Privacy

1. General information

This privacy policy explains which personal data is processed when visiting and using this website.

Personal data means any information that can be used to identify a natural person directly or indirectly, for example name, email address, IP address or technical usage data.

This website is a professional site by Johann Fischer on quality management, artificial intelligence, process improvement and related topics.

2. Controller

The controller for data processing on this website is:

Johann Fischer
Foxley Quality Intelligence
Henkelsweg 8a
87463 Dietmannsried
Deutschland

Email: fox@foxley-quality-intelligence.de

3. Hosting

This website is hosted by the following provider:

STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany

When this website is accessed, the hosting provider processes technically necessary data to deliver the website, maintain system security and detect attacks or misuse.

According to STRATO, IP addresses are recorded in log files when a website is accessed and stored for up to seven days to detect and defend against attacks. STRATO also provides anonymised log file evaluations; hostname or IP address of the accessing client is anonymised in this process.

The legal basis for this processing is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure, stable and efficient provision of the website.

The website is hosted by STRATO GmbH. In the course of hosting, technically necessary server log files may be processed. The conclusion and documentation of data processing pursuant to Art. 28 GDPR must be reviewed and kept up to date by the website operator in the STRATO customer account.

4. Server log files

When visiting this website, the following data in particular may be processed:

  • IP address or anonymised IP address
  • date and time of access
  • page or file accessed
  • referrer URL, if transmitted by the browser
  • browser and browser version used
  • operating system used
  • HTTP status code
  • amount of data transferred

This data is processed to deliver the website technically, maintain stability and security, and trace errors or attacks.

The operator of this website does not merge this data with other data sources.

5. Contact by email

If you contact us by email, the data you provide will be processed. This may include in particular your name, email address, message content, time of contact and technical metadata of the email.

Processing takes place to handle your enquiry and communicate with you.

The legal basis is Art. 6(1)(f) GDPR. Where contact is related to concluding or performing a contract, Art. 6(1)(b) GDPR also applies.

Data is deleted once the enquiry has been finally processed and no statutory retention obligations or legitimate interests in further storage exist.

6. Contact form

No contact form is currently provided on this website.

If a contact form is added later, this privacy policy will be updated before activation. In particular, mandatory fields, purpose of processing, retention period, spam protection and possible recipients must be described.

7. Newsletter

No newsletter is currently offered on this website.

If a newsletter is introduced later, separate consent will be obtained and a double opt-in procedure will be used. The privacy policy will be updated before activation.

8. Cookies and similar technologies

Based on the current technical setup, this website does not use non-essential cookies, advertising trackers or marketing technologies.

Technically necessary cookies or similar storage technologies may be used where required for operation, security or an expressly requested function of the website.

The legal basis for technically necessary processing is Art. 6(1)(f) GDPR. Where access to the end device is strictly necessary, permissibility also depends on Section 25(2) TDDDG.

Non-essential cookies, tracking technologies, marketing pixels or similar technologies are only used after valid consent has been obtained.

9. Web analytics and statistics

9.1 Current status

Based on the current technical setup, this website does not use personal web analytics with user profiles.

STRATO provides statistical evaluations for hosting products based on log files. According to STRATO, hostname or IP address in the log files is anonymised. These evaluations serve to assess technically and in terms of content which pages are accessed how often.

The operator of this website uses this data only in aggregated form and not to identify individual visitors.

9.2 No advertising or marketing trackers

The following are not currently used:

  • Google Analytics
  • Google Tag Manager
  • Meta Pixel
  • LinkedIn Insight Tag
  • TikTok Pixel
  • advertising network tracking
  • session recording
  • heatmaps
  • cross-site tracking

9.3 Comprehension feedback for “Simply explained”

For approved simple explanations, visitors may voluntarily select “Yes”, “Partly” or “No” to say whether the explanation was understandable. Only the deliberate click requests a static path on this website following the pattern /feedback/simple/{language}/{article}/{answer}.json. No free text, account or personal assignment of the response is collected.

The function sets no cookies and does not store the selection permanently or for the browser session. It makes no request to a third party. As with any page request, technically necessary server log data may be created by the host; editorial evaluation uses only the aggregated and anonymised request counts for these feedback paths provided by STRATO. Repeat submissions are not identified on a personal basis. Raw logs or personal data are not copied into the FQI repository.

9.4 Optional future web analytics

If a web analytics tool such as Plausible Analytics, Matomo or a comparable system is used later, this privacy policy will be updated before activation.

The following must be documented:

  • whether cookies or similar technologies are used,
  • whether consent under Section 25 TDDDG is required,
  • which personal data is processed,
  • whether IP addresses are anonymised,
  • where the provider is located,
  • whether data is transferred to third countries,
  • how long data is stored,
  • whether user profiles are created.

No consent-requiring tracking will be activated until technical and legal review has been completed.

10. Embedding of external content

Based on the current technical setup, no external content other than the product images described below is embedded that automatically transfers data to third parties when a page is loaded, in particular no automatically loaded content from:

  • YouTube
  • Google Maps
  • Google Fonts from Google servers
  • social media plugins
  • external tracking or advertising networks

Fonts are displayed using system fonts of the browser or operating system; no fonts are loaded from external servers.

The recommendations page loads editorially selected product images directly from the official servers of the respective rights holder: the book cover from O’Reilly Media via www.oreilly.com and product images from Apple via store.storeimages.cdn-apple.com. When an image is loaded, the respective provider may technically process data such as the IP address, time, requested file, browser and device information. FQI does not embed scripts, iframes, price queries or product widgets from these providers. Further information is available in O’Reilly’s Privacy Policy and Apple’s Privacy Policy.

The images for the recommended Udemy courses are served as local image files from the FQI web server. Merely loading the recommendations page therefore does not establish a connection to Udemy or Impact.

If external content is embedded later, this privacy policy will be updated accordingly. For services requiring consent, valid consent must be obtained before loading, for example via a two-click solution or a consent management system.

Apart from the separately described image requests to O’Reilly and Apple, links to external sources, the FQI shop on Etsy, Amazon, Udemy, Impact and Stripe do not transfer data to the linked destination providers merely by loading this website. Amazon is contacted only when a visitor clicks an affiliate link; commission attribution may then take place.

The labelled Udemy affiliate links first lead to trk.udemy.com, a tracking destination operated by the Impact partner network, and then redirect to Udemy. A connection to Impact and Udemy is established only after a deliberate click. Data such as the IP address, time, browser and device information, the advertising link clicked and a resulting course enrolment may then be processed and stored for commission attribution. Impact or Udemy may use cookies or comparable technologies on their own websites. FQI does not embed any Udemy or Impact scripts, pixels, iframes, cookies or storage access for this purpose. Further information is available in Impact’s Privacy Policy and Udemy’s Privacy Policy.

11. Voluntary support and Stripe

FQI enables voluntary financial support through external payment pages provided by Stripe. No payment form is embedded on this website. Stripe scripts or payment content are not loaded during an ordinary page visit. A connection to Stripe is established only when a visitor deliberately clicks a support link.

Depending on their role, payment processing and data processing may involve Stripe Payments Europe, Limited (SPEL), Stripe Technology Company Limited (STC), and Stripe Technology Europe, Limited for certain regulated payment services, each based in Ireland. Depending on location, contractual arrangements and the selected payment method, other Stripe entities, banks or payment service providers may also be involved.

On the Stripe payment page, data such as name, email address, billing and payment details, IP address, device and browser information, and fraud-prevention information may be processed. The data actually collected depends on the checkout configuration and selected payment method. FQI does not process card or bank account details on its own web server.

Stripe may provide the operator with transaction information required for payment processing, accounting and bookkeeping. This may include the amount, time, payment status and, where collected during checkout, contact or billing details. FQI processes this information to complete the payment initiated by the user and to comply with statutory documentation and retention duties. Stripe also processes certain data under its own responsibility, particularly for payment processing, security and fraud prevention.

Further information is available in Stripe’s Privacy Policy. A successful payment may then redirect to the FQI thank-you page. That page does not read payment details or Checkout Session identifiers.

12. AI-supported content

Some content on this website may have been created, structured, translated or summarised with the support of AI systems.

There is currently no plan to automatically transfer visitors’ personal data to AI services.

If visitors submit content by email, that content may be processed in the course of handling the enquiry. Transfer to external AI services does not take place without separate review and a legal basis.

AI-supported content is editorially reviewed where possible. Further information is available in the AI and editorial notice on this website.

12.1 Foxley Quality Navigator and private beta

The public Foxley Quality Navigator information page identifies the service as a private beta and links to the separate protected application. Merely visiting the information page neither creates a Navigator account nor sets Navigator cookies or transmits input to an AI service.

The Foxley Quality Navigator operates as a protected area at navigator.foxley-quality-intelligence.de for personally invited pilot users. Account setup and authentication process data including the email address, encrypted password hash, account status, invitations and sessions. A technically necessary secure session cookie keeps the user signed in on the Navigator subdomain; it is not used for advertising or audience measurement.

Cases will be assigned to individual accounts and stored in a PostgreSQL database on the STRATO VPS. Administrators may manage accounts and security metadata but will not have application access to other users’ case content. Users may delete their own cases; deleting an account removes its associated live data. Encrypted backups will be retained for no more than 30 days.

Only test, demo and fully anonymised content may be entered during the pilot. Personal data, trade secrets and real customer data are prohibited. Where an AI function is actively used, the anonymised case information entered may be sent to OpenAI for processing. API requests are made server-side with result storage disabled and contain a pseudonymised user identifier instead of the email address. According to OpenAI, API content may generally be retained for up to 30 days for abuse monitoring; API data is not used for training unless the operator explicitly opts in. The OpenAI API Data Usage Policies apply.

The exact contact details, data processing agreements, legal bases and technical settings will undergo a final human legal review before this amended text is published. Every pilot user must accept the applicable versioned data notice when setting up the account.

Personal data is processed on the following legal bases depending on the processing activity:

  • Art. 6(1)(f) GDPR: legitimate interest, in particular secure operation and communication
  • Art. 6(1)(b) GDPR: pre-contractual or contractual measures, where applicable
  • Art. 6(1)(c) GDPR: compliance with statutory duties, in particular commercial and tax documentation, where applicable
  • Art. 6(1)(a) GDPR: consent, where obtained
  • Section 25 TDDDG: access to information on end devices or storage of information on end devices, where applicable

14. Retention period

Personal data is stored only as long as necessary for the respective purposes or statutory retention obligations apply.

According to STRATO, server log data is stored for up to seven days to detect and defend against attacks. Anonymised statistics may be retained longer where no personal reference remains.

Email enquiries are deleted once finally processed and no statutory obligations or legitimate interests oppose deletion.

Payment and accounting data is retained only as long as required for processing, documentation and statutory retention duties. Stripe and participating payment service providers apply their own retention periods as described in their privacy information.

15. Recipients of data

Recipients of personal data may include:

  • STRATO GmbH as hosting provider
  • the site operator’s email provider
  • Stripe and, where applicable, other payment service providers selected by the user for voluntary support
  • O’Reilly Media and Apple as the technical providers of the product images loaded on the recommendations page
  • technical service providers where required for operation, security or maintenance

Data is not disclosed to third parties for advertising purposes.

16. Transfers to third countries

When externally hosted product images are requested on the recommendations page, technical connection data may be processed outside the European Union or the European Economic Area depending on O’Reilly Media’s or Apple’s infrastructure. The respective providers describe their processing and transfer mechanisms in their privacy information.

When a visitor voluntarily uses Stripe’s external payment page, data may also be processed outside the European Union or the European Economic Area depending on the Stripe entity, payment method and technical infrastructure involved. Stripe describes the safeguards and transfer mechanisms it uses in its privacy information.

17. Rights of data subjects

Data subjects have the following rights under the GDPR in particular:

  • right of access under Art. 15 GDPR
  • right to rectification under Art. 16 GDPR
  • right to erasure under Art. 17 GDPR
  • right to restriction of processing under Art. 18 GDPR
  • right to data portability under Art. 20 GDPR
  • right to object under Art. 21 GDPR
  • right to withdraw consent under Art. 7(3) GDPR

The contact address stated above may be used to exercise these rights.

18. Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority if they believe that the processing of their personal data violates data protection law.

The authority responsible may in particular be the data protection supervisory authority of the federal state in which the data subject lives, works or in which the alleged violation occurred.

19. No automated decision-making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place on this website.

20. Currency and changes to this privacy policy

This privacy policy reflects the technical and organisational status of the website at the time of publication.

If new functions are introduced, in particular web analytics, contact forms, newsletters, external embeds, comments, login areas or further payment functions, this privacy policy will be updated before activation.

As of: 24 August 2026