Privacy Information for Website Users

Controller of all processing activities is:

Margelo GmbH
FN 566573 x
Barichgasse 38/3.5
1030 Vienna

If you are a user of the website

When you visit the website, we process technical data required to provide, secure and improve the website. This can include information that is automatically transmitted by your browser or device, such as requested pages, timestamps, referrer information, approximate location, device type, browser and operating system information. For further information about analytics and cookies, please see the section below.

If you contact us via the online contact form or via the other contact options offered, the personal data you provide will be processed in order to deal with and answer your enquiry, in particular your e-mail address, company name, message and any additional data specified in the text. If you contact us by e-mail or other channels, we process the contact details and communication content you provide.

If you are a business partner/customer

On the basis of a (pre-)contractual relationship, personal data provided by you in the course of the initiation and during the ongoing contractual relationship will be processed.

• Name, company or business name
• Address
• Contact details
• Company register data
• Bank account data and credit card information
• UID number
• Names and contact details of contact persons
• Contract texts and business correspondence

We process your personal data for different purposes and by various means, depending on whether you are a visitor of our website or a business partner/customer.

• For the fulfilment of (pre-)contractual obligations pursuant to Article 6(1)(b) GDPR.
• For the fulfilment of legal obligations pursuant to Article 6(1)(c) GDPR.
• On the basis of legitimate interests pursuant to Article 6(1)(f) GDPR.

These interests include processing and answering enquiries, initiating legal business contact, ensuring the security of website operation, measuring aggregate website usage, optimizing our offer, contacting business partners regarding contractual relationships and maintaining data in the event of a legal dispute. You can object to processing based on legitimate interests at any time on grounds relating to your particular situation.

We transfer your personal data if we are legally obligated to do so or if this is necessary for processing activities.

• Hosting and analytics providers, in particular Vercel Inc.
• Contact form providers, in particular Formspree Inc.
• Other service providers, including IT providers
• Courts and authorities in case of necessity
• Legal representatives, lawyers and legal service providers
• Banks, tax advisers, accountants and auditors
• Insurance companies in the event of an incident

Vercel and Formspree may process data in the United States and other countries outside the European Economic Area. If recipients are located outside the EEA and no adequate level of data protection has been decided by the EU Commission, transfers are made on the basis of Standard Contractual Clauses or otherwise in accordance with Articles 46, 47 or 49 GDPR.

Service providers acting as processors are contractually obligated to keep your personal data confidential and may use it only on our behalf and in line with our instructions.

We use Formspree to receive and manage messages submitted through the contact form. When you submit the form, your e-mail address, company name, message and technical metadata required to transmit and secure the request are sent to Formspree and processed on our behalf. Formspree may store submissions in its inbox and send notifications to us so that we can respond to your enquiry.

Formspree states that it is GDPR compliant, relies on Standard Contractual Clauses as a data processor, hosts services with AWS in the United States, uses TLS for network traffic and encrypts databases at rest. Further information can be found in the Formspree Privacy Policy and on the Formspree Security page.

We process your personal data as long as the processing is necessary. Your personal data will be made anonymous or erased automatically as soon as processing is no longer necessary.

Contact enquiries and related correspondence are retained for as long as necessary to respond to the enquiry, handle follow-up questions, document the business relationship or comply with legal obligations. Analytics data is used in aggregated form to understand website usage and improve the website.

We retain personal data necessary for the performance of our services according to mandatory record retention and documentation duties, including under the Austrian Commercial Code (Unternehmensgesetzbuch) and the Federal Fiscal Code (Bundesabgabenordnung). We also comply with legal limitation periods, including under the Austrian Civil Code (ABGB), which can last up to 30 years in certain cases.

The public website does not use analytics cookies. Where the website provides authenticated or otherwise technically protected functionality, strictly necessary cookies may be used to provide that functionality and cannot be disabled through the website.

We use Vercel Web Analytics on the basis of our legitimate interests under Article 6(1)(f) GDPR to understand aggregate website usage and improve the website technically and editorially. Vercel Web Analytics may process data points such as timestamp, URL, dynamic path, referrer, filtered query parameters, approximate geolocation, device type, browser, operating system and analytics script version.

Vercel states that Web Analytics does not use cookies, does not collect personal identifiers that track users across different websites, records data points anonymously and uses aggregated statistics only. Visitors are identified by a hash created from the incoming request; according to Vercel, the generated hash is valid for a single day and the lifespan of a visitor session is discarded after 24 hours.

Further information can be found at vercel.com/docs/analytics and vercel.com/docs/analytics/privacy-policy.

Provided that we process your personal data, you have the following rights:

• Right of access
• Right to rectification and erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent where processing is based on consent
• Right to lodge a complaint with the supervisory authority

In Austria, the competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), www.dsb.gv.at.

To exercise your rights in connection with your personal data processed by us, please contact:

Margelo GmbH
FN 566573 x
Barichgasse 38/3.5
1030 Vienna
hello@margelo.com

Definitions of the terms used, such as "personal data" or "processing", can be found in Article 4 GDPR.