Privacy Policy

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

We collect personal data directly from you, automatically when you use Our Website or Platform, and, where applicable, from third parties.

We collect personal data directly from you when you: • create or manage an account on the Platform • request a demo, contact us or request customer support • submit an enquiry, provide feedback or participate in a survey • communicate with us by email, telephone or other communication channels; or • otherwise provide personal data to us through Our Website or Platform.

We collect certain personal data automatically when you: • visit or interact with Our Website; • access or use the Platform and its features • interact with Our emails or other electronic communications

This information may be collected through cookies and similar technologies, server logs, analytics tools and other technical systems. Further information about the cookies and similar technologies we use is provided in our Cookie Policy at rabbitqa.com/cookies.

We may also receive personal data about you from: • the organisation that subscribes to the Platform and creates or administers your user account; • third-party services and systems integrated with the Platform • service providers that support our account management, customer relationship management, analytics and communications activities; and • our business partners, where permitted by applicable law.

We do not collect any special categories of personal data about you, nor do we collect any information about criminal convictions and offences.

We will only use your personal data when the law allows us to. We use your personal data to: • create, administer and secure your account and verify your identity • provide, operate and maintain the Platform and the services made available through it; • manage your subscription, billing and related transactions, where applicable • communicate with you regarding your account, the Platform and the services, including service announcements, updates and security notifications; • respond to your enquiries, provide technical and customer support and resolve reported issues; • monitor and analyse the use, performance and security of Our Website and Platform • improve and develop the Website, Platform, services and user experience, • detect, prevent and investigate fraud, unauthorised access, security incidents and misuse of the Platform; • comply with Our legal and regulatory obligations and establish, exercise or defend legal claims,

We process your personal data only where we have a valid legal basis under GDPR. Depending on the relevant processing activity, we rely on the following legal bases:

Performance of a Contract: Where you are a party to a contract with Us, we process your personal data where necessary to enter into or perform that contract, including to create and administer your account, provide access to the Platform, manage your subscription and billing, and provide customer support.

Legitimate Interest: We process your personal data where necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your interests, rights or freedoms. These interests include operating, securing, maintaining and improving Our Website and Platform; administering user accounts on behalf of Our customers; communicating with users; providing support; analysing Platform usage and performance; preventing fraud, misuse and security incidents; managing Our business relationships; and establishing, exercising or defending legal claims.

Compliance with Legal Obligations: We process your personal data where necessary to comply with applicable legal and regulatory obligations, including accounting, tax, record-keeping and lawful disclosure obligations.

We implement appropriate technical and organisational measures to safeguard the personal data we collect and process. These measures are designed to protect personal data against accidental or unlawful destruction, loss or alteration, as well as unauthorised disclosure or access, and to provide a level of security appropriate to the risks associated with the processing. If you have any questions regarding the security of your personal data, you may contact Us using the contact details provided in this Privacy Policy.

Notwithstanding the security measures that We take, it is important to remember that the transmission of data via the internet may not be completely secure and that you are advised to take suitable precautions when transmitting to Us data via the internet.

This Privacy Policy applies only where we process personal data as a controller and does not apply to Customer Content. “Customer Content” means any materials or information submitted, uploaded, generated or otherwise made available by or on behalf of a customer through or in connection with the Platform, including: (i) the contents of any website, mobile application or other digital product, including application binaries or packages; (ii) automation scripts, screenshots, logs, test results and other materials or outputs created or supplied in connection with testing, development or the customer’s use of the services; and (iii) any other information submitted through the Platform in connection with the customer’s use of the services, excluding account administration, user management and subscription information.

The services are designed to operate without requiring Customer Content to contain personal data. Customers must therefore ensure that no personal data is submitted, uploaded, stored or transmitted through the Platform as part of Customer Content. This restriction does not apply to personal data provided for account administration, user management or subscription purposes, which is excluded from Customer Content. Where Customer Content nevertheless contains personal data and we process such data on behalf of a customer, the relevant processing will be governed by our agreement and applicable data processing terms with that customer.

We retain your personal data only for as long as necessary for the purposes for which it was collected or where there is an ongoing legitimate business or legal need to do so. In determining the applicable retention period, We consider the nature of the personal data, the purposes of the processing, the duration of your account or Our relationship with you, applicable statutory retention and limitation periods, and the need to maintain accurate financial and business records, resolve disputes, enforce Our agreements, and establish, exercise or defend legal claims.

Where there is no longer a need to retain your personal data, We will delete or anonymise it. If immediate deletion is not possible, We will securely store and isolate the relevant personal data from further processing until deletion becomes possible.

We may share your personal data, where necessary and lawful, with the following recipients: • Our affiliates and group companies, for internal administration, business operations and the provision and improvement of Our services; • cloud hosting, IT, security and technical service providers, to host, maintain, secure and support Our Website, Platform and related infrastructure; • analytics and artificial intelligence service providers, to analyse Platform usage, monitor performance and support the operation, development and improvement of Our services; • third-party systems integrated with the Platform, at the request of you or the organisation you represent, to establish and operate the relevant integration and provide the requested Platform functionality; • professional advisers, including lawyers, auditors, accountants and insurers, to obtain professional advice, comply with legal and financial obligations and establish, exercise or defend legal claims; • courts, regulatory authorities, law enforcement bodies and other public authorities, where disclosure is required to comply with applicable law, a legal process or a binding request; and • potential purchasers, successors and their advisers, where necessary in connection with a merger, acquisition, restructuring, financing or transfer of all or part of Our business.

We require service providers processing personal data on Our behalf to use such data only for the specified purposes and to implement appropriate confidentiality, security and data protection measures.

We do not sell your personal data.

The information that We collect from you may be transferred to and stored in a country outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for Us or Our partners.

If you are a resident of the EEA and your personal data is processed outside the EEA, We will ensure that appropriate safeguards are in place, for instance by entering into standard contractual clauses for the transfer of personal data as approved by the European Commission pursuant to Article 46 of the GDPR, or We will ask for your prior explicit consent to such international data transfers.

Where the GDPR applies to the processing of your personal data, you have the following rights:

Right to be informed: You are entitled to know whether we hold your personal data and the purpose your personal data is processed for.

Right of access: You are entitled to obtain a copy of your personal data, together with an explanation of the categories of personal data being processed, the purposes of such processing, and the details of third parties to whom the personal data may have been disclosed to.

Right to rectification: You are entitled to request the correction of inaccurate personal data and the completion of incomplete personal data held by Us.

Right to erasure: You are entitled to request the erasure of your personal data in certain circumstances. We may retain personal data where its retention is required or permitted by applicable law, including compliance with legal obligations, fraud prevention and the establishment, exercise or defence of legal claims.

Right to data portability: You have the right to request that We transfer the data that We have collected to another organization, or directly to you, under certain conditions.

Right to object/restrict processing or both: You have a right to object / restrict the processing of your personal data in some circumstances, including where the personal data is inaccurate (for the period during which we are verifying the personal data), the personal data is no longer required in light of the purpose of processing. You shall also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning and similarly significantly affecting you.

Right to withdraw consent: Where We rely on your consent, you may withdraw it at any time. The withdrawal of consent will not affect the lawfulness of processing carried out before its withdrawal.

To exercise any of the rights described above, you may contact Us using the contact details provided in the “Contact Us” section of this Privacy Policy. You also have the right to lodge a complaint with a competent supervisory authority if you consider that the processing of your personal data infringes applicable data protection laws.

Our Website and Platform may contain links to third-party websites. This Privacy Policy applies only to Our Website and Platform. If you access a third-party website through such links, you should review the privacy policy applicable to that website.

We may change this Privacy Policy as we may deem necessary from time to time, or as may be required by law. Your continued use of our services after any changes or revisions to this Privacy Policy indicates your agreement to the terms of the revised Privacy Policy. We recommend that you check this page regularly to keep up-to-date.

If you have any questions about this Privacy Policy, the personal data We hold about you or the exercise of your data protection rights, you may contact Us using the details below:

Company Name: RabbitQA GmbH Company Address: Kurfürstendamm 237, 10719 Berlin, Germany Email Address: [email protected]