Privacy policy.

Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

For any question about data protection and to exercise your rights, contact me at datenschutz@igromo.com.

Overview

• When you open the website, my hosting provider Vercel processes technically necessary access data (e.g. IP address) to deliver and protect the pages.
• When you request a diagnosis call through the form, your details are stored in my CRM at HubSpot.
• I do not use analytics, advertising or retargeting tools (no Google Analytics, no Meta pixel, no LinkedIn Insight Tag, no HubSpot tracking code) and create no usage profiles.
• Fonts are loaded from my own hosting, not from Google or other third parties.

Legal bases

• Art. 6(1)(b) GDPR – pre-contractual steps and performance of a contract, e.g. when you request a diagnosis call or we work together.
• Art. 6(1)(f) GDPR – legitimate interest, e.g. in secure, stable delivery of the website and in handling B2B requests.
• Art. 6(1)(a) GDPR – consent, where you give it explicitly, e.g. to receive further information by email. You can withdraw consent at any time with effect for the future.
• Art. 6(1)(c) GDPR – legal obligations, e.g. statutory retention duties under company and tax law.

Hosting and delivery (Vercel)

This website is hosted by Vercel Inc., Covina, California, USA, and delivered via its global edge network. Whenever a page is requested, Vercel automatically processes technical access data:

• IP address
• date and time of access
• requested URL and referrer URL
• browser, operating system and device type (user agent)
• amount of data transferred and status code

The purpose is to deliver the website, defend against attacks (e.g. DDoS) and analyze errors. The legal basis is my legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). Log data is only kept as long as required for these purposes and then deleted automatically.

Vercel acts as my processor under a data processing addendum. As processing in the USA cannot be ruled out, transfers are based on Vercel's certification under the EU-US Data Privacy Framework (adequacy decision of the European Commission) and additionally on EU Standard Contractual Clauses. More information: vercel.com/legal/privacy-policy.

Fonts and embedded content

All fonts, images and scripts on this website are loaded from my own hosting. I do not embed Google Fonts, YouTube or Vimeo videos or social media plugins. Links to external services (e.g. LinkedIn) are plain links – data is only transferred once you click them; from then on, the provider's privacy policy applies.

The only exception is the HubSpot form on the “diagnosis call” page (see next section): the form script is loaded from HubSpot's servers on that page only.

Diagnosis call form (HubSpot)

For requests via the form I use HubSpot, CRM and form software provided by HubSpot Ireland Limited, Dublin, Ireland (parent company: HubSpot, Inc., Cambridge, Massachusetts, USA). My HubSpot account is set up in HubSpot's EU data center.

Which data

• the details you enter in the form – e.g. name, business email address, company, role, website and your message
• technical data at submission – e.g. IP address, time, the page you submitted the form from and browser information
• if you give it: your consent to receive further information, including its timestamp

Purposes and legal basis

I use the data to answer your request, schedule and prepare the diagnosis call and – if a collaboration follows – to initiate and perform it (Art. 6(1)(b) GDPR). Storing it in my CRM to keep our communication traceable is based on my legitimate interest (Art. 6(1)(f) GDPR). I only send emails with further information if you have consented (Art. 6(1)(a) GDPR); every such email contains an unsubscribe link.

Processing and international transfer

HubSpot processes the data as my processor under a data processing agreement. The data is stored in the EU; access by HubSpot, Inc. in the USA (e.g. for support or security) cannot be ruled out. For this I rely on HubSpot's certification under the EU-US Data Privacy Framework and additionally on EU Standard Contractual Clauses. More information: legal.hubspot.com/privacy-policy.

No tracking cookies

I do not use the HubSpot tracking code. No HubSpot analytics or marketing cookies are set, and your browsing on this website is not linked to your contact record.

Contact by email

If you email me, I process your email address, name and the content of your message to answer your request (Art. 6(1)(b) or (f) GDPR). I use an email service provider as a processor for sending and receiving email. Relevant correspondence may be stored in my CRM (HubSpot).

Cookies and local storage

This website sets no analytics, marketing or advertising cookies and stores no information on your device to recognize visitors. That's why no cookie banner is needed. Should this change, I will ask for your consent beforehand and update this policy.

Recipients

Your data is only received by parties that need it for the purposes above:

• Vercel Inc. – hosting and delivery of the website (processor)
• HubSpot Ireland Limited / HubSpot, Inc. – form and CRM (processor)
• my email service provider – email communication (processor)
• where legally required or to enforce claims: tax advisors, legal counsel, courts and authorities

I do not sell data or pass it on to third parties for advertising.

Retention

• Server log data at Vercel: only briefly for operation and security, then deleted automatically.
• Requests via the form or email: as long as needed to handle them and for a potential collaboration. If no business relationship follows, I delete the contact data no later than 24 months after the last contact.
• In a collaboration: for the duration of the business relationship and then according to statutory retention periods (e.g. seven years under § 132 of the Austrian Federal Fiscal Code, BAO).
• Consents: until you withdraw them; proof of consent is kept as long as I legally need it.

Your rights

You have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• rectification of incorrect data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Just write to datenschutz@igromo.com. You can also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, Austria, dsb.gv.at.

Data security

The website is delivered exclusively over encrypted HTTPS (TLS), with HSTS and a restrictive Content Security Policy that only allows the sources required. Form data is transmitted to HubSpot encrypted. Only I and people I authorize have access to my CRM.

Changes

I update this privacy policy when my website, my service providers or the legal situation change. The version published here applies.