Privacy Policy

Statistics (Audience Measurement)

Provider

The measurement is operated by our web service provider fluid frames gmbh, Aiglhofstraße 45/5, 5020 Salzburg.

Purpose

statistical analysis of the use of this website (e.g. number of visits, pages accessed, time spent, origin of visits, loading times) in order to design and improve content and technology in line with requirements.

Data processed

page accessed, previously visited page (referrer) and campaign identifiers, time, country (derived from the IP address), device and browser type, screen size, loading times and individual actions on the website (e.g. submitting a form). Your IP address is not stored. To distinguish between visits, an encrypted identifier (hash) is generated from the IP address and browser identifier; it changes daily and does not allow any conclusions to be drawn about you as a person. No cookies are set and no information is stored in your browser.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in designing and improving our website in line with requirements). The provision of the personal data is neither required by law nor by contract. You can use the website without restriction even if you object to the measurement.

Third-country transfer

USA; EU-US Data Privacy Framework certification of Cloudflare (https://www.dataprivacyframework.gov/list) and standard contractual clauses.

Storage period

individual data 13 months, thereafter only aggregated daily values without identifier.

Objection

You can object to the measurement at any time via the “Disable statistics” link on this page; for this purpose, your decision is recorded in your browser’s local storage. If your browser sends the “Global Privacy Control” signal, no measurement takes place.

Disable statistics

Prize Draws

Purpose

conducting our prize draws in accordance with the respective terms of participation and confirming your participation, holding the draw, notifying the winners and handing over the prizes.

Data processed

first name, email address, the selected prize draw, time of registration and of confirmation, and the IP address as proof of confirmation.

Procedure

After submitting, you will receive an email with a confirmation link; you only take part once you have confirmed (double opt-in).

Legal basis

Art. 6(1)(b) GDPR (conducting the prize draw). The provision of the data is necessary for participation; without it, participation is not possible. Participation does not depend on subscribing to the newsletter; such a subscription only takes place with your separate consent (see “Newsletter”).

Processor

CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.

Third-country transfer

none.

Storage period

The data are deleted after the prize draw has ended, and the winners’ data after the prize has been handed over, unless statutory retention obligations exist.

AI chatbot

Provider

The chatbot is provided by our web service provider fluid frames gmbh, Aiglhofstraße 45/5, 5020 Salzburg (using the AI system of Botpress, USA).

Purpose

automated answering of enquiries and support of users by our AI chatbot.

Data processed

your chat entries (including any personal data contained therein), technical connection data, a conversation ID and timestamps, as well as the language and the heading of the page on which you use the chat.

Storage in the browser

The chatbot stores an identifier, a conversation ID and the chat history in your browser's local storage so that the conversation is preserved when you switch between pages. These entries are deleted if you have not used the chat for more than 24 hours and visit the website again. In addition, the website remembers for the duration of your visit whether you have opened the chat, so that it reopens on the next page or is ready more quickly. The chatbot is only loaded when you open it or click into the field for your question; no connection to the chatbot is established beforehand.

Legal basis

Art. 6(1)(a) or Art. 6(1)(b) or (f) GDPR (as well as Art. 9(2)(a) GDPR, insofar as you expressly provide special categories of data and thereby consent to their processing) for processing your enquiry. You give your consent by entering text in the chat or question field; we point this out directly at the input field. Storage in the browser is strictly necessary for the chat you have requested. The provision of personal data is not required by law. If you decide not to use our chatbot and thus not to provide your data, the consequence would be that you cannot use our chatbot.

Third-country transfer

USA (Botpress); safeguarded by the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/list) and standard contractual clauses.

Automated decision-making

There is no decision based solely on automated processing with legal effect within the meaning of Art. 22 GDPR.

Storage period / withdrawal / objection

Chat histories are deleted after 90 days at the latest. The entries in your browser's local storage are deleted on your next visit after 24 hours without use; you can also delete them at any time via your browser settings. You can withdraw your consent at any time with effect for the future (without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal) by sending a message to the contact details stated under point 1. You can object to the processing at any time.

Note to users

Please do not enter any sensitive data (in particular political opinions, health data, etc.) in the chat.

Consent Management (Cookies)

Provider

Cookie management and consent management are operated via a solution provided by our web service provider fluid frames gmbh, Aiglhofstraße 45/5, 5020 Salzburg.

Purpose

obtaining, storing and providing proof of your consents to embedded content and services. Your consent applies only to the respective service in each case. On your first visit, we ask you in a notice window which services you wish to allow: all, none or individually selected services. None of these services is loaded without your prior consent.

Data processed

your choice for each service, the time of that choice and a randomly generated identifier of your browser. The identifier is stored in your browser’s local storage, and your choice is stored in a database of our web service provider. Your choice in the notice window is also stored in your browser’s local storage.

Legal basis

Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent). Storing your choice in the browser is strictly necessary for this purpose (§ 165(3) TKG).

Storage period / withdrawal

Your stored choice is valid for 12 months, after which you will be asked again. The records of proof are deleted after 3 years. You can withdraw your choice at any time via the “Cookies” link at the bottom of every page (without affecting the lawfulness of processing based on consent before its withdrawal).

Newsletter

Provider

CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.

Purpose

regular sending of information and offers by email.

Data processed

email address, name where applicable; time of subscription and of confirmation, and IP address as proof of consent.

Legal basis

Art. 6(1)(a) GDPR (consent) in conjunction with § 174 TKG. The provision of the personal data is neither required by law nor by contract. Failure to provide the data would mean that we cannot send you any newsletters. After subscribing, you will receive an email with a confirmation link. We only add you to the mailing list after you have confirmed.

Third-country transfer

none.

Storage period / withdrawal

until consent is withdrawn (without affecting the lawfulness of processing based on consent before its withdrawal); you can unsubscribe at any time via the unsubscribe link in every email.

Performance measurement

Our newsletters contain technical markers (tracking pixels and personalised links) which record whether and when a newsletter was opened and which links were clicked. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give when subscribing; you can withdraw it at any time via the unsubscribe link.

Google Analytics 4

Provider

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC, USA).

Purpose

analysis of user behaviour in order to optimise the website. In addition, measuring the success of our advertisements (linked with Google Ads).

Data processed

IP address (used only to determine the approximate location and not stored), online identifiers/cookies, usage and device information. Google Analytics is only loaded after you have given your consent. No cross-device analysis takes place.

Legal basis

Art. 6(1)(a) GDPR (consent). The provision of the personal data is neither required by law nor by contract. Failure to provide the data would mean that we cannot use your data to further optimise our website. You can nevertheless use the website without restriction.

Third-country transfer

USA; EU-US Data Privacy Framework certification of Google (https://www.dataprivacyframework.gov/list) and standard contractual clauses.

Storage period

cookies “_ga” and “_ga_<ID>” 13 months; the analytics data are deleted by Google after 14 months. Further processing is governed by the provider’s specifications.

Withdrawal

via the “Cookies” link at the bottom of every page (without affecting the lawfulness of processing based on consent before its withdrawal); additionally via the browser add-on for deactivation provided by Google.

Microsoft Clarity

Provider

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft Corporation, USA).

Purpose

analysis of user behaviour in order to optimise the website, in particular analysis of clicks, mouse and scroll movements and recording of individual visits.

Data processed

IP address, online identifiers/cookies, device and browser information, usage data (e.g. pages accessed, clicks, mouse and scroll movements, time spent). Entries in form fields are made unrecognisable before transmission. The Microsoft script is only loaded after you have given your consent.

Legal basis

Art. 6(1)(a) GDPR (consent). The provision of the personal data is neither required by law nor by contract. Failure to provide the data would mean that we cannot use your data to further optimise our website. You can nevertheless use the website without restriction.

Third-country transfer

USA; EU-US Data Privacy Framework certification of Microsoft (https://www.dataprivacyframework.gov/list) and standard contractual clauses.

Storage period

cookies “_clck” 1 year and “_clsk” 1 day; session recordings are deleted by Microsoft after 30 days; recordings marked as favourites, a random sample of recordings and heatmaps after up to 9 months. Further processing is governed by the provider’s specifications.

Withdrawal

via the “Cookies” link at the bottom of every page (without affecting the lawfulness of processing based on consent before its withdrawal).

Meta Pixel (Facebook / Instagram)

Provider

Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (Meta Platforms, Inc., USA).

Purpose

measuring and optimising advertisements, reach analysis and retargeting. For this purpose, we create target audiences for advertising from the visitors to this website.

Data processed

IP address, cookies/online identifiers, device and usage data, event data (e.g. page views, conversions). The Meta script is only loaded after you have given your consent; your browser then transmits the data directly to Meta.

Legal basis

Art. 6(1)(a) GDPR (consent). The provision of the personal data is neither required by law nor by contract. Failure to provide the data would mean that we cannot use your data to measure and optimise our advertisements. You can nevertheless use the website without restriction.

Joint controllership

We and Meta are joint controllers within the meaning of Art. 26 GDPR for the collection of the data and their transmission to Meta; Meta is solely responsible for the further processing. The joint controllership arrangement (Meta Controller Addendum) is available at https://www.facebook.com/legal/controller_addendum. Under it, Meta is responsible for fulfilling your rights with regard to the data processed by Meta; you can contact Meta Platforms Ireland Limited directly for this purpose (https://www.facebook.com/privacy/policy).

Third-country transfer

USA; EU-US Data Privacy Framework certification of Meta (https://www.dataprivacyframework.gov/list) and standard contractual clauses.

Storage period

cookies “_fbp” and “_fbc” up to 90 days. Further processing is governed by the provider’s specifications.

Withdrawal

via the “Cookies” link at the bottom of every page (without affecting the lawfulness of processing based on consent before its withdrawal).

Google Ads (Conversion Tracking / Remarketing)

Provider

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC, USA).

Purpose

measuring the success of advertisements and remarketing.

Data processed

IP address, cookies/online identifiers, conversion and usage data. The Google script is only loaded after you have given your consent. In the process, Google may also set its own advertising cookies (e.g. “IDE” of the domain doubleclick.net).

Legal basis

Art. 6(1)(a) GDPR (consent). The provision of the personal data is neither required by law nor by contract. Failure to provide the data would mean that we cannot use your data to measure the success of advertisements and for remarketing. You can nevertheless use the website without restriction.

Third-country transfer

USA; EU-US Data Privacy Framework certification of Google (https://www.dataprivacyframework.gov/list) and standard contractual clauses.

Storage period

cookie “_gcl_au” up to 90 days, Google advertising cookies (doubleclick.net) up to 13 months. Further processing is governed by the provider’s specifications.

Withdrawal

via the “Cookies” link at the bottom of every page (without affecting the lawfulness of processing based on consent before its withdrawal).