1. Data controller

The controller responsible for the processing of your personal data is:
OSM Solutions GmbH
Wipplingerstraße 33 / 3. OG
1010, Vienna, Austria
Email: moc.s-mso@eciffo
Phone: +43 1 8903625

For any privacy-related questions or to exercise your rights, please contact us at moc.s-mso@eciffo.

When do we collect information?

We collect information from you when you fill out a form or enter information on our site.

2. What personal data we collect and why

We only collect personal data that is necessary for the purposes described below. Where applicable, we indicate the legal basis under Article 6(1) GDPR.

2.1 Contact form

When you fill out the contact form on our site, we collect:
– your name,
– your email address, and
– any message text you choose to provide.

Purpose: to respond to your inquiry and follow up with you.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) and/or Art. 6(1)(f) GDPR (our legitimate interest in responding to inquiries).

2.2 Appointment booking (TidyCal)

To let you schedule meetings with us, we use TidyCal, a booking service provided by Sumo Group Inc., 1305 East 6th Street, Suite 3, Austin, TX 78702, USA.

The TidyCal booking interface is only loaded when you actively click the “Schedule a meeting” button (or similar) on our site. As long as you do not click that button, no connection to TidyCal is established and no data is transmitted to them. By clicking the button, you voluntarily choose to initiate the booking process.

When you proceed to book an appointment, TidyCal processes:

– your name,
– your email address,
– the date, time, and time zone of the booking,
– any message or answers to booking questions you provide, and
– technical data necessary to deliver the booking interface (e.g. IP address, browser information).

Purpose: to enable you to book an appointment with us and to manage that appointment.
Legal basis: Art. 6(1)(b) GDPR – performance of pre-contractual measures carried out at your request when you initiate a booking.
International transfer: Because TidyCal is operated from the United States, your data is transferred outside the EU/EEA as soon as the booking interface is loaded. We rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses (Art. 46 GDPR) as the transfer mechanism. You can review TidyCal’s privacy policy at https://tidycal.com/privacy.

If you do not want your data transferred to TidyCal, please simply do not click the booking button – you can contact us instead via the contact form, email, or phone (see section 13).

2.3 Web analytics (Matomo, self-hosted)

We use Matomo, an open-source web analytics tool that we host ourselves on our own servers within the EU. No analytics data is shared with third parties.

When you consent via our cookie banner, Matomo sets cookies and collects:
– a pseudonymous visitor ID,
– your anonymized IP address (the last two octets are removed before storage, so your IP cannot be used to identify you),
– pages visited, time on page, and referrer,
– approximate location derived from the anonymized IP (country/region level only),
– browser, operating system, and device type.

Matomo is loaded only if you give consent in the cookie banner. If you do not consent – or if you withdraw consent – no Matomo cookies are set and no analytics data is collected.

Purpose: to understand how our site is used so we can improve it.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG / the implementing provision of the ePrivacy Directive in your jurisdiction (your consent).

2.4 Server log files

Our website runs on servers we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The website software and its log files are operated and managed exclusively by us – Hetzner provides the underlying infrastructure only and does not have access to our web server logs.

When you visit our site, our web server automatically records the following technical data in log files:
– IP address,
– date and time of the request,
– requested URL and HTTP status,
– referrer URL,
– user agent (browser and OS).

These logs are kept for a short period for security, troubleshooting, and abuse prevention, and are then deleted or anonymized.

Purpose: security, stability, and operation of the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running a secure website).

Hetzner, as our infrastructure provider, may process limited technical data (such as network-level traffic) strictly to operate and secure the physical and network infrastructure. A data processing agreement in accordance with Art. 28 GDPR is in place between us and Hetzner. Hetzner’s servers used for our site are located within the EU.

3. Cookies and similar technologies

Cookies are small text files stored on your device by your browser. We use the following categories:
– Strictly necessary cookies: required for the site to function (e.g. remembering your language preference or cookie consent choice). These do not require consent.
– Analytics cookies (Matomo): set only if you give consent. Used to measure site usage.

Note: the TidyCal booking interface (section 2.2) may also set cookies, but only once you have actively clicked the “Schedule a meeting” button and thereby initiated the booking process.

You can manage or withdraw your consent at any time via the “Manage Consent” link in our site footer. You can also configure your browser to refuse cookies or to warn you before accepting them. Please note that disabling strictly necessary cookies may affect site functionality.

4. Who receives your data

We do not sell, rent, or trade your personal data. Your data is only accessible to:
– authorized members of our team who need it to respond to you or manage your booking,
– Hetzner Online GmbH, as our infrastructure provider, under a data processing agreement pursuant to Art. 28 GDPR (infrastructure only, Hetzner does not access our application data or web server logs), and
– TidyCal (Sumo Group Inc.), as a processor, if and when you book an appointment.

We do not transfer data to any other third parties unless we are legally required to do so.

5. International data transfers

Our website and Matomo analytics are hosted within the European Union. The only routine transfer of data outside the EU/EEA occurs if you use the TidyCal booking widget, as described in section 2.2. For that transfer we rely on appropriate safeguards under Art. 44–49 GDPR (EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses).

6. How long we keep your data

Contact-form messages and email correspondence: Until the inquiry is fully handled, then up to 12 months for follow-up, unless you ask us to delete it earlier or a longer statutory retention period applies.
Booking data (via TidyCal): For the duration of the business relationship and as required by applicable tax or commercial law (typically up to 6–10 years for invoicing-related records).
Matomo analytics data: Aggregated and anonymized; individual visit data is retained for a maximum of 24 months and then deleted.
Server log files: Up to 90 days, then deleted or anonymized.
Consent records (cookie banner): Up to 12 months to prove lawful consent.

We delete or anonymize data as soon as it is no longer needed for the purpose it was collected for, unless a legal retention obligation requires us to keep it longer.

7. How we protect your data

We implement appropriate technical and organizational measures to protect your data, including:
– TLS (HTTPS) encryption for all traffic between your browser and our site,
– access controls limiting data access to authorized personnel only,
– regular security updates, vulnerability scans, and malware scans,
– secured networks and encrypted storage of sensitive data,
– confidentiality obligations for everyone with access to personal data.

8. Your rights under the GDPR

You have the following rights regarding your personal data:
– Right of access (Art. 15): to obtain confirmation of whether we process data about you and to receive a copy.
– Right to rectification (Art. 16): to have inaccurate data corrected.
– Right to erasure (Art. 17): to have your data deleted when the legal conditions apply.
– Right to restriction (Art. 18): to have processing restricted in certain cases.
– Right to data portability (Art. 20): to receive your data in a structured, machine-readable format.
– Right to object (Art. 21): to object to processing based on legitimate interests.
– Right to withdraw consent (Art. 7(3)): you can withdraw any consent at any time, with effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can withdraw cookie consent via the “Manage consent” button in our footer.
– Right to lodge a complaint (Art. 77): with a supervisory authority, in particular in the EU Member State where you live, work, or where the alleged infringement took place.

To exercise any of these rights, please contact us at moc.s-mso@eciffo. We will respond within one month (extendable by two months for complex requests, per Art. 12(3) GDPR).

9. Automated decision-making

We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Third-party links

Our site may occasionally link to third-party websites. These sites have their own privacy policies, and we have no responsibility or liability for their content or practices. We encourage you to review their policies before sharing any personal data with them.

11. Data breach notification

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, in accordance with Art. 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Art. 34 GDPR.

12. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this policy indicates when it was last revised. Material changes will be communicated on our website.

13. Contact

If you have any questions about this privacy policy or how we handle your personal data, please contact us:
OSM Solutions GmbH
Wipplingerstraße 33 / 3. OG
1010, Vienna, Austria
Email: moc.s-mso@eciffo
Phone: +43 1 8903625