Privacy policy
Data controller
The controller is VOLQID GmbH, Gurkensteig 9, 13159 Berlin, represented by Malgorzata Dorota Jablonska. For privacy enquiries: info@volqid.com, telephone +49 30 4849 1393.
Website access and hosting
The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Access involves processing technically necessary data, including IP address, time, requested URL, browser information and technical status data. This enables website delivery and security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure operation. STRATO acts as a processor under Article 28 GDPR. According to STRATO’s hosting information, IP addresses used to detect and defend against attacks are stored for a maximum of seven days. Where a specific security incident requires longer retention, this is limited to investigating that incident.
Contact by email and telephone
When you contact us, we process your contact details, enquiry and, where applicable, property information. Processing to answer your enquiry and prepare a contract is based on Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR, based on our legitimate interest in communication. Processing company representatives’ contact details is based on Article 6(1)(f) GDPR. Necessary data may be shared with appointed IT providers or relevant specialist partners where required to handle your project enquiry. We delete enquiries once resolved unless statutory retention obligations or necessary legal defence require continued storage. Commercial and tax records are retained for the applicable statutory periods.
Forms and assessment tools
The forms for the free initial assessment (building audit), the charging-potential check and the heat-pump check process the contact details you enter (in particular name, email and phone number), the building address and the building and consumption information requested by each form. Heat-pump inputs and calculated results are attached to the enquiry. Optional messages are also processed. We use these details to assess and respond to your enquiry and contact you.
For pre-contractual enquiries from the prospective contracting party, the legal basis is Article 6(1)(b) GDPR. For business contacts and other enquiries, it is Article 6(1)(f), our legitimate interest in handling enquiries. Where separate consent is the basis of optional processing, Article 6(1)(a) applies. An enquiry does not subscribe you to a newsletter. We cannot handle the requested service without the necessary information.
The charging-potential tool provides its initial assessment in your browser. Contact, building and charging details are transmitted only when you submit a separate personal enquiry.
REONIC customer and project management
We use software provided by Reonic GmbH (REONIC) to manage enquiries and projects. Our website interface sends submitted building-audit and heat-pump enquiries to the REONIC CRM, which stores the contact and project details, messages and calculations needed for further processing. Access should be limited to the people handling the enquiry and necessary service providers.
A data processing agreement with REONIC under Article 28 GDPR is in place. Processing takes place within the agreed purposes and instructions. Where REONIC uses subprocessors or data is processed outside the EEA, this takes place only within the scope of this agreement and subject to Articles 44 et seq. GDPR.
Embedded PV configurator
The photovoltaics page offers an external REONIC configurator. It is not loaded merely by opening the page. Starting it loads a script from apps.reonic.de and connects to the application at portal.reonic.de. This technically transmits IP address, browser and connection information to the external service. Project and contact information entered in the configurator is processed there for calculations and any enquiry you submit.
Activating the external tool is separate from submitting an enquiry. Providing the function you actively request and processing a pre-contractual enquiry rely, where necessary, on Article 6(1)(b) GDPR. Any non-essential device storage or other processing requiring consent must first obtain separate consent under section 25(1) TDDDG and/or Article 6(1)(a) GDPR. A start click alone does not replace appropriately informed consent.
Necessary storage and cookies
Our form interface uses a session cookie to protect against abusive requests (CSRF protection). It is limited to the API path and configured as Secure, HttpOnly and SameSite=Strict, without a fixed lifetime beyond the session. Necessary device storage is based on section 25(2)(2) TDDDG; security processing relies on Article 6(1)(f) GDPR. Language selection does not set a cookie.
To prevent duplicate submissions and track processing, the interface stores reference numbers, status, project references and verification values. Time-limited verification values derived from the IP address help limit abusive access. We do not use analytics or advertising tracking on this website. The external REONIC configurator is loaded only when you actively start it and may use its own technical storage; details are available in REONIC’s privacy information.
Retention and deletion
At least once a month, we review closed enquiries that did not lead to an order. Personal contact, building and calculation data that is no longer needed is deleted without undue delay once processing is complete; the monthly review is an additional check, not a minimum retention period. If a documented reason for retention exists, such as a specifically agreed continuation, a statutory duty or necessary legal defence, only the required data is retained for the necessary period and its use is restricted to that purpose. Where later continuation is agreed, a follow-up date is set and the need for retention reassessed. The review covers REONIC, our own submission records and other affected storage. Backups follow documented backup and overwrite cycles; deletions must be reapplied following restoration.
Your rights
Subject to statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with future effect. For processing under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing at any time. You may complain to a data protection supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information (www.datenschutz-berlin.de).
Appointments with Microsoft Bookings and Teams
We link to Microsoft Bookings for appointment scheduling. Opening the external booking page transmits technically necessary connection data, including your IP address and browser information, to Microsoft. Booking processes your name, email address, selected appointment and voluntary information. Bookings stores this data in Microsoft 365/Exchange and sends confirmations and updates. Appointments are checked against our business calendar; only available times, not calendar contents, are public. A Microsoft Teams link is created for the meeting; this also applies to video appointments for the free initial assessment that we arrange after a form enquiry. When you join, Microsoft processes connection and device data and the audio, video and chat content you provide.
Processing serves to arrange and conduct the requested conversation. The legal basis is Article 6(1)(b) GDPR for your own pre-contractual requests, or Article 6(1)(f) GDPR for business contacts (our interest in business communication). The provider is Microsoft Ireland Operations Limited, Ireland. Microsoft contractual terms, including the Products and Services Data Protection Addendum (DPA), apply. Processing outside the EEA may occur; the transfer mechanisms in the DPA, in particular EU standard contractual clauses, apply. The retention and deletion rules below also cover Bookings, calendars and associated messages. You may alternatively contact us by phone or email.