Privacy Policy
Last updated: 2026-08-05
1. Controller and contact
Clanker GmbH, Gumpendorfer Straße 36/46, 1060 Vienna, Austria. Qualidex is a brand of Clanker GmbH.
For privacy inquiries: [email protected]
2. Roles: controller and processor
For data relating to our website visitors, prospects and customer accounts, we act as controller within the meaning of the GDPR.
For customer data that clients submit to Qualidex for validation and harmonization (such as email addresses, phone numbers, names, company and address data), we act exclusively as a processor under Art. 28 GDPR. The respective client remains the controller. The basis is a data processing agreement (DPA) that we conclude with every client. We process such data only on documented instructions, exclusively to provide the commissioned services, and never for our own purposes.
3. Categories of data processed
3.1 Account data
Name, business email address, password (hashed), company affiliation, language preference and two-factor authentication settings.
3.2 Order data (our clients' customer data)
The records submitted by clients, in particular email addresses, phone numbers, names, company names and addresses, as well as the validation and harmonization results generated from them. This data is processed with tenant isolation and encryption (see section 9).
3.3 Billing data
Billing name, company name, billing address, VAT ID and payment information. We do not store full credit card numbers.
3.4 Usage and security logs
Technical logs of sign-ins, API access and security-relevant events, including IP address, timestamp and user identifier.
3.5 Contact and sales inquiries
Information you provide with demo, pricing or analysis requests (name, business contact details, content of the inquiry).
4. Purposes and legal bases
- Performance of contract (Art. 6(1)(b) GDPR): providing the platform, carrying out validation and harmonization orders, billing.
- Legitimate interest (Art. 6(1)(f) GDPR): security and abuse prevention, service improvement, responding to inquiries.
- Legal obligation (Art. 6(1)(c) GDPR): retention and documentation duties, in particular under tax and company law.
5. How validation works
For email validation we check syntax, domain and mail servers (MX) and perform an SMTP handshake with the responsible mail server; no email is ever sent to the address being checked. For phone number verification, the number is submitted to network query services (HLR/carrier lookup); no call is made and no SMS is sent to the number being checked.
6. Recipients and subprocessors
We use carefully selected service providers as further processors, in particular hosting providers with ISO 27001-certified data centers in the EU, network query services for phone validation, and payment and email service providers. Data processing agreements are in place with all subprocessors. A current list of subprocessors is available to clients on request.
7. Third-country transfers
Order data is processed exclusively in data centers within the European Union. No transfers to third countries take place.
8. Retention and deletion
Order data is deleted after completion of the respective order or at the end of the contract – on request with a deletion certificate, at the latest within 30 days, unless statutory retention obligations require otherwise. We store account and billing data for the duration of the business relationship and beyond that within statutory retention periods.
9. Data security
We implement technical and organizational measures pursuant to Art. 32 GDPR, in particular transport encryption (TLS 1.3), encryption at rest (AES-256), tenant isolation, role-based access controls, two-factor authentication and complete audit logs.
10. Cookies and analytics
Our website only uses technically necessary cookies. No third-party tracking takes place.
11. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Please contact [email protected]. If your request concerns customer data processed on behalf of one of our clients, we will forward it to the responsible client or refer you to them.
You also have the right to lodge a complaint with a supervisory authority; in Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna.
12. Changes to this policy
We update this privacy policy when the service or the legal situation changes. The current version is always available on this page.
13. Contact
Clanker GmbH, Gumpendorfer Straße 36/46, 1060 Vienna, Austria · [email protected]