Data Protection

1. Data Controller

The entity responsible for processing personal data on this website is:

risk on mind GmbH
Managing Director: Stephan Dorner
Postgasse 16/21
1010 Vienna
Austria

Phone: +43 1 343 03 09
Email:  dataprotection@riskonmind.eu

2. General Information on Data Processing

Protecting your personal data is of utmost importance to us. We process personal data strictly in compliance with applicable statutory provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the Telecommunications Act 2021 (TKG 2021).

Personal data refers to any information relating to an identified or identifiable natural person. This includes, for example, your name, email address, IP address, and details about your usage of our website.

We only process personal data to the extent necessary to provide our website, process inquiries, conduct our events and services, or on the basis of your explicit consent.

3. Hosting and Provision of the Website

Our website is provided via the Framer platform. The provider is:

Framer B.V.
Rozengracht 207B
1016 LZ Amsterdam
Netherlands

Framer provides a platform for creating, publishing, and operating interactive websites. In connection with delivering the website, Framer generally processes personal data as a processor on behalf of the respective website operator. The legal basis for this is Framer's Data Processing Addendum pursuant to Art. 28 GDPR. [framer.com]

Framer utilizes hosting infrastructure from Amazon Web Services to deliver its services. According to Framer, hosting infrastructures are located, among other places, in the USA, Europe, and the Asia-Pacific region. Content may also be delivered via a global Content Delivery Network. [framer.com]

Within the scope of hosting, the following data in particular may be processed:

• IP address

• Date and time of access

• Accessed page or file

• Referrer URL

• Browser type and version

• Operating system

• Device information

• Volume of data transferred

• HTTP status code

This processing is carried out to ensure the availability, stability, and security of our website, as well as for the detection and prevention of technical attacks.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in providing a secure, stable, and user-friendly website.

To the extent that Framer processes personal data outside the European Economic Area, the transfer takes place on the basis of applicable data protection guarantees, in particular an adequacy decision or appropriate safeguards pursuant to Art. 46 GDPR.

For further information, please refer to Framer's Privacy Policy and Framer's Data Processing Addendum.

4. Server Protocols and Log Files

When you access our website, technical access data may automatically be processed in server log files. This may include, in particular, your IP address, date and time of access, visited pages and files, referrer URL, browser and device information, data volume transferred, and status codes.

Processing is carried out for the following purposes:

• Technical delivery of the website

• Ensuring system stability

• Error analysis

• Detection and prevention of security threats

• Ensuring information security

The legal basis is Art. 6 para. 1 lit. f GDPR.

As a rule, log data is only stored for as long as necessary for the aforementioned purposes. Longer storage may occur if a specific security incident needs to be investigated or if a legal retention obligation applies.

Please verify before publishing: The actual storage period of the log files must be confirmed based on your actual Framer and hosting configuration. A retention period such as "maximum of 30 days" should only be specified if technically verified.

5. Contacting Us

When you contact us via a contact form, email, or telephone, we process the data you provide. This may include, in particular, the following information:

• Name

• Company

• Email address

• Phone number

• Subject

• Content of your inquiry

• Other voluntarily submitted information

The processing is carried out to handle your inquiry, communicate with you, and address potential follow-up questions.

The legal basis is Art. 6 para. 1 lit. b GDPR, provided your inquiry is aimed at the conclusion or execution of a contract. For all other inquiries, processing is based on our legitimate interest in handling and responding to business inquiries pursuant to Art. 6 para. 1 lit. f GDPR.

We generally store your data until your inquiry has been fully resolved, and thereafter for a maximum of six months, unless statutory retention obligations apply or further storage is necessary for the establishment, exercise, or defense of legal claims.

6. Registrations for Webinars, Events, and Training Sessions:

If you register for a webinar, event, training, or workshop via our website, we process the data required for registration and implementation.

This may include, in particular:

• First and last name

• Company and job title

• Email address

• Phone number

• Billing and contact details

• Details about the requested event

• Information regarding participation certificates or training records

• Other voluntarily submitted details

This processing is carried out to organize and execute the event, communicate with participants, manage billing, and, where applicable, issue participation certificates or training records.

The legal basis is Art. 6 para. 1 lit. b GDPR. Insofar as statutory documentation or retention obligations exist, processing is additionally based on Art. 6 para. 1 lit. c GDPR.

Data is stored for the duration of the event or contractual relationship and subsequently in accordance with statutory retention periods.

Photo, video, or audio recordings of events will only be made and used based on prior notification and an appropriate legal basis.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small pieces of information that can be stored on or read from your terminal device.

Technically Necessary Cookies

Technically necessary cookies are used when they are required for the operation of the website or for a function explicitly requested by you. This includes, in particular, cookies used to save your privacy preferences.

Processing is based on Section 165 para. 3 TKG 2021 and, insofar as personal data is processed, on Art. 6 para. 1 lit. f GDPR.

Non-Essential Cookies

Cookies for analysis, statistics, marketing, or similar purposes are only activated after you have given your consent via our consent banner.

The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 165 para. 3 TKG 2021.

According to the Austrian Data Protection Authority, technically non-essential cookies may generally not be set or read before appropriate consent has been obtained. Section 165 para. 3 TKG 2021 also requires information about what data is processed, on what legal basis, for what purpose, and for what duration. [dsb.gv.at] [ris.bka.gv.at]

You may withdraw your consent at any time with effect for the future. You can access and update your preferences via the "Cookie Settings" link in the footer of our website.

The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

8. Consent Management Platform

To manage your privacy preferences, we use a Consent Management Platform. This platform stores which categories and services you have accepted or declined.

In this context, the following data may be processed:

• Consent ID

• Timestamp of consent or refusal

• Selected cookie categories

• Language and browser settings

• Technical information about the device used

• Proof of consent

This processing is necessary to implement your privacy settings and to be able to provide proof of granted consent.

The legal basis is Art. 6 para. 1 lit. c GDPR in conjunction with legal obligations to demonstrate compliance, as well as Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the legally compliant management and documentation of your privacy settings.

Please complete before publishing:

• Name of the actual Consent Manager used

• Provider and address

• Specific storage duration of the proof of consent

• Information on third-country transfers, if applicable

9. Web Analysis with Google Analytics 4

Subject to your consent, we use Google Analytics 4 on our website, a web analysis service provided by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

In connection with support, maintenance, or other processing services, data processing by affiliated companies may also occur, in particular by:

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

Google Analytics helps us analyze the use of our website, measure the reach of our content, and continuously improve our web presence.

Google Analytics is only activated if you have explicitly consented to the analysis via the consent banner. Without your consent, no Google Analytics cookies will be set for web analysis, and no personalized analysis of your user behavior will take place.

The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 165 para. 3 TKG 2021.

Processed Data

Within the scope of Google Analytics, the following data in particular may be processed:

• Pages accessed

• Time and duration of the visit

• Clicks and other interactions

• Technical events

• Referrer URL

• Browser type and version

• Device type and operating system

• Screen resolution

• Approximate location information

• Information about the source of the visit

• Pseudonymous online identifiers

• Consent and cookie information

We do not knowingly transmit names, email addresses, phone numbers, or any other directly identifying information to Google Analytics.

Google states that Google Analytics does not log or store individual IP addresses of users in the EU. The IP address is used solely to derive approximate location information and is subsequently deleted before the data is stored. [support.google.com], [support.google.com]

Use of Google Consent Mode

Google services are controlled in accordance with the selections made via the consent banner. The default setting for analytics and advertising storage should be set to "denied" until consent is given.

We do not use Google Analytics to identify you personally. Features for Google Signals, detailed location and device data, personalized advertising, and linking with Google Ads are only used if technically configured, documented, and covered by your explicit consent.

Recommended configuration for risk on mind:

• Deactivate Google Signals

• Deactivate personalized advertising

• Deactivate detailed location and device data for EU users

• Do not use User ID

• Do not transmit personal data in URLs or event parameters

• Only load GA4 after active consent

Google allows you to disable Google Signals as well as detailed location and device data by region. [support.google.com]

Data Processing Agreement

Google's data processing terms apply to the use of Google Analytics. For Google Analytics customers established in the EU, these terms are part of the terms of service, according to Google. [support.google.com]

Data Transfer to the USA

Processing or transfer of personal data to the USA cannot be fully ruled out.

Insofar as a transfer takes place to a recipient certified under the EU-US Data Privacy Framework and the certification covers the processing in question, the transfer can be based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR.

Where the adequacy decision is not applicable, Google may use appropriate safeguards, in particular Standard Contractual Clauses approved by the European Commission pursuant to Art. 46 GDPR.

Despite these safeguards, in the event of processing in the USA, it cannot be completely ruled out that US authorities may access data within the scope of their statutory powers.

Storage Duration

We configure the retention period for user-level and event-level data in Google Analytics to 14 months.

For standard properties, Google Analytics generally allows a retention period of two or 14 months for user-level and event-level data. This setting does not affect standard aggregated reports in the same way. [support.google.com], [support.google.com]

The lifespans of the cookies used may differ from the retention period configured within the Google Analytics property. The cookies actually deployed and their respective lifespans are displayed in the Cookie Preference Center.

Withdrawal of Consent and Opt-out

You can withdraw your consent at any time via the "Cookie Settings" in the website footer.

Additionally, Google provides a browser add-on to opt out of Google Analytics.

The withdrawal of consent applies to the future. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

10. Embedded Content and External Services

Our website may feature content or functions from external providers, such as videos, maps, appointment scheduling systems, webinar platforms, or external forms.

Such services may process personal data, particularly your IP address and device information. Non-essential external content will only be loaded if you have consented beforehand or actively unlocked the respective content.

The legal basis is Art. 6 para. 1 lit. a GDPR.

Please verify before publishing and complete separately where applicable:

• YouTube or Vimeo

• Microsoft Forms

• Microsoft Bookings

• LinkedIn Insight Tag

• Microsoft Clarity

• Newsletter provider

• Webinar and event platforms

• Google Maps

• reCAPTCHA

• External web fonts

• Calendly or other appointment booking systems

Services that are not actually in use should not be included in the privacy policy as a precautionary measure.

11. Newsletter and Marketing Communication

If we send you a newsletter or other electronic marketing communications based on your consent, we will process your email address, your name, and, where applicable, information about your company and your professional interests.

The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR and the relevant provisions of the TKG 2021.

You can withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link in the respective message or by contacting us at dataprotection@riskonmind.eu.

If an external service provider is used for the newsletter, its name, address, data processing activities, retention period, and any possible transfers to third countries must be supplemented in this section.

This section should only be published if newsletter registrations are actually offered via the website or newsletter data is processed.

12. Recipients of Personal Data

To the extent necessary for the aforementioned purposes, personal data may be shared with the following categories of recipients:

• Hosting and website service providers

• IT and support service providers

• Consent management providers

• Analytics providers, subject to your consent

• Communication and email service providers

• Webinar and event management providers

• Tax consultants, banks, and payment service providers

• Authorities, courts, or other public bodies if there is a legal obligation

• External advisors for the establishment, exercise, or defense of legal claims

Where required, we enter into processing agreements pursuant to Art. 28 GDPR with service providers who process personal data on our behalf.