Note: This is a convenience translation. The legally binding version is the German one, available at the German page. In case of any discrepancy, the German version prevails.
Privacy Policy
With this privacy policy we inform you about which personal data we process in connection with the visit and use of the website reichweitenwerk.at, for which purposes and on which legal basis this takes place, and which rights you have as a data subject. The processing of personal data takes place in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) as well as the other relevant data protection provisions.
1. Controller and Contact
The controller within the meaning of Art. 4 No. 7 GDPR is:
ODS GmbH (the website operates under the brand „Reichweitenwerk") Dr.-Billroth-Siedlung 8/2 8435 Leitring Österreich
Commercial register number: FN 660971 t, Landesgericht für ZRS Graz VAT ID: ATU82555628 Email: support@reichweitenwerk.at Web: reichweitenwerk.at
Authorized managing directors: Alexander Szakaly, Jan Doleschel
A data protection officer to be appointed by law was not designated, as the preconditions under Art. 37 GDPR are not met. For all matters relating to data protection and the exercise of your rights, our data protection contact point is available at support@reichweitenwerk.at.
2. General Information on Data Processing and Terms
Personal data is all information relating to an identified or identifiable natural person (e.g. name, email address or IP address). Processing is any operation in connection with such data, for example collecting, storing, using, transmitting or deleting.
We process personal data only insofar as this is necessary for the provision of a functional website as well as our content and services, and always only on the basis of a valid legal basis. Processing takes place in particular when it is necessary for the performance of a contract or for the implementation of pre-contractual measures (Art. 6(1)(b) GDPR), when you have consented to it (Art. 6(1)(a) GDPR), when a legitimate interest exists and your interests do not prevail (Art. 6(1)(f) GDPR) or when a legal obligation requires it (Art. 6(1)(c) GDPR).
The website is essentially a static marketing landing page created with the Next.js framework. Analytics and marketing services (reach measurement, pixels) are loaded only after your express consent; in the default state no such tracking takes place (see section 6 for details).
3. Server Log Files and Hosting
Our website is operated by the hosting service provider Hostinger (Hostinger International Ltd., Lithuania/EU). Delivery takes place via a data center in Frankfurt am Main (Germany) and thus within the European Union or the European Economic Area.
Each time our website is accessed, information is automatically transmitted by the browser of your end device to the server of our hosting service provider and temporarily stored in so-called server log files. These are technically necessary data required for the delivery of the website as well as for its security and stability. The following are recorded in particular:
- the IP address of the requesting end device (shortened or anonymized where technically possible)
- date and time of access
- the specifically requested resource (name and URL of the file accessed)
- the previously visited page (referrer URL)
- information about the browser and operating system used (user agent)
These data are not merged with other data sources and do not serve to identify individual persons.
The legal basis for the processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and trouble-free operation of the website as well as in the defense against and clarification of abusive access.
A data processing agreement pursuant to Art. 28 GDPR exists with our hosting service provider, which ensures that the processing of your data takes place exclusively according to our instructions and in accordance with the GDPR.
4. Self-Hosted Fonts
For a uniform presentation of content we use the fonts „Archivo" and „Roboto Slab". These fonts are hosted exclusively by ourselves, that is, it is delivered directly from our own server or the server of our hosting service provider within the EU/EEA.
There is no connection to Google Fonts or to any other servers of Google or other third-party providers. When loading the font, no personal data is therefore transmitted to external third parties; in particular, your IP address is not passed on to Google or third parties.
5. Contact Form and Contacting Us
On our website we provide you with a contact form through which you can get in touch with us. When using the form, the data you enter is processed for the purpose of processing your enquiry and any contact.
The following information is processed:
| Data field | Requirement |
|---|---|
| First name | Mandatory field |
| Surname | Mandatory field |
| Email address | Mandatory field |
| Telephone number | optional |
| Company / Website | optional |
| Message | optional |
In addition, the indication of the source „reichweitenwerk.at" is technically transmitted with your enquiry. It serves to classify your enquiry in terms of content and to be able to submit a suitable offer to you.
The purpose of the processing is the handling and answering of your enquiry as well as the preparation and, where applicable, implementation of a business relationship.
The legal basis is Art. 6(1)(b) GDPR, insofar as your enquiry is aimed at the conclusion or performance of a contract or serves the implementation of pre-contractual measures. Otherwise – for example in the case of general enquiries – the processing is based on our legitimate interest in the efficient handling of the matters brought to us pursuant to Art. 6(1)(f) GDPR.
The data transmitted via the form is forwarded by email to our address support@reichweitenwerk.at and may furthermore be stored for further processing in our customer relationship management system (CRM) of the provider Zoho (see section 7 on this).
To protect against automated abuse (spam), we use technical protective measures, in particular an input field that is invisible to you (so-called „honeypot" method) as well as server-side validation of the entries. In this process, no personal data beyond the stated purposes is evaluated.
Google reCAPTCHA: To protect the form against abusive automated use, we additionally use „reCAPTCHA v3" from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). reCAPTCHA evaluates various information in the background (including IP address, dwell time, mouse and keyboard inputs as well as device and browser information) in order to distinguish whether the input is made by a human or automated. This information is transmitted to Google; this may involve a transfer to the USA (safeguards: EU-US Data Privacy Framework or EU standard contractual clauses, see section 9). reCAPTCHA is only loaded once you interact with the form. The legal basis is our legitimate interest in the defense against spam and abuse pursuant to Art. 6(1)(f) GDPR. Further details in Google's privacy policy (https://policies.google.com/privacy) as well as at https://policies.google.com/terms.
Contact by telephone: For incoming and outgoing calls we use the telephone system Zoho Voice of Zoho Corporation B.V. (EU data center, see section 7). This gives rise to connection data: the telephone numbers of both parties, the direction of the call (incoming or outgoing), time and duration, the outcome of the call (for example answered, not reached) as well as the notes our staff record afterwards. This information is assigned to your record in our customer relationship management system so that we can trace the course of our contacts and do not have to ask you the same questions again on a subsequent call.
Calls are not recorded. Should we introduce call recording in future, it would take place solely following a prior announcement and with your consent; we would amend this policy accordingly beforehand.
The legal basis is Art. 6(1)(b) GDPR insofar as the call serves the initiation or performance of a contract, and otherwise our legitimate interest in traceable and efficient customer communication pursuant to Art. 6(1)(f) GDPR. You may object to processing on this basis at any time (Art. 21 GDPR). We delete the connection data together with the associated record (see section 10).
Storage period: We store the data arising in connection with your enquiry until your matter has been conclusively settled. Insofar as statutory retention obligations exist – for example under company or tax law provisions – or the data is required for the assertion or defense of legal claims, we store the relevant data for the duration of the respective period.
5.1 Enquiry forms on our campaign pages
On our campaign pages (for example "/gastro/", "/gastro-mitarbeiter/", "/beauty-friseure/", "/berater-it/" and the report pages linked from them) we use our own multi-step enquiry form. It collects more information than the general contact form:
| Data field | Requirement |
|---|---|
| First name | Mandatory field |
| Last name | Mandatory field |
| Company | Mandatory field |
| E-mail address | Mandatory field |
| Telephone number | Mandatory field |
| Catchment area (town or region) | Mandatory field |
| Type of business | optional |
| Company name | optional |
| Website or social media profile | optional |
| Advertised offer | optional |
Purpose is the preparation and conduct of a personal consultation. On request we use this information to prepare a non-binding analysis of the competitive environment in your catchment area ("Mitbewerber-Radar"), which we then discuss with you by telephone.
Legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request); for the analysis of the competitive environment we additionally rely on your consent under Art. 6 (1) (a) GDPR, which you grant by submitting the form and may withdraw at any time.
Processing route: The information is first received by our automation service on a server in Frankfurt am Main (Germany), checked there for completeness and subsequently transferred to our CRM system (Zoho, data centre in the EU, see section 7). No transfer to a third country takes place.
5.2 Appointment booking via termine.reichweitenwerk.at
At termine.reichweitenwerk.at you can select an appointment yourself via a personal link belonging to one of our sales staff. The page is operated on the same server as this website (see section 3) and loads no content from third-party providers – no fonts, no scripts, no tracking pixels.
The following information is processed in this context:
| Data field | Requirement |
|---|---|
| First name | mandatory |
| Last name | mandatory |
| Email address | mandatory |
| Telephone number | mandatory |
| Company | optional |
| Message | optional |
| Selected appointment and meeting channel (telephone or video conference) | results from your selection |
The telephone number is a mandatory field even where the appointment takes place as a video conference – we need it in order to be able to reach you should the connection fail to be established.
Purpose is the arrangement, confirmation, rescheduling and cancellation of the appointment you have selected, as well as the reminder thereof.
Legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request).
Confirmation, rescheduling, cancellation and reminder emails are sent to you from the personal address of the responsible staff member in the form firstname.lastname@reichweitenwerk.at. A calendar file is attached to these emails so that you can transfer the appointment into your own calendar. A copy is sent to the responsible staff member.
Your amendment link: The emails contain a link with which you can reschedule or cancel the appointment without logging in. It is valid until 24 hours after the appointment; only an irreversible checksum of this link is stored in our database.
Calendars of our staff: So that you are not offered a time that is already taken, we read – where the respective staff member has set this up – their calendar via a subscription address provided by them and stored in encrypted form. From these external calendars we store exclusively start, end and the indication of whether the entry is an all-day entry. Appointment titles, descriptions and participants are not read out and not stored.
No cookie without necessity: When viewing the booking page and when selecting a time, no identifier is set and none is stored in your browser – not even one for the individual page view. After submission we set a short-lived technical cookie (validity five minutes) which exclusively carries the confirmation message and contains no identifier. There is therefore no cookie banner on this page, because no analytics or marketing services are integrated.
Protection against automated misuse: We employ the same technical measures as with the contact form (invisible input field, server-side validation) and limit the number of bookings per connection. For this purpose we store not your IP address, but exclusively an irreversible hash value derived from it, together with the time and the result. These log entries are deleted after 90 days.
Storage period: We store the appointment itself and the associated information for as long as it is required for the business relationship (see section 10). In the case of a cancelled appointment, your contact details are removed from the appointment records at the latest twelve months after the original appointment. The busy times read from external calendars are completely replaced with every synchronisation.
6. Cookies, Consent and Analytics/Marketing Services
When visiting our website, only technically necessary cookies or comparable technologies are used by default, which are required for the proper operation and the basic functionality of the website. A use of analysis, tracking or marketing cookies does not take place in the default state.
The processing in connection with technically necessary cookies is based on our legitimate interest in the technically error-free operation of the website (Art. 6(1)(f) GDPR); the storage of or access to information in your end device that is strictly necessary for the provision of the website expressly requested by you is permitted without consent pursuant to § 165(3) TKG 2021.
6.1 Consent Management (Cookie Banner)
A cookie consent banner is available to you on your first visit for managing your preferences. The analytics and marketing services listed below are only loaded – and the corresponding cookies are only set – after you have expressly selected „Accept all" in the banner (opt-in). If you select „Essential only", these services are not loaded and no analytics or marketing cookies are set.
The legal basis for setting these cookies and the associated processing is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021. Your consent is voluntary; you suffer no disadvantages in using the website without it.
You can withdraw consent already given at any time with effect for the future. It is sufficient to delete the cookies or local storage data stored by our website in your browser (whereupon the banner reappears and you can decide anew) or to block the respective services via your browser's cookie settings. The lawfulness of the processing carried out up to the withdrawal remains unaffected.
6.2 Analytics and Marketing Services Used
Once consent has been given, we use the following services. These may set cookies, process your IP address, form a device/usage identifier and transmit data – including to the USA – to the respective providers (see section 9):
- Google Tag Manager (GTM): Service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for the central management and triggering of the other services listed below. The tag manager itself generally does not set its own analytics cookies but serves as the technical basis for their delivery.
- Google Analytics 4 (GA4): Web analytics service of Google Ireland Limited for the statistical evaluation of usage behavior (e.g. pages viewed, dwell time, approximate origin). We use IP anonymization. Identifier: G-6KRW4W5ZLB.
- Meta Pixel: Service of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) for measuring the success of our ads on Facebook/Instagram as well as for building audiences (remarketing). Identifier: 4358409921140623.
- TikTok Pixel: Service of TikTok Technology Limited (10 Earlsfort Terrace, Dublin 2, Ireland) for measuring the success of our ads on TikTok as well as for building audiences. Identifier: D92C2HRC77U49J8650C0.
- Microsoft Clarity: Web analytics service of Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) for analyzing usage behavior via session recordings and heatmaps (e.g. mouse and scroll movements, clicks, anonymized replay of page interactions) to improve the usability of our website. Identifier: xinol1fger.
- OpenAI pixel (ChatGPT Ads): Service of OpenAI Ireland Limited (1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland) for measuring the success of our advertisements in ChatGPT. The service sets a first-party cookie (
__oppref) containing a click identifier that is passed on when you access our site from a ChatGPT advertisement, and reports back to OpenAI if you subsequently submit an enquiry. Cookie storage period: 30 days. Advanced matching: If you submit one of our forms, we additionally transmit your email address, telephone number and first and last name — but exclusively as an irreversible hash value (SHA-256). The conversion takes place in your browser; the details in plain text do not leave your device for this purpose. This allows OpenAI to attribute the enquiry to the preceding ad click without receiving the details themselves. If the conversion fails, these details are not transmitted at all. We do not transmit any country, city or postal code details.
The purpose of this processing is reach and success measurement, the optimization of our offering as well as the needs-based delivery and measurement of our online advertising. For further information on the data processing by the providers, please see https://policies.google.com/privacy (Google), https://www.facebook.com/privacy/policy (Meta), https://www.tiktok.com/legal/page/eea/privacy-policy/de (TikTok) https://privacy.microsoft.com/en-us/privacystatement (Microsoft) and https://openai.com/policies/eu-privacy-policy/ (OpenAI).
6.3 Reach Measurement Without Cookies (First-Party Counting)
In addition to the services named above, we collect our own aggregated usage figures on individual pages of our website. Only the following is recorded: the page called up, the type of event (page view, scroll depth reached, time spent, click on a button), the associated numerical value and the point in time.
For this purpose no cookies are set and no information is stored on or read from your device; § 165 (3) TKG 2021 therefore does not apply. No identifier is created or stored – not even one limited to a single page view. The values are aggregated per page only. Any attribution to you personally, to an individual page view, or recognition on a later visit, is thereby excluded. Your IP address is not stored for this counting.
The legal basis is our legitimate interest in a comprehensible measurement of the success of our own content (Art. 6 (1) (f) GDPR).
If you have selected "Accept all" in the cookie banner, the following are additionally recorded: the campaign parameters of the address called up (UTM parameters), the domain name of the referring page – without path and without parameters –, the category of your device (mobile or desktop), the page variant called up and the entry route. This information is linked by a session identifier. The legal basis for this is your consent (Art. 6 (1) (a) GDPR), which you may withdraw at any time with effect for the future.
The data collected remains on our server in Germany (see section 3) and is not transferred to third parties. We delete event data after 180 days and page-view data after 400 days.
6.4 Video Playback on Personal Preparation and Offer Pages
If we send you a link to a preparation page or to your personal offer page after scheduling an appointment or in connection with an offer, that link contains a signed identifier. It allows us to associate playback of the video embedded there with your record in our customer management system.
We record only the following: whether the video was started, the highest progress reached as a percentage, the accumulated viewing time in seconds, the number of views, the time of the most recent view, the page called up, and the identifier of the video.
The identifier in the link contains neither your name nor your email address. It is a signed reference to your record and expires after 30 days. The page itself displays no personal data – a forwarded or intercepted link therefore reveals nothing about you.
The purpose is to prepare for the personal conversation: we would like to know whether you have the explanatory material to hand, so that we can build on it during the appointment rather than repeating what you already know. The legal basis is our legitimate interest in advice tailored to your level of knowledge (Art. 6(1)(f) GDPR).
You may object to this processing at any time (Art. 21 GDPR); an informal message to the address given in section 1 is sufficient. If you call up the page without using the link from our message, no association takes place.
Without this identifier – that is, for every visit via a search engine, a bookmark or a shared link – video playback is counted anonymously only (see 6.3). In that case there is neither an association with a person nor a transfer to our customer management system.
The event data remains on our server in Germany (see section 3) and is deleted after 180 days. The aggregated values held with your record are deleted together with that record (see section 10).
7. Commissioned Processing and Recipients
To provide our services and to operate our infrastructure, we use carefully selected service providers who process personal data on our behalf and according to our instructions. Where required, data processing agreements pursuant to Art. 28 GDPR exist with these service providers. The following overview (in accordance with the appendix to the data processing agreement) names the possible recipients and service providers:
| Service provider | Service | Registered office / Data location | Third-country safeguard |
|---|---|---|---|
| Google Ireland Ltd. | Google Analytics 4 & Google Tag Manager (reach measurement on this website, only with consent) | Ireland (EU) / partly USA | DPF / EU-SCC |
| Google Ireland Ltd. | Google Ads | Ireland (EU) / partly USA | DPF / EU-SCC |
| Google Ireland Ltd. | reCAPTCHA (spam protection contact form) | Ireland (EU) / partly USA | DPF / EU-SCC |
| Meta Platforms Ireland Ltd. | Meta Pixel (success measurement on this website, only with consent) & Meta (Facebook/Instagram) Ads | Ireland (EU) / partly USA | DPF / EU-SCC |
| TikTok Technology Ltd. | TikTok Pixel (success measurement on this website, only with consent) & TikTok Ads | Ireland (EU) / partly third country | EU-SCC + additional measures |
| Microsoft Ireland Operations Ltd. | Microsoft Clarity (usage analytics/heatmaps on this website, only with consent) | Ireland (EU) / partly USA | DPF / EU-SCC |
| OpenAI Ireland Ltd. | OpenAI pixel (success measurement on this website, only with consent) & ChatGPT Ads | Ireland (EU) / partly USA | EU-SCC |
| Zoho Corporation B.V. | CRM, Forms, Sign, Billing, Voice (telephone system) | EU data center | DPF / EU-SCC |
| Payment service provider (GoCardless / Stripe) | SEPA direct debit / payment processing | EU | EU-SCC where required |
| Hostinger (Hostinger International Ltd.) | Hosting / storage of the website | Frankfurt am Main, Germany (EU) | not required (EU hosting) |
A transfer of your data to the named recipients takes place only insofar as this is necessary for the respective purpose. A disclosure to other third parties only takes place if there is a statutory obligation or another permissible legal basis for this.
8. Advertising Platforms and Online Marketing Service
An essential component of our service is the planning and execution of online advertising campaigns for our customers. These advertising campaigns are displayed not on this website, but on external advertising platforms, in particular via Google Ads, Meta (Facebook and Instagram) as well as TikTok.
In the context of placing such campaigns, the named platform operators process personal data under their own terms and on their own responsibility. They act in this – depending on the configuration – as independent controllers or as joint controllers within the meaning of Art. 26 GDPR. We have only limited influence on the specific data processing by these platforms. This may also involve a transfer of data to third countries, in particular to the USA (see section 9).
For further information on the data processing by the respective platforms, please refer to their own data protection notices:
- Google Ads: https://policies.google.com/privacy
- Meta (Facebook/Instagram): https://www.facebook.com/privacy/policy
- TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/de
These processing operations relate to the execution of the advertising service we offer and are to be distinguished from the mere use of this website.
9. Transfer to Third Countries
Insofar as personal data is transferred to recipients outside the European Union or the European Economic Area (so-called third countries), this only takes place in compliance with the special preconditions of Art. 44 et seq. GDPR.
A transfer to third countries, in particular to the USA, may take place namely in connection with the services named in sections 8 and 9. The following serve as appropriate safeguards to ensure an adequate level of data protection:
- the certification of the respective recipient under the EU-US Data Privacy Framework (DPF), insofar as the company concerned is correspondingly certified, as well as
- the conclusion of the EU standard contractual clauses (SCC) issued by the European Commission, where applicable supplemented by additional technical and organizational protective measures.
In the case of transfers to the USA to recipients not certified under the DPF as well as in the case of transfers to other third countries, we rely on the named standard contractual clauses including the required additional measures. You can request a copy of the respective relevant safeguards via the data protection contact point named in section 1.
10. Storage Period and Deletion
We process and store personal data only for as long as is necessary for the achievement of the respective processing purpose or a statutory retention obligation exists.
As soon as the purpose of the processing ceases to apply and no statutory retention obligations any longer stand in the way, the relevant data is deleted or restricted in a data-protection-compliant manner. Technically necessary server log files are only kept for a short period required to ensure operational security and are subsequently deleted. Data from enquiries via the contact form is stored in accordance with section 5. Statutory retention periods, for example under the Austrian Business Code (UGB) or the Federal Fiscal Code (BAO), remain unaffected.
11. Your Rights as a Data Subject
As a data subject, you have in particular the following rights under the GDPR:
- Right of access (Art. 15 GDPR): You can request information about whether and which personal data we process about you.
- Right to rectification (Art. 16 GDPR): You can request the correction of incorrect data or the completion of incomplete data.
- Right to erasure (Art. 17 GDPR): You can request the deletion of your data under the statutory preconditions.
- Right to restriction of processing (Art. 18 GDPR): You can, under certain preconditions, request that the processing of your data be restricted.
- Right to data portability (Art. 20 GDPR): You can request to receive the data you have provided in a structured, commonly used and machine-readable format.
- Right to object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to the processing based on Art. 6(1)(f) GDPR.
- Right to withdraw consent (Art. 7(3) GDPR): You can withdraw consent given at any time with effect for the future, without affecting the lawfulness of the processing carried out up to the withdrawal.
To exercise your rights, an informal notification to the data protection contact point named in section 1 (support@reichweitenwerk.at) is sufficient. To safeguard your rights and to prevent abuse, it may be necessary for us to verify your identity in a suitable manner.
12. Right to Lodge a Complaint with the Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of your personal data violates applicable data protection law. The supervisory authority responsible for Austria is:
Österreichische Datenschutzbehörde Barichgasse 40–42 1030 Wien Österreich Web: https://www.dsb.gv.at
13. Necessity of Providing Data
The provision of personal data in the context of the mere visit of our website is limited to the technically necessary data that is mandatorily required for the delivery of the page.
When using the contact form, the information marked as mandatory fields (name and email address) is required in order to be able to process your enquiry and respond to you. The provision of this data is neither legally nor contractually mandatory; however, without this information it is not possible for us to process the enquiry you submitted via the form. All other information is provided voluntarily.
14. No Automated Decision-Making within the Meaning of Art. 22 GDPR
A decision based exclusively on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) does not take place on this website.
15. Up-to-Dateness and Amendment of this Privacy Policy
This privacy policy is currently valid and has the status stated below. Due to the further development of our website and our offers or due to changed statutory or official requirements, it may become necessary to adapt this privacy policy. The respective current version can be accessed at any time on this website.
As of: 03.09.2026