Data protection
Privacy Policy
Version: 20 September 2026
1. Controller
The controller responsible for processing personal data on www.evalcard.com, within the EVALCARD platform and in the user area at my.evalcard.com is:
EvalCert GmbH
Leobersdorfer Straße 26
2560 Berndorf
Austria
Company register number: FN 673183a
Email: info@evalcard.com
You may contact info@evalcard.com at any time with questions concerning data protection or to exercise your rights.
2. Scope and Principles
This Privacy Policy explains which personal data EvalCert processes in connection with the website, the EVALCARD platform, user accounts, EVAL Cards, digital training and competence records, public profiles and the “Verify Record” service.
Personal data is processed only where this is necessary to provide the website or platform, a statutory obligation applies, a legitimate interest exists or you have given valid consent. EvalCert processes data for specified purposes, transparently and only to the extent necessary.
3. Website Visits and Server Log Files
When you visit the website, the hosting and web servers automatically process technical access data. This may include in particular:
the IP address of the accessing device,
the date and time of access,
the page or file requested,
the referrer URL,
browser type and browser version,
the operating system,
the volume of data transferred and the HTTP status code.
This processing is carried out to provide the website technically, maintain its stability and security, and identify and prevent attacks, misuse and errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
Server log files are generally stored only for as long as necessary for these purposes. In the event of a security incident, individual log data may be retained for longer where this is necessary to investigate or prevent the incident or to establish, exercise or defend legal claims.
4. Hosting
The website and technical parts of the platform are hosted by:
Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Germany
Hetzner processes personal data to the extent necessary for hosting, server operation, storage, backups and the technical security of the systems. EvalCert has entered into a data processing agreement with Hetzner pursuant to Article 28 GDPR.
The legal basis is Article 6(1)(f) GDPR. Further information is available in Hetzner’s Privacy Policy.
5. Cookies and Similar Technologies
The website uses strictly necessary cookies and similar technologies where these are required to operate the website, authenticate users, manage sessions, provide security functions or retain your privacy choices.
Strictly necessary cookies are used without separate consent where permitted by Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). The associated processing of personal data is based, depending on its purpose, on Article 6(1)(b) or (f) GDPR.
Non-essential analytics, marketing or other third-party technologies are activated only after you have given prior consent. You may withdraw your consent at any time through the privacy settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
You may also delete or block cookies in your browser settings. This may restrict individual functions of the website or platform.
6. Contacting Us
If you contact us by email, contact form, telephone or another method, we process the data you provide, including your name, contact details, the content of your enquiry, attachments and the resulting correspondence.
The processing is carried out to respond to your enquiry, take steps prior to entering into a contract or perform a contract pursuant to Article 6(1)(b) GDPR. In other cases, it is based on our legitimate interest in proper and efficient communication pursuant to Article 6(1)(f) GDPR.
The data will be deleted once the enquiry has been conclusively dealt with, unless statutory retention obligations, legitimate documentation interests or claims require longer storage.
Registration requests through the website
When you submit a registration request through www.evalcard.com, we process your selected role and contact details and, where provided, company details, country, VAT number, a voluntarily supplied date of birth and your message to handle the request. Submitting the request does not create a platform account. The legal bases and deletion criteria described under “Contacting Us” above apply to these enquiries.
7. Registration and User Accounts
For registration and use of the EVALCARD platform, we process the following data where necessary:
first name and surname,
email address and other contact details,
login and account data,
role, organisation and permissions,
profile information provided by you,
consent and change logs,
technical security and usage data.
The processing is necessary to create, administer and secure the user account and provide the contractually agreed platform functions. The legal basis is Article 6(1)(b) GDPR. Where processing serves security, quality assurance, misuse prevention or traceability, it is based on Article 6(1)(f) GDPR.
You must provide the data required for registration if you wish to create a user account and use the platform. Without this data, it may not be possible to create or use the account.
8. EVAL Cards and Training and Competence Records
The EVALCARD platform enables digital training and competence records to be documented and administered. The data processed may include in particular:
identity and contact data of the Cardholder,
training, assessment and competence data,
training level, validity period and status of a record,
data relating to the issuing training organisation or trainer,
issuance, amendment and review logs,
evidence and documentation required for quality assurance or verification.
The processing is carried out to create, administer, trace and verify records and to perform the relevant agreement. The legal basis is generally Article 6(1)(b) GDPR. Where statutory retention obligations, misuse prevention, quality assurance or the establishment, exercise or defence of legal claims are concerned, the processing is based on Article 6(1)(c) or (f) GDPR.
Training and qualification data do not generally constitute special categories of personal data within the meaning of Article 9 GDPR. Health data, biometric data, data revealing political opinions or religious beliefs, and other specially protected data should not be entered into the platform unless expressly required and supported by an appropriate legal basis.
9. Data Submitted by Training Organisations, Trainers and Employers
Training organisations, trainers, employers or other authorised entities may submit data to EvalCert for the creation or administration of a record.
Depending on the specific arrangement, the submitting entity may be an independent controller, EvalCert may act as a processor, or EvalCert and the submitting entity may be joint controllers. The respective data protection roles depend on the actual purposes and decisions concerning the processing and, where required, will be governed by an agreement pursuant to Article 26 or Article 28 GDPR.
The submitting entity is responsible for informing the data subject about the submission and ensuring the necessary legal bases, consents or other requirements. EvalCert may request information and evidence required to verify the authority and accuracy of the submission.
10. Public Profiles
The platform may enable users to create a publicly accessible profile. Information is published only to the extent released by the user or made publicly accessible on another appropriate legal basis.
Depending on the user’s selection, visible information may include the user’s name, profile image, role, organisation, training levels, validity status or professional details. Information that is not required, including date of birth, home address, private contact details, login data or internal assessment records, is not displayed publicly.
The publication of voluntary profile information is based on your consent pursuant to Article 6(1)(a) GDPR or, where applicable, on a contractual agreement. You may end publication through your account or withdraw your consent at any time. Content previously copied or stored by third parties cannot always be retrieved as a result.
11. “Verify Record” Service and QR Codes
The EVALCARD platform may provide a public function for verifying the authenticity and status of a record. Verification is carried out using an individual verification code, QR code or unique verification URL. A free search for persons by name is not provided.
When a verification request is made, the IP address, time of the request, verification URL accessed, browser data and the result may be processed where technically necessary. Only information required and released for reliable verification is displayed. This may include the name or an abbreviated form of the name, record type, training level, issuing entity, issue date, validity status and expiry date.
The date of birth is not required or displayed for standard public verification. Additional identity information may be requested only where necessary for a specific purpose and supported by an appropriate legal basis.
The provision of verification information released by the Cardholder is based on Article 6(1)(a) or (b) GDPR. Logging and securing verification requests is based on our legitimate interest in preventing forgery, misuse and unauthorised queries pursuant to Article 6(1)(f) GDPR.
12. Newsletter
If you subscribe to a newsletter offered on the website, we process your email address and the evidence required for the registration procedure, including the time, content and, where applicable, the IP address of the registration. Registration is generally carried out using a double opt-in procedure.
The processing is based exclusively on your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time using the unsubscribe link in the newsletter or by emailing info@evalcard.com. Following unsubscribe, the address is removed from the active distribution list. A suppression list may be maintained where necessary to prevent further mailings contrary to your withdrawal; the legal basis is Article 6(1)(f) GDPR.
13. Google Maps
Google Maps may be embedded on individual pages to display locations or directions. Google Maps is loaded only after you have consented to the required processing or another legal basis applies to the specific use.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map is loaded, the IP address, browser and device data, and information about use of the map may be transmitted to Google. Processing in third countries, particularly the United States, cannot be ruled out.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021 where access to information on the user’s device or the use of cookies is involved. Consent may be withdrawn at any time through the privacy settings. Further information is available in Google’s Privacy Policy.
14. Protection against spam and automated access
The contact and registration request forms on www.evalcard.com use a honeypot field. This form field is not visible to regular visitors and helps identify automated submissions. Google reCAPTCHA is not loaded in these website forms, and the honeypot does not transmit data to Google.
The following information concerns any use of Google reCAPTCHA outside these website forms:
Google reCAPTCHA may be used to protect forms and other functions against spam, automated access and misuse. reCAPTCHA may process technical device and usage data, IP address, browser characteristics, mouse movements, length of stay and other signals used to identify automated access.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where reCAPTCHA is loaded only after consent, the legal basis is Article 6(1)(a) GDPR. Where it is used solely for the technically necessary protection of a function requested by you, processing may be based on Article 6(1)(f) GDPR and the applicable telecommunications-law exceptions. The specific use must be identified in the privacy settings.
Processing in third countries, particularly the United States, cannot be ruled out. Further information is available in Google’s Privacy Policy and Google’s Terms of Service.
15. Paid Services and Payments
If you book paid services, we process the data required for quotations, contracts, billing and customer support, including your name, contact details, company details, booked service, invoice details and payment status. The legal basis is Article 6(1)(b) GDPR and, where required by law, Article 6(1)(c) GDPR.
Payment service providers may be used for technical payment processing. The payment service provider used, the scope of the data transmitted and the applicable privacy information will be identified during the ordering process or in supplementary privacy information. EvalCert stores payment data only to the extent necessary for billing, evidence or statutory retention.
16. Recipients and Processors
Personal data may be disclosed, to the extent necessary, to the following recipients or categories of recipients:
hosting, storage, backup and IT security providers,
technical providers supporting the operation, maintenance and support of the platform,
training organisations, trainers, employers or other authorised Issuing Entities where required for a record,
payment and billing service providers where a paid service is used,
tax advisers, legal advisers, debt collection providers or other entities engaged to pursue legal rights,
public authorities, courts or other entities where disclosure is required by law.
Processors are carefully selected and contractually bound pursuant to Article 28 GDPR. Data is not disclosed for third parties’ own marketing purposes without an appropriate legal basis.
17. Transfers to Third Countries
EvalCert endeavours to process personal data within the European Union or European Economic Area. Where a service provider processes data in a third country, the transfer is made only where the requirements of Articles 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, appropriate safeguards such as standard contractual clauses, or a statutory derogation.
For individual third-party providers, particularly Google services, processing in the United States or another third country cannot be ruled out. Details are provided in the relevant section and in the provider’s privacy information.
18. Retention Periods
EvalCert stores personal data only for as long as required for the relevant purpose. Relevant criteria include in particular:
the duration of the user account and use of the platform,
the validity period and required traceability of a training or competence record,
statutory retention periods, including tax and company-law obligations,
limitation periods for the establishment, exercise or defence of legal claims,
the duration of consent and the documentation required to demonstrate that consent.
Once the relevant purpose no longer applies, the data is deleted or, where deletion is impossible or disproportionate, anonymised or blocked against further processing.
19. Data Security
EvalCert implements appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised access and other unlawful processing. These measures include access controls, authorisation concepts, encryption in transit, logging of security-relevant events and regular review of the systems used.
Data transmitted between your browser and the website is generally protected by an encrypted HTTPS connection. However, complete protection against all risks associated with the internet cannot be guaranteed.
20. Automated Decision-Making and Profiling
EvalCert does not generally make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Automated security and filtering systems may be used to identify spam, malware, manipulation and unusual usage patterns. A measure that materially affects a user account or record may be reviewed by a natural person following a reasoned objection.
21. Your Rights
Subject to the statutory requirements, you have the following rights:
the right of access to personal data pursuant to Article 15 GDPR,
the right to rectification of inaccurate data or completion of incomplete data pursuant to Article 16 GDPR,
the right to erasure pursuant to Article 17 GDPR,
the right to restriction of processing pursuant to Article 18 GDPR,
the right to data portability pursuant to Article 20 GDPR,
the right to object to processing based on Article 6(1)(e) or (f) GDPR pursuant to Article 21 GDPR,
the right to withdraw consent with effect for the future.
To exercise your rights, send a message to info@evalcard.com. To prevent unauthorised disclosure, EvalCert may request appropriate evidence of identity. Requests will generally be answered within the statutory period.
22. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR or other data protection law.
The competent Austrian supervisory authority is in particular:
Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Website: https://dsb.gv.at/
23. External Links and Services
The website may contain links to third-party websites or services. The relevant operator is responsible for processing personal data on those external websites. The privacy policies published there apply.
24. Amendments to this Privacy Policy
EvalCert may amend this Privacy Policy if the website, platform, services used or statutory requirements change. The version published on this website at the relevant time applies.