Privacy Policy

Basic information

This Privacy Policy is intended to inform visitors to our website and users of our online tool QUESTIONSTAR about the nature, scope and purpose of the collection and use of personal data by us as the website operator, by our cooperation partners, and by our customers who conduct their online surveys with the help of our tool.

We take your privacy very seriously and treat your personal data confidentially and in accordance with statutory provisions. Since new technologies and the continuous development of this website may make changes to this Privacy Policy necessary, we recommend that you re-read this Privacy Policy at regular intervals.

Definitions of the terms used (e.g. “personal data” or “processing”) can be found in Art. 4 GDPR.

Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is:

Data protection officer

General information on data processing

Scope of the processing of personal data

As a rule, we process personal data of our users only to the extent necessary to provide a functional website and our content and services. The processing of personal data of our users regularly takes place only with the user’s consent. An exception applies in cases in which obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by statutory provisions.

Legal basis for the processing of personal data

Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

For the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures.

Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

In the event that vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.

If the processing is necessary for the purposes of a legitimate interest of our company or of a third party, and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

Data erasure and storage period

The personal data of the data subject are erased or blocked as soon as the purpose of storage no longer applies. Storage beyond this may take place if provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. Data are also blocked or erased when a storage period prescribed by the aforementioned norms expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

SSL and TLS encryption

For security reasons and to protect the transmission of confidential content that you send to us as the site operator, our website uses SSL or TLS encryption. This means that data you transmit via this website cannot be read by third parties. You can recognize an encrypted connection by the “https://” address line of your browser and by the lock symbol in the browser bar.

Provision of the website and creation of log files

We, the website operator and site provider, collect data about accesses to the website on the basis of our legitimate interest (see Art. 6(1)(f) GDPR) and store them as “server log files” on the website’s server. The following data are logged in this way:

• Website visited or file requested
• Time of access
• Amount of data sent, in bytes
• Source/referrer from which you reached the page
• Browser used
• Operating system used
• IP address used

The server log files are stored for a maximum of 7 days and then deleted. The data are stored for security reasons, e.g. to be able to investigate cases of misuse. If data must be retained for evidentiary reasons, they are exempt from deletion until the incident has been conclusively resolved.

Server location: IONOS data centers in Frankfurt and Berlin.

Registration on this website

To use the QUESTIONSTAR online tool, you must register on our website. This creates a contractual relationship between you and the website operator, which is governed by our Terms of Service. The data transmitted serve exclusively the purpose of using our service and performing the aforementioned contract. Mandatory information requested during registration must be provided in full. Otherwise, we will refuse the registration.

In the event of important changes, for example for technical reasons, we will inform you by e-mail. The e-mail will be sent to the address provided during registration.

The processing of the data entered during registration takes place on the basis of your consent (Art. 6(1)(a) GDPR) and on the basis of the contractual relationship established through the use of our service (Art. 6(1)(b) GDPR). You may withdraw consent you have already given at any time. An informal notification by e-mail is sufficient for the withdrawal. The lawfulness of the data processing already carried out remains unaffected by the withdrawal.

We store the data collected during registration for the period during which you are registered on our website. Your data will be deleted if you cancel your registration. Statutory retention periods remain unaffected.

Handling of contact data

If you contact us as the website operator through the contact options offered, your details will be stored so that they can be used to process and answer your inquiry. These data will not be passed on to third parties without your consent.

The processing of the data transmitted when you contact us takes place on the basis of your consent (Art. 6(1)(a) GDPR) and, in the case of contact by e-mail, on the basis of Art. 6(1)(f) GDPR. If the e-mail contact is aimed at the conclusion of a contract, Art. 6(1)(b) GDPR additionally applies. You may withdraw consent you have already given at any time. An informal notification by e-mail is sufficient for the withdrawal. The lawfulness of the data processing operations carried out up to the withdrawal remains unaffected by the withdrawal.

Data transmitted when you contact us remain with us until you request their deletion, withdraw your consent to their storage, or until there is no longer any need to store the data. Mandatory statutory provisions — in particular retention periods — remain unaffected.

Newsletter

The website operator offers you a newsletter in which it informs you about current events and offers. If you wish to subscribe to the newsletter, you must provide a valid e-mail address. In addition, if you purchase services on our website and provide your e-mail address in the process, that address may subsequently be used by us for sending a newsletter. By subscribing to the newsletter or purchasing our service (including free of charge), you agree to receive the newsletter and to the procedures described. The legal basis for the processing of data is Art. 6(1)(a) GDPR in the case of subscription to the newsletter, and § 7(3) UWG (German Act Against Unfair Competition) in the case of the purchase of services.

The newsletter is sent via our dispatch service provider SendGrid (Twilio). For more detailed information on SendGrid and the associated data protection provisions, see the section “SendGrid (Twilio)” below.

Withdrawal and cancellation: You may withdraw your consent to receiving the newsletter at any time and thereby cancel the newsletter subscription. After your cancellation, your personal data will be deleted. Your consent to the newsletter dispatch expires at the same time. At the end of each newsletter you will find the link for cancellation.

SendGrid (Twilio)

For sending our newsletters and transactional e-mails (e.g. registration confirmation, password recovery), we use the e-mail dispatch service SendGrid. The provider is Twilio Inc., 101 Spear Street, San Francisco, CA 94105, USA — represented in Europe by Twilio Ireland Limited, 25-28 North Wall Quay, Dublin 1, Ireland.

When you subscribe to the newsletter, your e-mail address and subscription data are transmitted to SendGrid and stored on their servers. SendGrid enables us to organize dispatch and delivery and to analyze whether e-mails were opened and links were clicked.

Data transfer to the USA: SendGrid (Twilio) is certified under the EU-US Data Privacy Framework (EU-US DPF). In addition, we have concluded Standard Contractual Clauses (SCC, Module 2) with Twilio.

Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and, in the case of the purchase of services, § 7(3) UWG.

Data processing agreement: A data processing agreement pursuant to Art. 28 GDPR is in place with Twilio.

Withdrawal:You may withdraw your consent at any time. To do so, use the “Unsubscribe” link at the end of each newsletter or send an informal notification to privacy@questionstar.com.

Twilio’s privacy policy: https://www.twilio.com/legal/privacy

Audience measurement & cookies

This website uses cookies for pseudonymized audience measurement, which are transferred to the user’s browser either from our server or from the server of a third party. Cookies are small files that are stored on your device. Your browser accesses these files. The use of cookies increases the user-friendliness and security of this website.

On your first visit to our website, we display a cookie banner. Via the banner, you can give granular consent as to which optional cookies (e.g. analytics, marketing) may be set, or refuse consent. Technically necessary cookies are set without consent — the legal basis for this is § 25(2) no. 2 TTDSG (German Telecommunications-Telemedia Data Protection Act).

You may withdraw your consent at any time via the “Cookie settings” link in the footer of this website.

Cookies are stored on the user’s computer and transmitted by it to our site. Therefore, you as the user also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

The legal basis for the processing of personal data using cookies is Art. 6(1)(a) GDPR and § 25(1) TTDSG for optional cookies. For technically necessary cookies, § 25(2) no. 2 TTDSG applies.

Consent management with Klaro

To implement your consent decision, we use the open-source consent manager Klaro (klaro.org, licensed under BSD-3). Klaro is hosted entirely on our own servers in Germany — no data are transferred to third parties.

Klaro sets a single technically necessary cookie (“klaro-consent”) with a storage period of 365 days. It stores exclusively your decision as to which optional tracking and marketing tools you have permitted. No personal data or tracking identifiers are collected.

Legal basis: § 25(2) no. 2 TTDSG (strictly necessary in order to provide a service expressly requested by the user — the GDPR-compliant management of your consents) and Art. 6(1)(c) GDPR (compliance with legal obligations).

JivoChat live chat

On the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), we use the live chat widget JivoChat on our website. The provider for the European market is Jivosite Ltd., 122, 1st Floor, Agias Fylaxeos, 3083 Limassol, Cyprus (“JivoChat” or “Jivo”). The parent company is JivoSite Inc., 525 W Remington Dr, Sunnyvale, CA 94087, USA.

JivoChat enables you to communicate with our support team in real time. When you open the chat, technically necessary cookies (jv_* family) are set, and the following data are transmitted to JivoChat: chat messages, IP address, browser and device information, pages visited, timestamps and, if you provide them voluntarily, your name and contact details.

Data transfer to third countries: The contractual partner for the processing of your data is Jivosite Ltd., established in Cyprus, an EU member state fully subject to the GDPR. A transfer to the US parent company JivoSite Inc. cannot be entirely ruled out. For such transfers to the USA, we have concluded Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR with JivoChat. To the extent that JivoSite Inc. is certified under the EU-US Data Privacy Framework (EU-US DPF), the certification additionally serves as the basis for the transfer.

Withdrawal / opt-out:You may withdraw your consent at any time via our cookie banner or the “Cookie settings” link in the footer. Before you give your consent, the chat is not loaded and no data whatsoever are transmitted to JivoChat.

Privacy policy: https://www.jivochat.com/privacy-policy/

Google Tag Manager

We use the Google Tag Manager (GTM) of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The GTM serves exclusively to centrally manage other tags (e.g. for Google Analytics or Meta Pixel). The GTM itself does not set cookies and does not collect any personal data.

If you have deactivated tracking at the domain or cookie level, this deactivation remains effective for all tracking tags integrated via the GTM.

Privacy policy: https://policies.google.com/privacy

Google Analytics 4 (GA4)

On the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), we use Google Analytics 4 to analyze website usage. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — parent company Google LLC, USA.

GA4 uses cookies and/or comparable technologies to record usage behavior on our website in pseudonymized form. The data collected include, among other things, device and browser information, truncated IP address (IP anonymization active), time spent on the site, page views and click paths.

Data transfer to the USA: Google LLC is certified under the EU-US Data Privacy Framework (EU-US DPF). In addition, we have concluded Standard Contractual Clauses (SCC) with Google.

Data processing agreement: A data processing agreement pursuant to Art. 28 GDPR is in place with Google.

Withdrawal / opt-out: You may object to the data collection at any time via our cookie banner. In addition, you can install the browser plugin provided by Google: https://tools.google.com/dlpage/gaoptout

Google’s privacy policy: https://policies.google.com/privacy

Google Ads and Google conversion tracking

Our website uses Google Ads. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — parent company Google LLC, USA.

Google Ads is an online advertising program. Within the online advertising program, we work with conversion tracking. After a click on an ad placed by Google, a cookie for conversion tracking is set. Cookies are small text files that your web browser stores on your device. Google Ads cookies lose their validity after 30 days and do not serve to personally identify users. The cookie allows Google and us to recognize that you clicked on an ad and were redirected to our website.

Each Google Ads customer receives a different cookie. The cookies cannot be tracked across the websites of Google Ads customers. Conversion cookies are used to create conversion statistics for Google Ads customers who use conversion tracking. Google Ads customers learn how many users clicked on their ad and were redirected to pages with a conversion tracking tag. However, Google Ads customers do not receive any information that would allow users to be personally identified.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent).

Data transfer to the USA: Google LLC is certified under the EU-US Data Privacy Framework (EU-US DPF). In addition, we have concluded Standard Contractual Clauses (SCC) with Google.

Details on Google Ads and Google conversion tracking can be found in Google’s privacy policy: https://policies.google.com/privacy

Google remarketing / “similar audiences” function

On our website, we use the remarketing or “similar audiences” function of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — parent company Google LLC, USA. This function serves the purpose of analyzing visitor behavior and visitor interests.

To carry out the analysis of website usage, which forms the basis for creating interest-based advertisements, Google uses cookies. The cookies record visits to the website as well as anonymized data about the use of the website. No personal data of visitors to the website are stored. If you subsequently visit another website in the Google Display Network, you will be shown advertisements that are highly likely to take into account previously viewed product and information areas.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent).

Data transfer to the USA: Google LLC is certified under the EU-US Data Privacy Framework (EU-US DPF). In addition, we have concluded Standard Contractual Clauses (SCC) with Google.

You may object to the use of cookies by Google at any time via our cookie banner. In addition, a browser plugin is available: https://support.google.com/ads/answer/7395996

Further information on Google remarketing and the associated privacy policy can be found at: https://policies.google.com/privacy

Google Web Fonts

Our website may use web fonts from Google. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — parent company Google LLC, USA.

The use of these web fonts makes it possible to present our website to you in the way we intend, regardless of which fonts are available to you locally. This takes place by retrieving the Google web fonts from a Google server and the associated transfer of your data to Google. This concerns your IP address and which of our pages you visited. Google Web Fonts are used on the basis of Art. 6(1)(f) GDPR. As the operator of this website, we have a legitimate interest in the optimal presentation and delivery of our web presence.

Data transfer to the USA: This takes place under the EU-US Data Privacy Framework (EU-US DPF) and on the basis of Standard Contractual Clauses (SCC).

Further information can be found in Google’s privacy policy: https://policies.google.com/privacy

YouTube

For the integration and display of video content, our website uses plugins from YouTube. YouTube is operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — parent company Google LLC, USA.

When a page with an integrated YouTube plugin is accessed, a connection to the YouTube servers is established. YouTube thereby learns which of our pages you have accessed.

YouTube can associate your browsing behavior directly with your personal profile if you are logged into your YouTube account. You can prevent this by logging out beforehand.

YouTube is used in the interest of an appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

Data transfer to the USA: Google LLC is certified under the EU-US Data Privacy Framework (EU-US DPF). In addition, we have concluded Standard Contractual Clauses (SCC) with Google.

Details on the handling of user data can be found in YouTube’s privacy policy: https://policies.google.com/privacy

Use of social media plugins by Meta (Facebook)

On the basis of our legitimate interest in the analysis, optimization and operation of our online offering (within the meaning of Art. 6(1)(f) GDPR), this website uses the Meta social plugin, which is operated by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) — parent company Meta Platforms, Inc., USA. The integrations can be recognized by the Facebook logo or by the terms “Like” or “Share” in Facebook’s colors (blue and white).

The plugin establishes a direct connection between your browser and the Meta servers. The website operator has no influence whatsoever on the nature and scope of the data that the plugin transmits to the Meta servers.

The plugin informs Meta that you, as a user, have visited this website. There is a possibility that your IP address will be stored. If you are logged into your Facebook account during your visit to this website, the aforementioned information will be linked to it.

If you use the functions of the plugin — for example by sharing or “liking” a post — the corresponding information is also transmitted to Meta.

Data transfer to the USA: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (EU-US DPF). In addition, we have concluded Standard Contractual Clauses (SCC) with Meta.

If you wish to prevent Meta from linking these data to your Facebook account, please log out of Facebook before visiting this website and delete the stored cookies.

Meta’s privacy policy: https://www.facebook.com/about/privacy/

Meta Pixel and Custom Audiences

On our website, we use the remarketing function “Custom Audiences” and the Meta Pixel of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) — parent company Meta Platforms, Inc., USA. This function serves the purpose of addressing visitors to the website in a targeted manner with interest-based advertising on the social network Facebook.

For this purpose, the Meta Pixel has been implemented on the website. Via this tag, a direct connection to the Meta servers is established when the website is visited. This transmits to the Meta server which of our pages you have visited. Meta associates this information with your personal Facebook user account. When you visit the social network Facebook, you will then be shown personalized, interest-based Facebook ads.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent).

Data transfer to the USA: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (EU-US DPF). In addition, we have concluded Standard Contractual Clauses (SCC) with Meta.

You may withdraw your consent at any time via our cookie banner. Further information on the collection and use of data by Meta can be found in Meta’s privacy notices: https://www.facebook.com/about/privacy/

Publishing surveys on social networks

The QUESTIONSTAR web service provides its customers with a function that allows customers’ surveys to be published or shared on social networks. When this function is used, a connection to the server of the respective social network is established, and data are transferred to the server of the respective social network. To publish the survey on the social network, the customer must log into their user account with that social network, or already be logged into the social network before using the function. As a result, the social network can associate the visit to our website or the use of our web service with that user account. Without a transfer of data to the servers of social networks, publishing the survey on social networks is not possible. By using the function to share a survey on social networks, you consent to the transfer of data to the respective social network. The details relevant to data protection concerning the interactions with the supported social networks are set out below.

Facebook (Meta)

The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland — parent company Meta Platforms, Inc., USA.

When a survey is shared on Facebook, a connection to Meta servers is established. Meta thereby receives the information that you have visited our site with your IP address and can associate the visit to our pages with your user account. We point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or of their use by Meta. Further information can be found in Meta’s privacy policy: https://www.facebook.com/about/privacy/

XING

The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany (XING AG was renamed New Work SE in 2019).

When a survey is shared on XING, a connection to the XING servers is established. To our knowledge, no personal data are stored in the process. IP addresses are not stored, nor is usage behavior evaluated. Details on data protection and the XING share button can be found in XING’s privacy policy: https://www.xing.com/app/share?op=data_protection

X (formerly Twitter)

The provider is X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

When a survey is shared on X and the “repost” function is used, the websites you have visited are linked to your X account and published in your X feed. In the process, data are transmitted to X. We have no knowledge of the content of the data transmitted or of the use of these data by X.

Data transfer to the USA: takes place on the basis of the EU-US Data Privacy Framework (EU-US DPF) or Standard Contractual Clauses (SCC).

Details can be found in X’s privacy policy: https://x.com/privacy

Pinterest

The provider is Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland — parent company Pinterest Inc., USA.

When a survey is shared on Pinterest, your browser establishes a direct connection to the Pinterest servers. Log data are transmitted to the Pinterest servers. The log data may allow conclusions to be drawn about your IP address, websites visited, browser type and settings, date and time of the request, your usage of Pinterest, and cookies.

Data transfer to the USA: takes place on the basis of the EU-US Data Privacy Framework (EU-US DPF) or Standard Contractual Clauses (SCC).

Details can be found in Pinterest’s privacy notices: https://about.pinterest.com/en/privacy-policy

LinkedIn

The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland — parent company LinkedIn Corporation / Microsoft, USA.

When a survey is shared on LinkedIn and the share function is used, a connection to LinkedIn servers is established. LinkedIn thereby receives the information that you have visited our site with your IP address and can associate the visit to our pages with your user account. We point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or of their use by LinkedIn.

Data transfer to the USA: takes place on the basis of the EU-US Data Privacy Framework (EU-US DPF) or Standard Contractual Clauses (SCC).

Further information in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy

Telegram

The provider of the Telegram messenger is Telegram FZ-LLC, Business Central Towers, Tower B, Office 38-A03, Dubai Internet City, Dubai, UAE.

When a survey is shared on Telegram, the websites you have visited are linked to your Telegram account and published in your Telegram channel. In the process, data are transmitted to Telegram. We have no knowledge of the content of the data transmitted or of the use of these data by Telegram. Details can be found in Telegram’s privacy policy: https://telegram.org/privacy

PayPal

Our website enables payment via PayPal. The provider of the payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you pay with PayPal, the payment data you enter are transmitted to PayPal.

The transmission of your data to PayPal takes place on the basis of Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing for the performance of a contract). You may withdraw consent you have already given at any time. Data processing operations that took place in the past remain effective in the event of a withdrawal.

Stripe

Our website enables card payment via Stripe. The provider of this payment service is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”).

If you pay by card, the payment data you enter (card number, expiry date, verification code, cardholder name) are transmitted directly to Stripe through embedded Stripe input fields; the card data do not touch our servers and are not stored by us. Stripe may transfer data to Stripe, Inc. in the USA; the transfer is safeguarded by the EU standard contractual clauses (SCC).

The transmission of your data to Stripe takes place on the basis of Art. 6(1)(b) GDPR (processing for the performance of a contract). Details on data protection at Stripe: https://stripe.com/privacy.

API and AI-assistant connector — personal data

QUESTIONSTAR offers a public API and MCP connectors that let external tools and AI assistants work with your surveys on your behalf. Personal data is handled as follows:

• Separation of identity from responses.The connector never returns a respondent’s personal or contact data together with their survey answers. Tools that read responses return answer data only; respondent contact and personal fields are excluded from those results by construction.
• Contact data only through respondent-specific tools. Respondent contact details (name, email, custom fields) are returned solely by dedicated respondent tools — an individual respondent lookup or an explicit respondent-list export — and never alongside survey answers. Tools that read responses return answers only, so an AI assistant never receives personal identity bundled with opinions.
• Owner-controlled writes.Data written through the connector (creating or updating a respondent or a response) is data the account owner already holds and chooses to provide; it is processed under the account owner’s control and this Privacy Policy.
• Authentication. Connector access uses OAuth; QUESTIONSTAR does not share account credentials with third parties.

Rights of the data subject

Insofar as personal data concerning you are processed, you are a data subject within the meaning of the GDPR, and you have the following rights:

• Right of access (Art. 15 GDPR): You may request information about which personal data concerning you we process.
• Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate data or the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You may request the erasure of your data, provided no statutory retention obligations exist.
• Right to restriction of processing (Art. 18 GDPR): You may request that the processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): You may request that we transmit your data in a structured, commonly used and machine-readable format to you or to another controller.
• Right to object (Art. 21 GDPR): You may object to the processing of your data — in particular in the case of direct marketing.
• Right to withdraw consent (Art. 7(3) GDPR): If you have given consent, you may withdraw it at any time — the lawfulness of the processing carried out up to the withdrawal remains unaffected.
• Right to lodge a complaint (Art. 77 GDPR): You may lodge a complaint with a data protection supervisory authority — the competent authority in Lower Saxony is the State Commissioner for Data Protection of Lower Saxony (LfD): https://lfd.niedersachsen.de

To exercise these rights, please contact: privacy@questionstar.com

Validity and changes

This Privacy Policy is currently valid. The further development of our website or changes to statutory provisions may make it necessary to amend this Privacy Policy. We recommend reviewing the current version regularly.

Last updated: May 5, 2026.

Information for survey respondents

QUESTIONSTAR is an online tool with the help of which our customers (e.g. universities, research institutions, market research companies and others) can create their online questionnaires, conduct online surveys and analyze the collected data.

Due to the nature of our service, the data entered into the questionnaires by survey respondents are passed on to the respective customer of our service and may be processed by that customer. This transfer of data takes place on the basis of Art. 6(1)(f) GDPR, on the grounds of our legitimate interest — otherwise our service could not fulfill its purpose. Since the fields of application of our tool are diverse and we have only very limited control over the activities of our customers, we unfortunately cannot provide information about the purpose of a specific data collection or survey. This information obligation therefore falls within the area of responsibility of the respective customer.

Nevertheless, to protect you against misuse of your personal data, we contractually oblige our customers, through their acceptance of our terms of service, to comply with the data protection rules of the GDPR. Furthermore, we provide our customers with a set of instruments within the tool that helps them fulfill the requirements of the GDPR. For example, the survey owner can specify which questions collect personal data and whether these data should be exported in a separate file, pseudonymized where applicable. These settings cannot be reversed, so that a subsequent linking of personal data with the remaining answers of a survey respondent is not possible in this case. Nevertheless, the correct handling of these settings falls within the area of responsibility of the customer.

Please therefore observe the privacy policy of the respective survey owner and contact them directly in matters of data protection.

Most of our customers comply with the GDPR and, for their part, require us to comply with data protection rules. Nevertheless, misuse is theoretically possible. Should you become aware of a case of misuse of our service, please let us know as quickly as possible. We will review the case immediately. Should the misuse be confirmed, we will block the account of the responsible party and their access to the data.