Privacy Policy

1. Controller

The controller responsible for processing personal data on oilcue.de is:

360 Creations LLP
1103 – 11871 Horseshoe Way, Suite 1103, 2nd Floor
Richmond BC V7A 5H5
Canada
Registration no.: LL01529, British Columbia Registry Services
Email: hallo@oilcue.de

For any questions about data protection or to exercise your rights, you can contact us at any time at hallo@oilcue.de.

2. What this platform is about

OilCue provides essential oil consultants (“consultants”) with their own online quiz. We therefore process data from two groups:

• consultants who create an account and set up their quiz (section 5), and
• visitors who use a quiz (section 4).

We do not use any analytics or tracking tools, advertising or marketing cookies, or social media plugins, and we do not load fonts or scripts from third-party servers.

3. Hosting, server logs and encryption

The platform is hosted by ALL-INKL.COM – Neue Medien Münnich, Friedersdorf (Germany) in Germany. Whenever a page is accessed, the server processes technically necessary data: IP address, date and time of access, requested address, amount of data transferred, status code, browser and operating system, and the previously visited page. Without this data, pages cannot be delivered and attacks cannot be prevented.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the platform. The logs are deleted by the host in accordance with its own rules. We do not analyse them ourselves or combine them with other data. We have concluded a data processing agreement with the host under Art. 28 GDPR.

All pages are transmitted in encrypted form (HTTPS/TLS).

4. When you use a quiz

4.1 Your answers

The quiz evaluates your answers only in your browser. Your answers are not sent to us and are not stored anywhere. The recommendation at the end is a suggestion, not a decision with legal effect within the meaning of Art. 22 GDPR, and not medical advice.

4.2 Storage in your browser

So that the quiz remembers your chosen language and country on your next visit, it stores the entries oqLang and oqCountry in your browser’s storage (localStorage). They stay on your device, are not sent to us and can be deleted at any time in your browser settings. The legal basis is Section 25(2) No. 2 of the German TDDDG, as the storage is necessary for the function you have requested.

4.3 Anonymous counters

So that a consultant can see how her quiz is used, we count for each quiz how often it was opened, started and completed and how often a set was clicked. Only these numbers are stored, with no link to any person. To avoid counting a visit more than once, we create a non-reversible check value from your IP address using a secret key. It is deleted automatically after 30 minutes. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is providing the consultant with privacy-friendly usage statistics.

4.4 Contact form

If you send the consultant a question using the form, we forward your name, email address and, if provided, phone number and message by email to the consultant, together with your quiz result (recommended oil, suitable companions, chosen topic, topic profile, country and language). The legal basis is your consent under Art. 6(1)(a) GDPR, which you give in the form and can withdraw at any time with effect for the future.

OilCue does not store this request: there is no database of requests, no customer list and no archive. Once sent, the message is only in the consultant’s inbox. When forwarding it, we act as the consultant’s processor. The consultant is responsible for anything she does with your details afterwards (replying, advising, keeping them). You can find her contact details and, where applicable, her own privacy policy in the quiz under “Legal notice” and “Privacy”.

To prevent misuse, we allow no more than five requests per hour from the same IP address. For this purpose, we store a non-reversible check value derived from your IP address for one hour. In addition, a timestamp and an invisible field check whether the form is being filled in by a human. The legal basis is Art. 6(1)(f) GDPR.

4.5 Links to shops and WhatsApp

The order links lead to the shops of the respective company. Only when you click such a link do you leave OilCue; the shop’s privacy policy applies there. The “Message me on WhatsApp” button opens WhatsApp (Meta Platforms Ireland Ltd.) only when you click it. No data is sent to WhatsApp before that.

4.6 Sample quiz

The sample quiz at /beispiel uses made-up data. It does not count anything, and its contact form does not send any messages.

5. When you register as a consultant

5.1 What data we process

• At registration: first name, email address, the company you work with, and the time you accepted the Terms of Use.
• In My account, if you enter them: name shown in the quiz, photo, greeting, website, WhatsApp number, email address for requests, countries, sets with oils and order links, legal notice details, link to your privacy policy, your personal link and, where applicable, your own domain, and the language and colour of your quiz.
• Automatically: the anonymous counters of your quiz (section 4.3), the language in which you use the platform, and the status of your account.

5.2 Purpose and legal basis

We process this data to provide your account and your quiz (Art. 6(1)(b) GDPR). The following is publicly visible in the quiz: name, photo, greeting, website, WhatsApp number (as a link), your legal notice details and your sets with order links. Your email address is not displayed unless you add it to your legal notice yourself. We use your details solely to operate your quiz, do not pass them on and do not change your order links.

5.3 Login without a password

To log in, we send you a link by email. It contains a random one-time key, which we store only in encrypted (hashed) form. The link is valid for one hour (48 hours after registration) and works only once. To prevent misuse, we limit registrations and link requests to five per hour per IP address; for this, we store a non-reversible check value derived from the IP address for one hour (Art. 6(1)(f) GDPR).

5.4 Cookies after login

When you are logged in, WordPress sets technically necessary login cookies (wordpress_logged_in_…, wordpress_sec_…, valid for up to 14 days or until you log out). Without them, you cannot use My account. The legal basis is Section 25(2) No. 2 TDDDG.

5.5 Emails

We send login links, requests from your quiz and important notices about your account from mail@oilcue.de via our email account at ALL-INKL.COM – Neue Medien Münnich, Friedersdorf (Germany). When someone registers, submits a review or adds their own domain, we receive a short notification with your name, email address, company and link.

5.6 Own domain

If you connect your own domain, we store the domain and its status. To check whether it points to the platform, we query public DNS records.

5.7 Storage period

We store your data for as long as your account exists. If you would like your account deleted, simply send an email to hallo@oilcue.de. We will then delete your profile, photo, counters and review. Statutory retention obligations remain unaffected.

6. Reviews

Once your quiz is online, you can rate OilCue in My account with one to five stars and a short text. We store the stars, text, date and whether you agreed to publication. Only if you agree and we approve the review will it appear on the start page with your first name, photo and company. The legal basis is your consent (Art. 6(1)(a) GDPR). You can change or delete your review in My account at any time; it will then also disappear from the start page.

7. Language selection and notices in the browser

If you select a language at the top, we store your choice for one year in the cookie oilcue_lang (content: de, en or es). If you are logged in as a consultant, we also remember the language in your account so that emails to you arrive in that language. If you close the notice showing the number of users on the start page, your browser remembers this until the end of the session (sessionStorage oilcue_toast). The legal basis is Section 25(2) No. 2 TDDDG.

8. Support requests

If you email us, we process your email address and the content of your message in order to reply. The legal basis is Art. 6(1)(b) GDPR where your account is concerned, otherwise Art. 6(1)(f) GDPR. We delete the messages once they have been dealt with and no retention obligations apply.

9. Recipients and transfers to third countries

The only recipients of your data are our host, acting as processor, and, for requests made via the contact form, the respective consultant. We do not sell data and do not pass it on for advertising purposes.

The data is stored on servers in Germany. The operator is based in Canada and accesses the platform remotely, in encrypted form, for operation and support. For Canada there is an adequacy decision of the European Commission (Decision 2002/2/EC) confirming an adequate level of data protection.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To do so, simply write to us at hallo@oilcue.de. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work (Art. 77 GDPR).

Once sent, data from a quiz’s contact form is held only by the respective consultant. For access to or deletion of this data, please contact her directly.

11. Obligation to provide data

You do not have to provide any personal data to use a quiz. For a consultant account we need your first name and email address; without them we cannot provide you with an account or login links.

12. Changes

We update this privacy policy when the platform or the legal situation changes. The version published here applies. We inform registered consultants of material changes by email.