your Rights as a Data Subject

  • Right to information (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Revocation of consent (Art. 7 (3) GDPR)

Right to lodge a complaint with the supervisory authority:

AttributeValue
AuthorityState Commissioner for Data Protection and Freedom of Information Baden-Württemberg
AddressLautenschlagerstraße 20, 70173 Stuttgart
P.O. Box10 29 32, 70025 Stuttgart
Phone0711 / 615541-0
Emailpoststelle@lfdi.bwl.de
Websitewww.baden-wuerttemberg.datenschutz.de

19. Storage Duration

Data TypeStorage Duration
Contact inquiries3 years after completion
Contract data10 years after end of contract
Website access (log files)30 days
CookiesSession

Personal data will be deleted as soon as it is no longer required for the purposes or if there are no statutory retention obligations preventing deletion.

20. Security of Your Data

We use comprehensive technical and organizational measures to protect your data:

Technical Measures:

  • SSL/TLS encryption
  • Firewall, regular updates
  • Encrypted data storage
  • Two-factor authentication
  • Regular backups

Organizational Measures:

  • Access controls
  • Confidentiality obligations
  • Data security audits
  • Incident Response Plan

21. Changes

This policy will be updated in the event of technical, legal, or content-related changes.

Notification: In the event of significant changes, we will inform you via a notice on the website.

The current version can always be found on our website.

22. Contact

For data protection inquiries, please contact:

Email: web@qubeec.com, Subject: "Data Protection"

Processing Time: We will process your request within 30 days.

Identity Verification: For requests for information, we may require identity verification to prevent misuse.

This Privacy Policy has been prepared with the utmost care. However, no guarantee can be given for the completeness, correctness, and topicality of the information. This Privacy Policy does not constitute legal advice and cannot replace such advice.