Privacy Policy

Note: This is a courtesy translation. Only the German version is legally binding.

As of: October 2026

1. Controller

The controller responsible for the processing of personal data on this website and for business accounts is Jens Wiemann, c/o DEVDEER GmbH, Herderstraße 31, 39108 Magdeburg, Germany. Please address privacy enquiries to datenschutz@wait-in-q.com.

Wait-in-Q is a service for businesses that admit their guests to a virtual queue via QR code. We distinguish three groups: website visitors, businesses with an account, and guests in a queue. For the data of guests, the respective business is the controller, and we process it on its behalf (Art. 28 GDPR (DSGVO)).

2. Visiting the Website and Server Logs

When you access the website, our hosting provider processes technically necessary data, in particular IP address, date and time, requested address, status code and browser information. We process this data to provide the service and to ensure its security and stability (Art. 6 (1) (f) GDPR). These operational logs are generally stored for up to 30 days.

The website is operated on Microsoft Azure in the data centre in the Netherlands (region West Europe).

3. Guests in a Queue

When you scan a QR code and join a queue, you need neither an account nor an app. In doing so, we process on behalf of the business:

a name or nickname of your choice (you can also use a pseudonym),
your ticket number, position in the queue and points in time (joining, call, completion),
a technical identifier and a secret access key that is stored in your browser so that only you can see and change your place,
if you enable notifications: your browser's push subscription (address of the push service of your browser provider and key). Your browser asks for your permission beforehand. You can revoke it at any time in your browser settings.

The purpose is to operate the business's queue and to call you (Art. 6 (1) (b) or (f) GDPR; for push notifications Art. 6 (1) (a) GDPR).

Storage period: Your entry is deleted as soon as your service is completed, and at the latest 48 hours after an abandoned entry. For the business's statistics (for example average waiting time), a history entry with the name you chose and the points in time remains until the business deletes its account; when the account is deleted, the name is anonymised. Therefore, do not choose a name that you do not want to have stored.

The business can see your queue data.

4. Businesses (Account Holders)

When you create an account, we process:

sign-in data via Microsoft Entra External ID (e-mail address, name, account identifier),
information about the business (name, e-mail, telephone, address, description, logo), queues and settings,
subscription information (plan, status, terms, identifiers at Stripe).

For paid plans, Stripe processes your payment data (for example card data). We do not receive the card data, only the payment status. We send you service e-mails about your subscription (for example payment confirmation, failed payment, cancellation, payment dispute) via the e-mail service Resend.

The legal bases are performance of the contract (Art. 6 (1) (b) GDPR), statutory retention obligations under tax and commercial law (Art. 6 (1) (c) GDPR) and our legitimate interest in security and prevention of abuse (Art. 6 (1) (f) GDPR).

Storage period: We store your data for as long as your account exists. If you delete your account, it can be restored for 30 days and is deleted afterwards. We retain invoice and billing data for as long as tax and commercial law require (currently up to ten years).

5. Technical Operating Data (Telemetry)

We use Microsoft Application Insights to detect errors and performance problems.

On the server side, we process technical operating data of the service interface (functions called, response times, errors, pseudonymous identifiers of account and business). This serves operational security and troubleshooting (Art. 6 (1) (f) GDPR) and takes place without cookies. The data is generally stored for up to 30 days.

In the browser, we use Application Insights only with your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). In that case, we collect page views, session duration, browser type, rough geographic region, performance metrics and error reports, and set cookies for this purpose (ai_user, ai_session). Without your consent, no analytics cookies are set and no analytics data is sent from the browser.

6. Cookies and Local Storage

Technically necessary (§ 25 (2) no. 2 TDDDG) and used without consent:

your cookie decision,
language and theme selection,
sign-in status of businesses (token in the browser's local storage),
the guests' secret access key for their place in the queue,
user interface settings (for example automatic advancing),
in the area for businesses (dashboard, subscription and payment), the Stripe script, which may set its own identifiers for fraud prevention.

Analytics is active only with consent (Section 5). You can withdraw your consent at any time with effect for the future, via "Cookie Settings" in the footer of the public pages or in the user menu of signed-in businesses. Withdrawal does not affect the lawfulness of processing carried out up to that point.

7. Recipients and Processors

We use the following service providers, with whom we conclude data processing agreements under Art. 28 GDPR:

Microsoft (Azure hosting and database, Application Insights, Microsoft Entra External ID for sign-in),
Stripe (payment processing for paid plans),
Resend (sending of service e-mails to businesses),
Provider of your browser's push service (for example Google, Mozilla, Apple, Microsoft), if you enable notifications as a guest. This provider is determined by your browser, not by us.

Data is disclosed to other third parties only if we are legally obliged to do so. Queue data is visible to the business in whose queue you are waiting.

8. Transfers to Third Countries

Some service providers are based in the USA or may process data there (Microsoft Corporation, Stripe, Inc., Resend, Inc.). We base the transfer on the adequacy decision on the EU-US Data Privacy Framework where the provider is certified there, and otherwise on EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in the providers' data processing terms. You can obtain a copy of the safeguards in place on request at datenschutz@wait-in-q.com.

9. Your Rights

Vis-à-vis the respective controller, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent given at any time.

If, as a guest, you wish to assert rights regarding data relating to a particular business, please contact that business. You can also contact us at datenschutz@wait-in-q.com; we will forward your request.

You have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragter für den Datenschutz Sachsen-Anhalt) or the authority at your place of residence.

10. Obligation to Provide Data, Automated Decisions

As a guest, you do not have to provide any information beyond a name of your choice. Businesses must provide the sign-in and operating data for an account. There is no automated decision-making, including profiling.

11. Changes

We will amend this policy if the service or the legal situation changes. The version most recently published applies.