Privacy policy

1. Controller and privacy contact

The controller under the EU General Data Protection Regulation (GDPR) is:
EBS Euchner Büro- und Schulsysteme GmbH
Ernst-Leitz-Straße 3
D-63150 Heusenstamm, Germany
Phone: +49 6104 3313
Email: info@ebs-euchner.com

Represented by managing director Robert Euchner. Quickard is a product of EBS Euchner Büro- und Schulsysteme GmbH. You may also use these contact details for privacy requests.

2. Purposes and legal bases

We process personal data to provide and secure Quickard, perform usage and subscription agreements, communicate, comply with legal obligations and — only where separately permitted — measure reach or send newsletters. Depending on the activity, the legal bases are Art. 6 (1) lit. b GDPR (contract or pre-contractual steps), lit. c (legal obligation), lit. f (legitimate interests, especially secure and efficient operation) or lit. a (consent). Where we rely on Art. 6 (1) lit. f GDPR, we state the relevant interest below. Data marked as mandatory is required for registration, conclusion of the contract and invoicing; without it we cannot provide the account or plan. Beyond that, you are not obliged to provide data. No solely automated decision with legal or similarly significant effects within the meaning of Art. 22 GDPR takes place.

3. Roles for customer cards and forms

EBS is the controller for the Quickard account, billing, platform security and its own website content. Where a customer adds data about employees or other people to a card or collects contact or newsletter data on a public card for its own purposes, that customer generally determines the purposes and means and EBS processes the data as processor. The customer must provide its own Art. 13 or 14 GDPR information and establish a legal basis. The customer's privacy notice must therefore also be accessible on its card.

4. Hosting, database, backups and server logs

We operate the core application, database, authentication and file storage using self-administered server and Supabase software. The production systems run on cloud servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in its data centre in Nuremberg (Germany). Backups, error monitoring (Section 17), deployment management and an access-protected test environment run on servers of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, in data centres in Germany. Both providers process the data as processors under Art. 28 GDPR exclusively in Germany. Access generates technically necessary logs including IP address, date and time, requested resource, status code, data volume, referrer and user agent. We use them for delivery, stability, IT security and misuse or incident analysis (Art. 6 (1) lit. f GDPR). Routine logs are generally deleted after 30 days; relevant extracts may be retained until a specific security incident has been investigated and contained. Backups are created daily and overwritten after 14 days on the respective server and after 30 days in the separately stored copy. If a customer sets up its own domain for its cards, we request a TLS certificate from Let’s Encrypt (Internet Security Research Group, USA); only the domain name is transmitted.

5. Account, sign-in and OAuth

When you register and sign in, we process in particular your email address, password (as a hash only), confirmation and one-time codes, timestamps, security data and organization, team and role information. If you enable two-factor authentication, we also store the secret key of your authenticator app. The legal bases are Art. 6 (1) lit. b GDPR and lit. f GDPR (protecting the account against misuse). You can alternatively sign in with Apple or Google. We then receive a provider identifier from Apple Distribution International Ltd. or Google Ireland Limited and — depending on what you release there — name, email address and profile data; a profile picture stored there is copied once into our storage. The providers also learn of the sign-in. Your prior acceptance of the Terms and privacy information is recorded in a signed cookie valid for no more than ten minutes until you return from the provider (Section 18). The connection is made at your request to prepare or perform the agreement (Art. 6 (1) lit. b GDPR) and can also be removed in the provider account.

6. Contract, billing and evidence of declarations

To conclude and manage agreements, we process master data, plan, organization and billing data, order and payment status, invoices, booked quotas and support communication (Art. 6 (1) lit. b GDPR). For enterprise agreements invoiced by EBS, we create and send invoices ourselves. If you redeem a discount code, we store it with the order; if the code is assigned to a sales partner, we attribute the order to that partner to settle its remuneration and only share the information required for this (Art. 6 (1) lit. f GDPR; legitimate interest in settling our sales commissions). Acceptance of the Terms, requests for immediate performance, confirmation of the trial reminders, cancellation and withdrawal declarations are stored with content, version, time and technical evidence data in order to comply with legal obligations and prove declarations (Art. 6 (1) lit. c and lit. f GDPR).

7. Card, organization and media data

We store card and organization data you enter, including name, role, company, contact details, logos, profile images, audio and other media, links and design settings, to provide the selected plan (Art. 6 (1) lit. b GDPR). For third-party data, EBS generally acts on the customer's instructions; the customer must be authorized to store and publish it.

8. Public contact page, QR code and vCard

The core feature is the public contact page of each card at quickard.de/<slug> or at a custom domain set up by the customer. Released content is available there worldwide without sign-in, can be shared by link or QR code and downloaded as a vCard. Contact pages are marked “noindex” and are therefore not intended to appear in search results; search engines and other crawlers may nevertheless retrieve and analyse them. Only publish data whose public distribution is intended and lawful. Accessing a page generates the technical data described in Section 4 and, where applicable, the reach data explained in Section 11.

9. Contact forms and leads on customer cards

When a visitor submits a contact form, the entered contact details, the message, the answers to additional form fields set up by the customer and any uploaded files are stored, displayed to the relevant Quickard customer and may be reported by email. Uploaded files are kept in non-public storage, are not sent by email but can only be retrieved in the customer account through a short-lived link, and are deleted together with the request. The customer is generally the controller for handling the request; EBS provides the form, storage and transmission as processor. The customer determines the legal basis, usually Art. 6 (1) lit. b GDPR for requested pre-contractual steps or lit. f for another requested response. A consent checkbox is not required for this purpose, but the customer's privacy information must be directly accessible at the form.

10. Newsletter forms on customer cards

When a newsletter block is used, the visitor must accept a customer-specific, unticked consent statement. We record the email address, card/page and block reference, responsible company, linked privacy notice, full consent wording and version, request and confirmation times, and a non-reversible keyed hash of the requesting IP address. We then send a confirmation link through Resend that is valid for 48 hours. Merely opening the link changes nothing; only an explicit click on “Confirm subscription” completes double opt-in and displays the address in the customer's inbox. A confirmation email contains a personal unsubscribe link; unsubscribing likewise requires an explicit button and immediately removes the address from the operational recipient list. The customer is generally the controller for the newsletter, consent, later mailing and unsubscribe process; EBS provides collection and double opt-in as processor. The legal basis is consent under Art. 6 (1) lit. a GDPR together with Section 7 (2) German UWG.

10a. Product information, reminders and direct marketing

For product information and broadcasts, we process email address, account status, consent or objection status, the time, version and exact wording displayed for consent, and delivery data. Product news is disabled by default; historical accounts without complete proof of consent are not contacted. We send marketing email only with voluntary, demonstrable consent (Art. 6 (1) lit. a GDPR and Section 7 (2) German UWG) or under the narrow existing-customer exception in Section 7 (3) UWG, in which case Art. 6 (1) lit. f GDPR applies. Recipients may withdraw consent or object to marketing use at any time free of charge for the future.

11. Public-card reach measurement (Umami and card events)

On public contact pages, including customer domains, we measure reach using a self-hosted instance of the open-source software Umami and our own card event system in order to provide statistics to customers and improve Quickard. No cookies are set for this. Umami is addressed through our own server, which passes the IP address and user agent to the Umami instance; country, region and city as well as browser, operating system and device class are derived from them. Umami does not store the IP address but derives a pseudonymous session identifier from it that changes monthly. Time, requested path without query parameters, referrer domain, screen size and browser language are also recorded. If “Do Not Track” is enabled in the browser, no Umami measurement takes place. For Pro cards, the card event system stores the event type (such as view, vCard download or a click on phone, email or a link), time, card identifier, device class and referrer domain as well as a pseudonymous visitor value derived from IP address, user agent, card identifier, day and a secret value that changes daily; the raw IP is not stored. To avoid double counting, the page stores the key qk_an_v:<Kartenadresse> with a timestamp in sessionStorage for 30 minutes; it is deleted when the tab is closed. The legal basis is Art. 6 (1) lit. f GDPR; the legitimate interest is data-minimising reach measurement for our customers and improving the service. For storage in sessionStorage we rely on Section 25 (2) no. 2 TDDDG. You can object to the measurement at any time (Section 22). The cookie banner on public cards only appears if the page embeds Google Maps or YouTube/Vimeo (Section 12). Card events are automatically deleted after 180 days. Purely security-related server analyses without access to the device are also based on Art. 6 (1) lit. f GDPR.

12. Embedded content: Google Maps, YouTube and Vimeo

Customers can embed Google Maps and videos from YouTube (including youtube-nocookie.com) or Vimeo. On public cards, neither the Google Maps frame nor YouTube/Vimeo frames, cover videos or YouTube thumbnails are created before consent. Visitors can enable the categories “Google Maps” and “YouTube and Vimeo” separately and withdraw consent at any time. Only then does the browser connect directly to the provider; at least IP address, time, page, referrer and browser data are transmitted and providers may read or store further identifiers on the device. For Google services this is in particular Google Ireland Limited, for Vimeo Vimeo.com, Inc., USA. The legal bases are Section 25 (1) TDDDG and Art. 6 (1) lit. a GDPR. A deliberately clicked external route link opens Google Maps directly. Cards using a brand template of Dr. Ing. h.c. F. Porsche AG approved by the brand owner load fonts and program components of the Porsche Design System from the server cdn.ui.porsche.com when opened; IP address, time, page and browser data are transmitted to the operator of that server (Art. 6 (1) lit. f GDPR; legitimate interest in the brand-compliant presentation specified by the brand owner). Other external images, audio, font or document files added by the customer may be loaded directly from the provider recognisable from the URL; the customer must name these sources in its own privacy information and hold the necessary media, font and trademark rights.

13. Apple Wallet and Google Wallet

On request, card data can be transferred to an Apple Wallet pass or a Google Wallet object. For Apple, delivery is a signed pass file. To update an added pass, we also process Apple device/library identifiers, push tokens, pass identifier and registration time and send update signals to the Apple Push Notification service. For Google, the required pass and card data are transmitted to the Google Wallet API. Providers are Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland, and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6 (1) lit. b GDPR. Once added, Apple or Google also process the data under their own terms. If a customer configures places or time windows for the lock screen, the pass also contains these coordinates, notification texts and time windows; whether the card is suggested is decided by the device itself — we do not receive device location data. For the address search in the editor, we only transmit the entered search term server-side to the public Nominatim service of the OpenStreetMap Foundation, United Kingdom; an adequacy decision of the EU Commission exists for the United Kingdom.

14. Payments through Stripe

Paid plans and subscriptions are processed by Stripe. Stripe processes contact, billing, payment, device and transaction data; we do not receive full payment instrument data. We retain the identifiers and status information required for contract, payment and invoice administration. The EEA provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The legal bases are Art. 6 (1) lit. b and c GDPR.

15. Transactional email through Resend

We send confirmations, invitations, pass delivery, reminders, newsletter double opt-in and other transactional email through Resend (Plus Five Five, Inc., USA). Recipient, subject, complete content and technical sending, delivery and error data are processed. Incoming webhooks are reduced before storage to required, predefined delivery and error fields; we do not store complete raw events, opening events or click events. Our email templates do not load fonts from Google servers. Required transactional email relies on Art. 6 (1) lit. b and f GDPR; newsletter confirmation relies on the requested consent under Art. 6 (1) lit. a GDPR. Where Resend acts on our behalf, processing is governed by an Art. 28 agreement and the section 19 safeguards.

16. Notifications, reminders and the trial

For a trial, we store its start, end, the number of available cards and your confirmation that you will be reminded by email before it ends, with a timestamp in the audit log. On that basis we send a reminder seven, three and one day before the end and, at the end, a notice stating which cards continue with Pro, which continue as free Starter cards and which end, to the organization's billing addresses (Art. 6 (1) lit. b GDPR). When someone joins a team, we inform its owners and administrators of the joining person's name and email address (Art. 6 (1) lit. b and lit. f GDPR). You can unsubscribe from this notice and from billing notices, such as before a renewal, in the settings under “Notifications”. You receive emails about sign-in and security, orders, cancellations, payments and the trial regardless, because they are necessary for the agreement and the account. We only send product news with your consent (Art. 6 (1) lit. a GDPR), which you can withdraw there at any time with effect for the future.

17. Error and security monitoring (GlitchTip/Sentry SDK)

We use a Sentry-compatible SDK with a self-hosted GlitchTip instance to detect technical errors and security incidents. An error report may contain time, affected code and URL, device, browser and operating-system information, technical execution and error data, and IP address. Session replay and performance tracing are disabled by default and ordinary user content or complete form entries are not intended to be collected. The legal basis is our legitimate interest in stability and security under Art. 6 (1) lit. f GDPR. Error data is deleted once it is no longer required for analysis and prevention.

17a. Support, administrative access and audit

Authorized staff may access account, organization, card, contact, form and billing data where support or platform administration requires it. Security-relevant administrative access is logged with administrator account, organization, time, IP address and user agent. Support messages may include user/organization reference, the request, the affected page and technical context. Purposes are support, troubleshooting, abuse prevention, auditability and product improvement (Art. 6 (1) lit. b or f GDPR). Access is role-restricted and data is deleted when handling, security and evidence purposes end.

17b. Illegal-content reports and authority orders

For a Digital Services Act report, we process reporter contact data, the relevant URL or card address, reasons, evidence, good-faith statement, communications and our decision. Purposes are receiving and assessing the report, protecting all parties' rights, complying with law and proving its handling (Art. 6 (1) lit. c and f GDPR). Data may be disclosed to affected users, authorities, courts or advisers only where required and lawful. Suspected offences posing a threat to life or safety are reported to law-enforcement or judicial authorities as required by law. Data is kept until the procedure ends and afterwards only for applicable evidence and limitation periods.

17c. Personal sales pages for prospects

For contacts at potential business customers, we create personal sales pages with a demo card in the design of the respective company. For this we process first and last name, company, business email address, location, job title and, where applicable, a profile picture as well as further business contact details and internal notes. The data comes from previous contact with you or from publicly available professional sources, such as your company's website or professional networks. The pages are only accessible via their personal address and are excluded from search engines (noindex). We record how often and when the sales page was last opened; Section 11 also applies to the demo card. The purpose is to initiate a business relationship; the legal basis is Art. 6 (1) lit. f GDPR, the legitimate interest being direct marketing to businesses. When the page ends, the demo card is deactivated; we delete the data as soon as it is no longer required for the sales approach, at the latest twelve months after the page ends, unless a business relationship arises. You can object to the processing at any time (Section 22); we will then end the page and delete your data.

18. Cookies and local browser storage

Technically necessary are in particular the sign-in cookies sb-…-auth-token for the session until sign-out (when signing in with Apple or Google, additionally a short-lived verifier for the PKCE flow), the active-organization cookie (qk_active_org, one year), the signed consent record qk_oauth_legal_consent when registering with Apple or Google (no more than ten minutes) and — after a manual language choice — the language cookie qk_locale for one year. Maintenance access may be stored for 24 hours; access-protected test environments set the cookie qk-access for 30 days after the access password is entered. localStorage or sessionStorage may also contain the theme, the email address entered at registration (to resend the confirmation email), an onboarding draft including billing/card data and dismissed overview notices. On public cards with Google Maps or YouTube/Vimeo blocks, qk_public_consent stores the version, decision time and selection for these embeds so that the decision is technically respected and can be withdrawn; without such blocks, no cookie banner appears. The key from Section 11 may temporarily be stored in sessionStorage. Necessary functional storage is based on Section 25 (2) no. 2 TDDDG and Art. 6 (1) lit. b or lit. f GDPR. Third-party embeds (Section 12) are based on Section 25 (1) TDDDG and Art. 6 (1) lit. a GDPR. We do not use advertising or tracking cookies.

19. Recipients, processors and international transfers

Depending on the feature, recipients include our hosting providers Hetzner Online GmbH and IONOS SE as well as Let’s Encrypt (Section 4), Apple and Google (Sections 5 and 13), the OpenStreetMap Foundation (Section 13), Stripe (Section 14), Resend (Section 15), map and video providers selected by customers and the operator of the Porsche Design System (Section 12) and — in individual cases, where necessary and permitted — authorities, courts and advisers bound by professional secrecy. Where a provider processes on our instructions, we enter into an Art. 28 GDPR agreement; for certain operations other providers act as separate controllers. Transfers to the USA concern in particular Resend and Let’s Encrypt and — after your consent — Vimeo. Transfers outside the EEA only take place in accordance with Art. 44 et seq. GDPR, in particular under an adequacy decision, including valid EU-US Data Privacy Framework certification, or EU Standard Contractual Clauses and supplementary safeguards. You can request a copy of the safeguards using the contact details in Section 1.

20. Retention

We delete data as soon as the purpose and any necessary evidence period no longer apply and there is no retention obligation. In particular:
· Routine server logs: generally 30 days; incident data until the investigation is complete. Backups: 14 or 30 days (Section 4).
· Card events from Section 11: automatically after 180 days. Email delivery and error data: automatically after 180 days.
· Contact and confirmed newsletter entries in the customer inbox, including uploaded files: automatically after 365 days or earlier on a legitimate instruction or once the purpose has been achieved.
· Unconfirmed newsletter requests: seven days after the 48-hour confirmation link expires; unsubscription records: three years after unsubscribing; active consent records until unsubscription or an earlier legitimate instruction.
· Sales pages for prospects (Section 17c): until an objection or until the purpose ceases, at the latest twelve months after the page ends, unless a business relationship arises.
· Logs of security-relevant administrative access (Section 17a): until the evidence purpose ceases, usually three years.
· Account, card and media data: for the term of the agreement, then deletion in the account deletion process unless a separate obligation or legitimate protection of claims prevents this.
· Contract, consent, cancellation and withdrawal records and DSA reports: generally until possible claims expire; the regular limitation period is three years and generally begins at the end of the relevant year.
· Books, inventories, opening balance sheets and annual financial statements: ten years; accounting vouchers and invoices: eight years; commercial or business letters received and sent: six years (Section 257 HGB, Section 147 AO, Section 14b UStG).
Statutory periods generally begin at the end of the calendar year. Deleted data may remain in secured backups until they are overwritten as scheduled; it is not used for other purposes in the meantime.

21. Your privacy rights

Subject to the statutory conditions, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21). You may withdraw consent at any time for the future without affecting prior lawful processing. For data controlled by a Quickard customer, you may contact that customer or us; we will forward the request where necessary.

22. Specific notice about the right to object

Where we process data under Art. 6 (1) lit. f GDPR, you may object at any time on grounds relating to your particular situation. We will then stop unless we demonstrate compelling legitimate grounds that override your interests or need the data to establish, exercise or defend legal claims. You may object to direct marketing at any time without giving reasons.

23. Right to complain to a supervisory authority

Without prejudice to other remedies, you may complain to a data protection authority, particularly at your habitual residence, workplace or the place of the alleged infringement. The authority responsible for EBS is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163, 65021 Wiesbaden, Germany
datenschutz.hessen.de