Privacy Policy

1. Controller

2. General information about processing

We process personal data only where this is necessary to operate this website securely, respond to enquiries, or establish and perform a business relationship. The relevant legal bases include Article 6(1)(b) GDPR for pre-contractual steps and contract performance, and Article 6(1)(f) GDPR for our legitimate interests in a secure, stable and user-friendly website.

Where processing is based on consent, the legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

We do not currently use automated decision-making, including profiling.

3. Website delivery and Cloudflare

This website is delivered through Cloudflare Workers and Cloudflare’s content delivery network. The provider is Cloudflare, Inc., USA. When the website is accessed, Cloudflare processes technically necessary connection and log data. This may include the IP address, access date and time, requested address, referrer, browser and operating-system information, HTTP headers, and security and error information.

This processing is used to deliver the website, prevent abusive access, analyse errors and maintain technical security. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

Depending on the security features enabled, Cloudflare may use technically necessary cookies. Further information is available in Cloudflare’s Privacy Policy and Data Processing Addendum.

4. Contact form and direct enquiries

When you use the contact form, we process the information you enter:

• name,
• company, if provided voluntarily,
• email address,
• phone number and website, if provided voluntarily,
• the content of your enquiry,
• selected language and technical transmission data.

The information is used solely to review and respond to your enquiry and, where relevant, take pre-contractual steps. The legal basis is Article 6(1)(b) GDPR where your enquiry relates to a potential business relationship. For other enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is handling business communications.

For the Controlling Potential Check, we additionally process company size, selected challenge, preferred callback time and campaign parameters contained in the requested URL. A phone number, company information and explicit contact consent are required there so that we can make the requested callback. The wording, version and server-side timestamp of that consent are documented in the email delivered with the enquiry. The legal bases are Article 6(1)(a) GDPR and Article 6(1)(b) GDPR for processing your requested pre-contractual contact.

If you select the separate voluntary consent for information and practical controlling insights, we use your email address for that purpose under Article 6(1)(a) GDPR. The selection is documented with the enquiry. You may withdraw this consent at any time by emailing the address above.

Please do not submit financial information, special categories of personal data, or other confidential documents through this form. The website does not store contact enquiries in its own database.

5. Delivery of contact enquiries through Resend

We use Resend, a service provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, to deliver your enquiry to our business email inboxes. The contact-form content and technical information required to deliver the email are transferred to Resend.

Resend processes this information as a service provider for message delivery. Further information is available in Resend’s Privacy Policy and Data Processing Addendum.

After delivery, your enquiry is processed within our Microsoft 365 business email inboxes. The provider for customers in the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Further information is available in Microsoft’s Privacy Statement and the Microsoft Products and Services Data Protection Addendum.

6. Storage of language and consent preferences

The website stores your choice between German and English in your browser’s local storage under the key fng-language. This allows your chosen language to be displayed when you return.

Your cookie-banner choice is stored under the key fng-cookie-consent. The entry contains the selected categories, consent version and time of selection. This enables the website to respect your choice on later visits without loading analytics or marketing services before you consent.

These preferences remain on your device and are necessary for the selected language and management of your privacy choice. You can change your selection at any time through “Cookie settings” in the footer or remove it through your browser settings.

7. Locally hosted fonts

We use the “DM Sans” and “Newsreader” typefaces. Their font files are stored locally on this website and are delivered from the same domain as the other website content. Loading the fonts therefore does not establish a connection to Google.

8. External links

The website contains standard links to Samantha Szabó’s LinkedIn profile and her public entries in the WKO company directory and GISA. No plug-in or tracking pixel from these providers is embedded on our website. The relevant provider receives normal connection information only after you select a link and leave our website.

For users in the European Economic Area, LinkedIn Ireland Unlimited Company is generally responsible for LinkedIn’s processing. Further information is available in LinkedIn’s Privacy Policy.

9. Cookies, analytics and marketing

Cloudflare may use technically necessary cookies for security and network functionality. These cookies are used solely to deliver and secure the website you requested.

Google Analytics 4 and Google Ads conversion measurement are technically prepared. Under our Basic Consent Mode, Google services load only after you expressly consent to the relevant optional category and we have activated the corresponding Google identifiers. No connection to Google for analytics or marketing purposes is established before your consent.

If you consent to “Analytics”, Google Analytics may process information about page views, approximate location, device, browser, referrer, session duration and interactions. We measure events including form starts and successfully submitted enquiries. The legal basis is Article 6(1)(a) GDPR. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

If you consent to “Marketing”, Google Ads conversion measurement and the required consent signals may additionally be activated. Data is used for personalised advertising only where you have also consented to this category. Google may process click identifiers such as gclid, the requested URL, device information and interaction data.

Google Analytics may set the cookies _ga and _ga_<container-id>, normally for up to two years. Our consent manager uses Google Consent Mode v2 signals for analytics_storage, ad_storage, ad_user_data and ad_personalization. Further information is available in Google’s Privacy Policy.

You can change or withdraw your consent at any time with future effect through “Cookie settings” in the footer.

10. Recipients and international transfers

Personal data is available only to the people and service providers who need it for the purposes described above. These include Cloudflare for hosting and security, Resend for email delivery, Microsoft for our business email inboxes and – after your consent and technical activation – Google for analytics and conversion measurement.

Cloudflare and Resend are based in the United States or use subprocessors there. Microsoft and Google may also process data using companies or subprocessors outside the European Economic Area. Transfers rely on the applicable data-protection safeguards, particularly an adequacy decision for certified recipients and/or Standard Contractual Clauses. Details are provided in the linked contractual and privacy information.

We otherwise disclose information only where legally permitted or required, or where you have expressly consented.

11. Retention periods

We retain personal data only for as long as necessary for the relevant purpose or to comply with statutory retention obligations.

• Contact enquiries: normally until the enquiry has been fully handled and then for six months, provided no business relationship arises and no legal reason requires longer retention.
• Contractual and accounting-related communications: for the applicable statutory retention and limitation periods.
• Hosting and security logs: according to Cloudflare’s technical and contractual retention periods, and only for as long as required for operation, error analysis and security.
• Language preference: until you clear your browser’s local storage or replace the selection.
• Cookie consent: until you change the selection, clear local storage or we request a new consent version.
• Google Analytics event and user data after activation: according to the 14-month retention period that we must configure in Google Analytics; the standard duration of the analytics cookies listed above is up to two years.
• Consent to receive email information: until withdrawn; evidence of consent may be retained beyond that within applicable limitation periods.

12. Your data-protection rights

Subject to the requirements of the GDPR, you have rights including access, rectification, erasure, restriction of processing and data portability. Where processing is based on our legitimate interests, you may object on grounds relating to your particular situation. You may withdraw consent at any time with effect for the future.

To exercise your rights, contact the address provided under “Controller”. We may request additional information where necessary to confirm your identity.

You also have the right to lodge a complaint with a data-protection supervisory authority. The competent Austrian authority is:

13. Data security and changes

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Website traffic is encrypted using HTTPS.

We update this privacy policy when the website, our service providers or legal requirements change. The version published on this page is the applicable version.