Privacy policy

DRAFT — must be reviewed by a lawyer. This text was produced as a first draft and is not legal advice. It must be reviewed and adapted to the actual circumstances before publication.

The German version is authoritative. This translation is provided for convenience only.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Austrian Datenschutzgesetz (DSG, Austrian Data Protection Act). Below we inform you which data we process, for which purpose and on which legal basis.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

[COMPANY NAME AS PER COMPANIES REGISTER] [STREET AND NUMBER] [POSTCODE] [CITY], Austria

Phone: [PHONE] Email: [DATA PROTECTION EMAIL ADDRESS] Firmenbuch number (company register number): [COMPANIES REGISTER NUMBER]

2. Data protection officer

[DATA PROTECTION OFFICER — NAME AND CONTACT DETAILS OR NOT APPLICABLE]

[TO VERIFY: An obligation to appoint a data protection officer arises under Art. 37(1) GDPR only in certain cases — in particular where data subjects are monitored regularly and systematically on a large scale, or where special categories of personal data are processed on a large scale. For a company of this size and activity, no such obligation normally exists. Unlike Germany, Austrian law has no appointment threshold tied purely to the number of employees. The assessment must be confirmed before publication. If no data protection officer is appointed, this section should be replaced by a reference to the general contact address.]

3. Server log files

When this website is accessed, the hosting provider automatically stores data transmitted by your browser in what are known as server log files.

Data processed:

truncated or full IP address [TO VERIFY: whether the IP address is stored in truncated form — the statement must match the actual server configuration]
date and time of access
address accessed (URL) and volume of data transferred
message about successful retrieval (HTTP status code)
browser type and version, operating system used
referrer URL

Purpose: technical provision and delivery of the website, safeguarding system security and stability, detecting and defending against attacks, and error analysis.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and undisturbed operation of the website.

Retention period: [RETENTION PERIOD SERVER LOG FILES] [TO VERIFY: common practice is short periods of a few days to weeks; the actual configuration of the hosting provider governs and must be entered here]

These data are not combined with other data sources in order to identify individuals.

4. Contact form and contact by email or telephone

If you contact us through the contact form, by email or by telephone, we process the data you transmit in order to deal with your enquiry.

Data processed: [MANDATORY FIELDS OF THE CONTACT FORM — e.g. name, email address, company, message], together with any further data you provide voluntarily.

Purpose: handling and answering your enquiry, and initiating a possible business relationship.

Legal basis:

Art. 6(1)(b) GDPR, where your enquiry is directed at concluding or performing a contract (pre-contractual measures);
Art. 6(1)(f) GDPR otherwise. Our legitimate interest lies in answering enquiries addressed to us.

Providing the data marked as mandatory is necessary for us to process your enquiry. Without them we cannot answer it.

The form is processed through a backend we operate ourselves. Form data is not passed on to third parties for advertising purposes.

To protect against automated abuse we use [SPAM PROTECTION METHOD — e.g. server-side rate limiting, honeypot field]. [TO VERIFY: If an external service is used for spam protection, it must be named separately here together with the provider, purpose and legal basis.]

Retention period: [RETENTION PERIOD ENQUIRIES]. If the enquiry leads to a contractual relationship, the statutory retention periods apply. [TO VERIFY: retention periods under § 212 UGB (Austrian Commercial Code) and § 132 BAO (Bundesabgabenordnung, Austrian Federal Fiscal Code) — have the exact period and its starting point confirmed by a lawyer or tax adviser.]

5. Appointment booking

You can book a meeting on this website. For scheduling we use [APPOINTMENT BOOKING SERVICE — Cal.com, self-hosted or as a cloud service].

Data processed: [FIELDS COLLECTED — e.g. name, email address, preferred slot, time zone, subject of the meeting], technical connection data.

Purpose: arranging, administering and holding the meeting you requested, and sending confirmations and reminders.

Legal basis: Art. 6(1)(b) GDPR (carrying out pre-contractual measures at your request); in addition Art. 6(1)(f) GDPR based on our interest in organising appointments efficiently.

Provider and place of processing: [PROVIDER, ADDRESS AND SERVER LOCATION]

[TO VERIFY: If Cal.com is used as a cloud service, it must be clarified whether the provider or its sub-processors are established outside the EU or the EEA. In that case, section 10 (transfers to third countries) and the details of recipients must be adapted accordingly. With a self-hosted installation in an EU data centre there is no third-country element, and this section should be simplified accordingly.]

Processing on our behalf: a data processing agreement under Art. 28 GDPR is in place with the provider. [TO VERIFY: Only applicable if the agreement has actually been concluded. Not applicable if the service is self-hosted.]

Retention period: [RETENTION PERIOD APPOINTMENT DATA]

6. Audience measurement without cookies

We evaluate the use of this website statistically in order to improve it. For this we use [ANALYTICS TOOL — self-hosted Matomo without cookies, or Plausible EU].

Characteristics of this measurement:

No cookies are set and no comparable information is stored on or read from your device.
No cross-device and no cross-site profile is created.
IP addresses are processed [ANONYMISATION METHOD — e.g. truncated and not stored].
The data is processed on servers in [ANALYTICS SERVER LOCATION] and is not passed on to third parties.

Data processed: pages accessed, time and duration of access, referrer, approximate geographic area based on the truncated IP address, browser and device type used in generalised form.

Purpose: statistical evaluation of use, improvement of content and of technical delivery.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in designing our offering to meet demand and improving it continuously. Since no information is stored on or read from your device, in our assessment no consent is required.

[TO VERIFY: This assessment relies on § 165 TKG 2021 (Telekommunikationsgesetz 2021, Austrian Telecommunications Act), which governs the storing of information on terminal equipment and access to it. Have the section reference and the current interpretation by the data protection authority and the courts confirmed before publication. The assessment applies solely to the cookie-free configuration described above.]

Retention period: [RETENTION PERIOD ANALYTICS DATA]

You can object to this measurement; see section 12.

7. Hosting and processing on our behalf

This website is operated at [HOSTING PROVIDER, ADDRESS] in a data centre in [DATA CENTRE LOCATION]. The provider processes the data arising from operation exclusively on our instructions.

Legal basis: Art. 6(1)(f) GDPR, based on our interest in a secure and reliable provision of our offering. A data processing agreement under Art. 28 GDPR is in place with the provider.

Fonts are delivered from our own servers. No connection is made to external font services and no transfer of your IP address to third parties takes place for this purpose.

[TO VERIFY: All further processors must be added as soon as they are used — for example email providers, CRM, newsletter delivery, backup services, error and availability monitoring.]

8. Job applications

If you apply to us, we process the application data you transmit.

Data processed: contact details, covering letter, CV, references and any other documents and information you provide voluntarily.

Purpose: conducting the application process and deciding whether to enter into an employment relationship.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and § 4(4) DSG in conjunction with Art. 6(1)(f) GDPR for processing within the application process. [TO VERIFY: Have the citation of the national provision confirmed by a lawyer.] If your application contains special categories of personal data within the meaning of Art. 9 GDPR (for example information about a disability), processing takes place on the basis of Art. 9(2)(b) GDPR.

Retention period: after the application process has ended we delete your documents after [RETENTION PERIOD APPLICATIONS]. [TO VERIFY: Customary retention is based on possible claims under the Gleichbehandlungsgesetz (Austrian Equal Treatment Act); have the exact period confirmed by a lawyer.] If you would like us to keep your documents beyond that for future positions, we obtain your separate consent under Art. 6(1)(a) GDPR, which you can withdraw at any time.

9. Categories of recipients

Your data is passed on to recipients only where this is necessary to fulfil the purposes stated or where we are legally obliged to do so. The following categories of recipients may be involved:

IT service providers for hosting, operation and maintenance (processors)
the provider of the appointment booking service (processor)
email and communication service providers (processors)
tax advisers and auditors
legal representatives as well as courts and authorities, where provided for by law or necessary to pursue legal claims
banks and payment service providers in the course of handling business relationships

[TO VERIFY: Adapt this list to the service providers actually used. A record of processing activities under Art. 30 GDPR should be kept as an internal basis.]

Data is not sold.

10. Transfers to third countries

Transfers of personal data to countries outside the European Union and the European Economic Area are not envisaged. Hosting, form processing, fonts and audience measurement are set up so that processing takes place within the EU or the EEA.

[TO VERIFY: If a service in use — in particular appointment booking or an email provider — transfers data to a third country, this section must be replaced. In that case the recipient, the third country and the basis for the transfer under Chapter V GDPR must be named, for example an adequacy decision of the European Commission or standard contractual clauses under Art. 46(2)(c) GDPR together with supplementary measures.]

11. Retention periods

We store personal data only for as long as it is necessary for the purposes stated or as long as statutory retention obligations require. After that the data is deleted or blocked.

Processing	Retention period
Server log files	[RETENTION PERIOD SERVER LOG FILES]
Contact enquiries without contract initiation	[RETENTION PERIOD ENQUIRIES]
Contract and business records	[RETENTION PERIOD BUSINESS RECORDS] [TO VERIFY: statutory retention periods under UGB and BAO]
Appointment data	[RETENTION PERIOD APPOINTMENT DATA]
Statistical measurement data	[RETENTION PERIOD ANALYTICS DATA]
Application documents	[RETENTION PERIOD APPLICATIONS]

12. Your rights

Under the GDPR you have the following rights:

Access (Art. 15 GDPR) to whether and which data we process about you
Rectification (Art. 16 GDPR) of inaccurate or incomplete data
Erasure (Art. 17 GDPR), where no retention obligation or other ground stands in the way
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR) for data you provided to us on the basis of consent or a contract
Objection (Art. 21 GDPR)

Art. 19 GDPR also obliges us to inform recipients about rectifications, erasures and restrictions.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data carried out on the basis of Art. 6(1)(f) GDPR. We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

If your data is processed for direct marketing purposes, you can object to that processing at any time without giving reasons.

Where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.

How to exercise your rights

An informal message to [DATA PROTECTION EMAIL ADDRESS] or to the postal address given above is sufficient to exercise your rights. To avoid disclosing information to unauthorised persons, we may request additional details to identify you.

13. Right to lodge a complaint with the supervisory authority

Without prejudice to other remedies, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data infringes the GDPR (Art. 77 GDPR, § 24 DSG). The supervisory authority responsible for us is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42 1030 Vienna Austria Website: https://www.dsb.gv.at Email: dsb@dsb.gv.at Phone: [PHONE DATA PROTECTION AUTHORITY]

[TO VERIFY: Verify the address, website and email address of the data protection authority on dsb.gv.at before publication; take the telephone number from there.]

14. No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR does not take place.

15. Data security

We take technical and organisational measures under Art. 32 GDPR to protect your data against loss, destruction, access, alteration or disclosure by unauthorised persons. This website is transmitted in encrypted form via TLS.

16. Changes to this privacy policy

We adapt this privacy policy when the processing or the legal framework changes. The version published on this page applies in each case.

Last updated: [DATE OF LAST UPDATE]