Privacy notice
What this site collects, why, for how long, who else sees it, and what you can require of us. We sell governance work, so this page is written to the standard we would apply to a client system.
Controller
The controller for the processing described here, within the meaning of Article 4 (7) of the General Data Protection Regulation (GDPR), is:
Quenora Consulting
Kleiststr. 12
74117 Bad Friedrichshall
Baden-Württemberg, Germany
info@quenora.ai
We have not appointed a data protection officer, because we are not required to under Article 37 GDPR or § 38 BDSG. Data protection questions go to the address above and are answered by the controller directly.
What this site does not do
This site sets no tracking cookies. It runs no analytics, no tag manager, and no advertising or social media pixels. Nothing here profiles you, follows you between sites, or builds a record of your visit. There is no consent banner because there is nothing to consent to.
It does use your browser’s own storage for three small things, each of which exists only so the site behaves the way you asked it to:
qn:restore— session storage. The position on the page you navigated away from, so that returning puts you back where you were. Deleted the moment it is read, and in any case when you close the tab.q_lang— a cookie, twelve months. Your language choice: the lettersde,froren, and nothing else. It is written only if you click one of the buttons on the language offer. Ignore the offer, or let it close itself, and nothing is stored.q_lang_seen— session storage. That the language offer has already been shown once, so it does not reappear on every page. Gone when you close the tab.
None of these contains an identifier. None is transmitted to us or to anyone else — they are read only by your own browser. Clearing cookies and site data for this domain removes all three; the site works normally without them.
Language. The site reads your browser’s own language setting to decide whether to offer you a German or French version. That setting is read in your browser and is neither stored nor transmitted. You are never redirected automatically — you are offered the choice, and you may ignore it.
Legal basis. These entries are strictly necessary to provide functionality you requested, under § 25 (2) no. 2 TDDDG, and storing your language choice follows from your own click. No consent is required for them.
You will not be tracked across sites, profiled, or subjected to automated decision-making of any kind, including profiling within the meaning of Article 22 GDPR.
Server log data
The site is hosted by Vercel. Each time a page is requested, the hosting infrastructure records technical data that your browser transmits automatically:
- the IP address of the requesting device
- the date and time of the request
- the URL requested and the HTTP status returned
- the referring URL, where your browser sends one
- the browser and operating system reported in the user-agent string
Purpose and legal basis. This data is processed to deliver the site, to keep it stable and secure, and to identify and defend against abuse. The legal basis is Article 6 (1) (f) GDPR — our legitimate interest in operating a functioning and secure website. The data is not used to identify individual visitors and is not combined with any other source.
Retention. Log data is retained by the hosting provider for a short operational period and then deleted, other than where a specific record is needed to investigate a concrete security incident.
Web fonts
Typefaces on this site are loaded from Google Fonts at fonts.googleapis.com and fonts.gstatic.com. When a page loads, your browser makes a request to those servers, and your IP address is transmitted to Google in the process. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose and legal basis. Consistent typography across devices. The legal basis is Article 6 (1) (f) GDPR. Google states that font requests are kept separate from authenticated Google accounts and that no cookies are set by the font delivery domains.
What we intend to change. Self-hosting these fonts would remove the transfer entirely. It is on our list. Until it is done, this paragraph tells you what actually happens rather than what we would prefer to be true. Google's own privacy information is at policies.google.com/privacy.
Contact form and email
The form on the contact page is not yet connected to a server. When you submit it, the details you typed are handed to the email client on your own device as a pre-filled message. Nothing reaches us until you send that email yourself, and no copy of the form is stored on this site or by the hosting provider.
Once you do send it — or if you email us directly — we process the data in your message: your name, your email address, your organisation and role where you give them, and whatever you tell us about the problem.
Purpose and legal basis. Answering your enquiry and, where it leads somewhere, taking steps at your request prior to entering into a contract. The legal basis is Article 6 (1) (b) GDPR for enquiries with a contractual purpose, and Article 6 (1) (f) GDPR for general correspondence.
Retention. Correspondence is kept for as long as it is needed to deal with your enquiry and for any subsequent engagement, then deleted — subject to the retention periods that German commercial and tax law impose on business correspondence, which run to six or ten years depending on the document.
Providing this data is neither required by law nor by contract. You are free to give us only what you want to; without a way to reply, however, we cannot answer.
Recipients
We do not sell personal data and we do not share it for advertising. Data reaches third parties only where they operate part of this site on our behalf:
- Hosting
- Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — serves the site and processes server log data.
- Web fonts
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — receives your IP address when fonts load.
- The provider handling the quenora.ai mailbox, which processes the messages you send us.
Where these providers act as processors under Article 28 GDPR, a data processing agreement is in place.
Transfers outside the EU
Vercel Inc. and Google are US-headquartered. Where personal data is transferred to the United States, the transfer is covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise by the Commission's Standard Contractual Clauses under Article 46 (2) (c) GDPR. You can request a copy of the safeguards we rely on at the address above.
Data security
The site is served over HTTPS only, with HTTP Strict Transport Security, a Content Security Policy that restricts which origins may load resources, and the X-Content-Type-Options, X-Frame-Options and Referrer-Policy headers set. Client correspondence is held in access-controlled accounts.
Your rights
Under the GDPR you may require us to:
- Article 15 — confirm whether we process data about you, and give you a copy of it
- Article 16 — correct data that is inaccurate or incomplete
- Article 17 — erase your data, where none of the grounds for keeping it apply
- Article 18 — restrict processing while a dispute about accuracy or lawfulness is resolved
- Article 20 — provide data you gave us in a structured, machine-readable form, or transmit it to another controller
- Article 21 — object to processing based on legitimate interest, on grounds relating to your particular situation. We then stop unless we can show compelling legitimate grounds that override your interests.
Where processing rests on consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of what was done before.
Write to info@quenora.ai to exercise any of these. We answer within one month, as Article 12 (3) requires.
Complaints
You have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in the Member State of your residence, place of work or the alleged infringement. The authority competent for us is:
Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart, Germany
Changes to this notice
We update this notice when the site or the way we handle data changes — self-hosted fonts and a server-side contact form are both expected, and both will be reflected here before they go live. The date below always states the current version.
Last updated 25 August 2026