Privacy Policy

This policy sets out which personal data this platform processes, for what purpose and on what legal basis. It is organised by the three groups who use the platform: visitors without an account, commercial agents, and representations.

1. Controller and contact

Controller within the meaning of the General Data Protection Regulation: Open item 1:1[Responsible body]

Data protection officer: Open item 2:2[Name and contact details of the data protection officer]

Contact for data subject requests: Open item 3:3[E-mail address for access, rectification and erasure]

2. Visitors without an account

Without signing in, only the home page, the legal notice, this privacy policy, the terms of use and the accessibility statement are reachable. Every other address leads back to the home page.

Server log files

Each page request causes the server to process the IP address, the time, the address requested, the status code, the volume transferred, the referrer and the browser identification. The purpose is technical operation and defence against attacks. The legal basis is the legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Retention period: Open item 4:4[Ask the hosting providers and insert]

Cookies

No analytics, marketing or third-party cookies are set. There is no tag manager, no embedded content, no external fonts and no content delivery network.

• ha_lang — remembers the chosen interface language. Lifetime: one year.
• ha_target — remembers the page originally requested before signing in. Lifetime: a few minutes.
• WordPress authentication cookies — sign-in and session. Set only after signing in.

All cookies are strictly necessary; no consent is required for them.

No self-registration

Accounts are vetted and created internally. A visitor without an account cannot submit any personal data through this website.

3. Commercial agents

3.1 Account data

The account is created by Open item 1:1[Responsible body]; name and e-mail address originate from that step. In the account the agent maintains: phone number (normalised to international notation on saving), the marker “contact via WhatsApp welcome” and a free-text “About me”.

Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).

3.2 Shortlist

Shortlisted offers are stored with the offer identifier, a timestamp and a private note. The note is visible to nobody else — not even to the representation that published the offer.

If a shortlisted offer is permanently deleted, the agent receives a notification containing the note so that it is not lost; the entry is then removed and the note is not retained any further.

3.3 Enquiries to representations

With an enquiry, the name, e-mail address, phone number, the WhatsApp marker and the “About me” text are transmitted to the chosen representation. The message text itself is not stored. Stored are only: who, when, about which offer, to which representation, and whether delivery succeeded.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Without a name and an e-mail address the representation cannot reply; a forced consent would not be freely given here.

Limits apply against misuse: at most ten enquiries per hour, thirty per day, and the same offer no sooner than twenty-four hours later.

3.4 Usage statistics

The following is recorded, each item individually switchable by Open item 1:1[Responsible body]:

• Offer views — when an agent opens the detail page of somebody else’s offer. Repeated views within thirty minutes count once.
• Visits and sign-ins — sessions, updated at most every five minutes, as well as actual sign-in events.
• Filter searches — the chosen combination of country of origin and industry, above all those without results.

Views by the owner of an offer and by administrators are not counted.

Retention: The individual, person-related events are deleted after thirteen months (default, configurable). Only aggregated monthly totals without any personal reference are kept permanently.

Representations see totals only — never which agent opened or shortlisted an offer.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — establishing whether the access-restricted service is being taken up.

3.5 Notifications

The self-chosen settings are stored: language, frequency (daily, weekly or none) and the filters by industry, customer group and territory. Delivery can be switched off in the account at any time.

There is no success measurement in these e-mails: no tracking pixel, no rewritten links. The logos they contain are loaded from our own server.

Delivery log: For every message the recipient, the time, the state and any error text are recorded — as proof of delivery and to prevent duplicate sending. Retention: Open item 5:5[Define a period, suggestion: 24 months]

4. Representations

4.1 Account data

Name of the representation, contact person, address, postal code, city, country and e-mail address. Maintained in the account by the representation itself.

4.2 Offers

Published offers contain details of the company seeking representation, where applicable including a contact person, an address and contact details. This information is visible to all signed-in commercial agents.

Note to representations: Details of named individuals in an offer are personal data of third parties. The representation is responsible for being permitted to publish them. The corresponding obligation is set out in the terms of use.

The representation’s own e-mail address appears on an offer only if Open item 1:1[Responsible body] explicitly enables it; the default is off. The owner always sees their own address.

4.3 Reports

Representations receive monthly figures about their own offers, as totals only. In addition there are two e-mails: a notice about offers due to expire, and a status and statistics report. Both can be unsubscribed from individually in the account. Section 3.5 applies to the delivery log.

5. Recipients and processors

• Open item 6:6[Hetzner — full company name and registered office] — hosting.
• Open item 7:7[TOSCOM — full company name and registered office] — hosting.
• Mailgun — e-mail delivery, EU region (eu-central-1), parent company in the United States. Basis for the transfer: Open item 8:8[adequacy decision or standard contractual clauses — verify]
• fitting-solutions — Richard Gruberbauer, Austria — development and maintenance.

Contracts pursuant to Art. 28 GDPR are in place with all processors. Open item 9:9[Confirm that the contracts exist]

No transfer to advertising networks, analytics services or social networks.

6. Deletion and restoration

Deleted content can be restored only after contacting Open item 1:1[Responsible body] and only within thirty days.

Open item 10:10[Statement on the backup concept: are backup copies retained permanently? This must match the actual practice of both hosting providers — a false assurance would be worse than none at all.]

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, objection and data portability.

7.1 How to request access or erasure

There is deliberately no button in the account: a request has to be checked and confirmed, otherwise somebody else could trigger the erasure of your data in your name. The route is therefore this:

• Write to us at Open item 3:3[E-mail address for access, rectification and erasure] and state whether you want access or erasure.
• You receive a confirmation e-mail containing a link. Only once you click it does the process continue — that is the check that the request really comes from you.
• For access you then receive a file to download containing all data held about you: profile and notification settings, shortlist including your notes, your enquiries, the statistical events and the delivery log.
• For erasure your account and your personal data are removed.

⚠️ One thing is not deleted on erasure but anonymised: your enquiries, the statistical events and the delivery log. These entries are also business records of the respective representation — they remain as figures, and the reference to you as a person is removed. Who made the enquiry can no longer be established afterwards.

We answer requests within one month (Art. 12(3) GDPR). If it takes longer, we tell you so within that period, with reasons.

7.2 Complaints

If you are not satisfied with how your request was handled, you may lodge a complaint with the supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna.

Open item 11:11This text is a draft and has not been legally approved. It describes the technical state of the platform and serves as a basis for discussion. Before publication it belongs to somebody who is liable for it.