§ GDPR · Art. 13 / 14

Privacy Policy

Applies to · data-insights.aiGoverned by · GDPR · DSG (AT)

The protection of your personal data is of particular concern to us. We process your personal data only for specific purposes, in compliance with data protection regulations. Below we explain how data is handled on data-insights.ai.

Scope of application

This privacy policy applies to all personal data processed by us within the company and to all personal data processed by companies commissioned by us (data processors). By personal data, we mean information as defined in Art. 4 No. 1 GDPR, such as a person's name, email address, and postal address. The processing of personal data ensures that we can offer and bill our services and products, whether online or offline.

The scope of this privacy policy includes:

our entire online presences (websites, online shops etc.)
social media presences and email communication
mobile apps for smartphones and other devices

Legal bases

We provide transparent information about the legal principles and regulations — i.e. the legal bases of the General Data Protection Regulation — that allow us to process personal data. Regarding EU law, we refer to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

We only process your data if at least one of the following conditions applies:

Consent (Art. 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose — e.g. the storage of data entered into a contact form.
Contract (Art. 6(1)(b) GDPR): To fulfill a contract or pre-contractual obligations with you, we process your data.
Legal obligation (Art. 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data — e.g. retaining invoices for accounting purposes.
Legitimate interests (Art. 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data — e.g. to operate our website securely and efficiently.

In addition to the EU regulation, national laws also apply. In Austria this is the Federal Act for the Protection of Natural Persons with regard to the Processing of Personal Data (Datenschutzgesetz, DSG). In Germany, the Federal Data Protection Act (BDSG) applies. If other regional or national laws apply, we will inform you about them in the relevant section.

Contact of the responsible party

If you have any questions about data protection, you will find the contact details of the responsible person below:

Name: DI Dr. techn. Markus Nissl
Company: datAInsights GmbH
Address: Prinz-Eugen-Straße 76/12
1040 Wien, Austria
E-Mail: markus⁠.nissl⁠@data-insights⁠.ai
Phone: +43 660 2917219

Processing · Website usage

Every time our website data-insights.ai is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is automatically collected via log files: browser type and version, user's operating system, user's internet service provider, IP address, date and time of access, and referrer URL.

Legal basis

The temporary storage of this data is necessary for professional hosting of the website and ensuring its operation and IT security. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. The collection of this data to provide the website and the storage in log files are essential for the proper operation of the website. Generally, this data does not have a direct personal reference and is not used to identify you personally. There is no merging of this data with other data sources.

We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data securely over the internet. By using TLS (Transport Layer Security) — an encryption protocol for secure data transfer — we ensure the protection of confidential data, complying with data protection through technology design (Art. 25(1) GDPR).

Purpose

The storage of the IP address is necessary to enable provision of our website on your computer. Your IP address is stored for the duration of your session. The storage of data in log files beyond that is done to ensure functionality of the website and to optimize it. Additionally, we use your personal data to detect, prevent, and investigate attacks on our website.

Duration

The data collected during your visit to our website is deleted by default after 31 days. Longer storage is possible; however, in this case the IP addresses of the users are either deleted or alienated in such a way that no assignment to the calling client is possible anymore.

Recipients

Your data will not be passed on to third parties without your consent.

Processing · General communication

You have the option to contact us in writing by letter, email, or phone — especially if you are interested in our services and activities. When you contact us, we process the data you voluntarily provide, which includes your first and last name, your title/salutation, your phone number or email address, and the content of your inquiry. You decide for yourself whether and which information you provide us, though providing certain data may be necessary to properly handle your concern.

Legal basis

We justify the processing under Art. 6(1)(b) GDPR for inquiries leading to contract initiation, as the processing is necessary to carry out pre-contractual measures. For other inquiries, we rely on Art. 6(1)(a) GDPR, provided that you have voluntarily provided the data. Additionally, we use Art. 6(1)(f) GDPR to effectively manage inquiries and organize the corresponding responses.

Purpose

Storing and processing your data aims to ensure that inquiries and responses are handled uniformly and promptly, enabling the necessary communication and contact with you, and serving to manage these messages including documentation of the inquiries and their processing.

Duration

Your data will be kept as long as contact with you exists or until you revoke your consent — for a maximum of one year after your last contact with us.

Recipients

Your data will not be passed on to third parties without your consent.

Processing · Corporate communication

We collect and process the following information: first and last name, title, nickname, email address, phone number, or other necessary contact information resulting from modern communication techniques, as well as your online identity on the respective social media platform (username, photo, avatar, or logo). We also process the content of posts and requests that you voluntarily share with us.

Legal basis

The processing of data for public communication with individuals interested in our company via online media is based on the implied consent (Art. 6(1)(a) GDPR) of the communication partners regarding the voluntarily provided data, and our legitimate interest in the other data (Art. 6(1)(f) GDPR).

Purpose

Our data processing aims to disseminate our content and activities on social media platforms. In discussions with interested parties, content is exchanged on these platforms, and occasionally individuals provide personal data. We use this data to maintain communication and to provide interested users with reports in text and picture form.

Recipients & duration

The information is generally accessible on the social media platforms and is made available to all other users according to the functions of these platforms. The data is processed until the post is removed from the respective communication platform.

Processing · Payments

When you buy a subscription or a one off product, the payment is handled by Paddle.com Market Ltd., our reseller and the Merchant of Record for every order. Paddle collects the data needed to complete the purchase: your name, email address, billing address, country, the payment details you enter and the tax identification number if you give one. Your card number is entered in Paddle's payment form and never reaches our servers.

We receive the events about your order from Paddle and store them: order and subscription identifiers, the plan bought, amounts and tax, the country used for tax, the payment status, and the payment method type with the last four digits of the card, its expiry date and the name on the card, as Paddle includes them. We never receive the full card number.

Legal basis

Performance of a contract (Art. 6(1)(b) GDPR) for processing the order itself, and compliance with a legal obligation (Art. 6(1)(c) GDPR) for the invoicing and bookkeeping records that Austrian tax law requires us to keep.

Purpose

Completing the purchase, giving you access to what you bought, issuing invoices, handling refunds and meeting our accounting obligations.

Duration

Invoicing records are kept for seven years, the retention period under § 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung, BAO), and that applies even if you have your account deleted. Account and subscription data are kept for as long as the account exists. The end of a subscription does not delete the account. You can have your account deleted at any time; we then delete everything we are not legally required to keep. We may delete accounts without an active subscription that have not been used for an extended period.

Recipients

Paddle.com Market Ltd. (Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom) acts as a separate controller for the payment, not as our processor, because it is the seller of record. Its privacy policy describes what it does with the data. Payment service providers and the tax authorities receive data where the transaction or the law requires it.

Third-party requests on the payment page

Our payment page loads Paddle's payment library from Paddle's servers so that the payment form can run. That page is the only page on this website that contacts a third party, and it does so only when you are completing a purchase. No other page, including the home page, the blog and these legal pages, loads anything from a third party.

Automated decision making

We do not carry out automated decision-making, including profiling, in accordance with Art. 22(1) and (4) GDPR.

Your rights under the GDPR

In accordance with Articles 13 and 14 GDPR, we inform you of the following rights that you have to ensure fair and transparent processing of data:

Right to information (Art. 15). You have the right to access all data related to you that we process, receive a copy of the data, and learn the purpose of processing, the categories processed, recipients (including transfers to third countries and the safeguards used), storage duration, your rights to rectification / deletion / restriction / objection, the right to lodge a complaint, the origin of the data if not collected from you, and the existence of automated decision-making.
Right to rectification (Art. 16). You have the right to have data corrected if you find any errors.
Right to deletion — "right to be forgotten" (Art. 17). You can request the deletion of your data.
Right to restriction of processing (Art. 18). We can only store the data but not use it further.
Right to data portability (Art. 20). We must provide your data in a common format upon request.
Right to object (Art. 21). If processing is based on Art. 6(1)(e) or 6(1)(f), you can object. We will then check as soon as possible whether we can legally comply. If data is used for profiling, you can object at any time — we may then no longer use your data for profiling.
Right not to be subject to automated decisions (Art. 22) under certain circumstances.
Right to complain (Art. 77). You can always complain to the data protection authority if you believe the processing of personal data violates the GDPR.

Right to complain · supervisory authority

If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can complain to the supervisory authority. For Austria, this is the Data Protection Authority:

Authority: Österreichische Datenschutzbehörde
Head: Mag. Dr. Andrea Jelinek
Address: Barichgasse 40–42, 1030 Wien
Phone: +43 1 52 152-0
E-Mail: dsb⁠@dsb⁠.gv⁠.at
Website: dsb.gv.at

Data transfer to third countries

We only transfer or process data in countries outside the EU (third countries) if you agree to this processing, if it is required by law or contractually necessary, and in any case only to the extent that it is generally permitted. Whenever possible, we try to use server locations within the EU, provided this is offered.

Security of data processing

To protect personal data, we have implemented both technical and organizational measures. Wherever possible, we encrypt or pseudonymize personal data. In doing so, we make it as difficult as possible for third parties to infer personal information from our data based on our capabilities.

Cookies

We do not use cookies.

These Terms and Conditions are made in German and English. In case of discrepancies between the two versions, the German version shall prevail. Any and all liability on the part of datAInsights for any deviations in content or mistranslations is excluded.