Privacy Policy

1. Overview

If we have the pleasure of welcoming you as a customer or business partner, please start reading at section 3.
If you are visiting our website, please start reading at section 2.

2. What data do we process when you visit our website?

Welcome to the www.elferspot.com website! Please familiarize yourself with how we process your personal data when you visit our website (Art. 13, Art. 14 of the GDPR; § 165(3) of the TKG).

When you visit our website, the following data may be processed:

• Browser type,
• Operating system,
• Country,
• Date,
• time and duration of access,
• ^{IP address¹} and pages visited on our website, including entry and exit pages,
• contact page on the website,
• Email address,
• payment information,
• Phone number,
• Mailing address,
• Data provided during registration.

The processing of this data is necessary to ensure the secure operation of the website and to guarantee its functionality from a technical standpoint. This data is collected in part through technical cookies. These technical cookies are used only to the extent necessary (Section 165(3) of the German Telecommunications Act (TKG)). The processing of this data is justified by our legitimate interest in operating our website (Article 6(1)(f) of the GDPR).

In order to operate our website, we may need to disclose your data to the following recipients:

Sign In with Google (“Sign in with Google” / OAuth)

On our website, we offer the option to sign in or create a user account using the “Sign in with Google” (OAuth) service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If the user chooses this login method, Google provides us with the following data after authentication has been completed and with the data subject’s consent: first name, last name, and email address. We process this data exclusively to create the user account, complete the sign-in process, and provide access to the platform’s features. The legal basis is Art. 6(1)(b) of the GDPR (performance of the contract or pre-contractual measures at the data subject’s request) and, to the extent that consent is required for the connection to Google and the transmission of profile data, Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time with future effect; the lawfulness of the processing carried out prior to withdrawal remains unaffected. Google may also process technical data (e.g., IP address, browser, and device information). Transfer to third countries, in particular to the U.S., is possible; Google is certified under the EU-U.S. Data Privacy Framework. Further information on data processing by Google can be found at https://policies.google.com/privacy. The use of “Sign in with Google” is voluntary; registration and login are also possible without a Google account.

OpenAI Ads (ChatGPT Ads Measurement Pixel)

On our website, we use the “ChatGPT Ads Measurement Pixel” (OpenAI Pixel) provided by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. This pixel allows us to track the actions visitors take on our website after viewing or clicking on one of our ads in ChatGPT—such as visiting a page, registering, submitting an inquiry, or making a purchase. This allows us to measure the effectiveness of our advertising campaigns and improve them. The following data may be processed in this process: a click ID that OpenAI appends to our website’s address when an ad is clicked; a randomly generated identifier for your browser; the page visited; the type and time of the tracked action; and, where applicable, information regarding products, amounts, and currency. For technical reasons, your IP address is also transmitted to OpenAI when the pixel loads; in addition, browser and device information may be processed. To store the browser identifier, the pixel on our website sets the “__obref” cookie, which is valid for 365 days. In accordance with OpenAI’s terms of service, we and OpenAI each act as independent data controllers in this processing. OpenAI uses the data received to provide us with analytics on the performance of our campaigns, as well as to measure, optimize, deliver, and improve its own services. We receive only performance reports on our campaigns from OpenAI, but no information about the activities of individual users. According to OpenAI, it does not currently use the data collected via the pixel for user-specific personalization. We use the OpenAI pixel only if you have given your consent via our cookie banner (Borlabs Cookie). The legal basis is your consent pursuant to Art. 6(1)(a) of the GDPR and § 165(3) of the TKG. You may revoke your consent at any time with future effect by adjusting your selection via the “Cookies” link on our website; the lawfulness of the processing carried out up to the time of revocation remains unaffected. In addition, you can delete cookies that have already been set at any time in your browser settings. The transfer of personal data to third countries, in particular to the United States, is possible; according to OpenAI, such transfers are based on the Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) of the GDPR). In addition, the transfer is based on your consent pursuant to Article 49(1)(a) of the GDPR. OpenAI itself determines how long it stores the transferred data on its own servers; according to its own statements, OpenAI stores personal data only for as long as necessary to provide the services or for other legitimate business purposes, such as resolving disputes, for security reasons, or to comply with legal obligations. You can exercise your rights with respect to OpenAI at https://privacy.openai.com or by email at dsar@openai.com. Further information on data processing by OpenAI can be found at https://openai.com/de-DE/policies/eu-privacy-policy/.

2.1 Overview of the “technical” cookies used

The data mentioned above is stored using so-called^{“cookies”2}. Cookies are text files that are stored on your computer and enable an analysis of how the website is used. They are used to recognize and store temporary data about website visitors. We generally use cookies only to the extent necessary to communicate with you via the website.

These technical cookies are activated as soon as you visit our website.

The following cookies are used on our platform based on our overriding legitimate interest (Article 6(1)(f) of the GDPR):

2.2 Overview of the “Advertising Cookies” We Use

In addition to the “technical cookies” described above, we also use so-called advertising cookies (including “statistical cookies”). These advertising cookies enable us to better understand and analyze your interests. With the help of advertising cookies, we can combine your “browsing behavior” beyond the boundaries of our website with data from other websites. This enables us to better understand the interests of our website visitors and address them in a more targeted manner.

We respect that not every visitor to the website wants this. Therefore, we process your data in connection with advertising cookies only if you consent to it (Art. 6(1)(a) GDPR). You may withdraw this consent at any time, although the data processing that took place up until the time of withdrawal remains justified.

The following advertising cookies are currently in use:

3. For what purposes do we process your data if you are a customer of ours or have a business relationship with us?

In the course of our business relationship with patients and business partners, we process data based on contractual obligations ( fulfillment of the contractual relationship with you, pre-contractual obligations, billing for services, sending documents, and communication necessary for contract fulfillment) and legal obligations ( legally required retention pursuant to § 132 BAO); (Art. 6(1)(b) and (c) of the GDPR) as well as based on our legitimate interests or the legitimate interests of third parties (Art. 6(1)(f) of the GDPR), namely:

• for the purposes of internal administration and management of your business transaction to the extent necessary (e.g., processing your business transaction, forwarding your business transaction to various departments, filing, archiving, and correspondence with you);
• Disclosure of data in connection with corporate transactions (e.g., due diligence reviews);
• Delivery of packages;
• For the purpose of direct marketing (e.g., mailing, emailing, satisfaction surveys, congratulatory letters, statistical analyses);

We would like to expressly inform you that you have the right to object to the processing of your data for direct marketing purposes.

• Asserting and Defending Legal Claims

to the extent necessary in each case. The processing of your data serves to initiate, maintain, and conduct our business relationships. If you do not provide us with this data, we will unfortunately be unable to process your business transaction.

In addition, personal data may be transferred to our processors (as defined in Article 4(8) of the GDPR). These processors are listed in Section V.

Where applicable, we process your data based on your voluntary, explicit consent (Article 6(1)(a) of the GDPR).

4. How long will your data be stored?

We will store your data only for as long as is necessary for the purposes for which we collected it. In this context, statutory retention requirements must be taken into account (for example, for tax purposes, contracts and other documents arising from our contractual relationship must generally be retained for a period of seven years (Section 132 of the Austrian Federal Tax Code (BAO))). In justified individual cases—such as to assert or defend legal claims—we may also store your data for up to 30 years after the business relationship has ended.

We retain data from prospective customers for one year from the date of their last contact with us.

5. Who might receive your data?

In the course of our business relationship, we may need to disclose your data to the following recipients:

6. Collection of Data from Other Sources (Article 14 of the GDPR)

In the course of a business relationship, or when establishing one, it is naturally necessary to conduct research on the business partner. This is done only to the extent necessary for that purpose. In this context, data may be retrieved and processed from the following sources:

7. Does automated decision-making or profiling take place (Article 13(2)(f) of the GDPR)?

Our company does not engage in automated decision-making or profiling.

8. What rights do you have regarding data processing?

We would like to inform you that, provided the legal requirements are met:

• You have the right to request information about what data we process about you (see Article 15 of the GDPR for details).
• You have the right to request the correction or completion of inaccurate or incomplete personal data concerning you (see Article 16 of the GDPR for details).
• You have the right to have your data erased (see Article 17 of the GDPR for details).
• You have the right to object to the processing of your data that is necessary to safeguard our legitimate interests or those of a third party. This applies in particular to the processing of your data for marketing purposes.
• The right to receive the data you have provided in a structured, commonly used, and machine-readable format.

If we process your data based on your consent, you have the right to withdraw that consent at any time by email. This does not affect the lawfulness of the data processing carried out up to that point (Art. 7(3) GDPR).

9. What rights do you have to file a complaint?

Should, contrary to expectations, your right to lawful processing of your data be violated, please contact us by mail or email. We will make every effort to address your concerns promptly. However, you also have the right to file a complaint with the supervisory authority responsible for data protection matters in your jurisdiction.

The address of the Austrian Data Protection Authority is:

Austrian Data Protection Authority
Barichgasse 40-42,
1030 Vienna

10. How can you contact us?

If you have any further questions regarding the processing of your data, please feel free to contact our Data Protection Coordinator using the contact information provided below.

11. Data Controller

The data controller within the meaning of Article 4(7) of the GDPR is:

Elferspot Media GmbH
Hauptstraße 6, 3rd Floor, 4040 Linz, Austria
info@elferspot.com

¹ An IP address is a number assigned to a device. Devices use this IP address to communicate over the Internet. Every IP address contains information about the Internet service provider used and the physical location of the device. In this way, information about the device’s user can be obtained.

² You can prevent cookies from being stored by adjusting your browser settings accordingly. However, please note that in this case, you may not be able to use all of the features of this website to their full extent.