Privacy Policy

This privacy policy informs you, in accordance with Art. 13 of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), about which personal data we process on hubtimal.com, for what purpose and on what legal basis. We only load services requiring consent after you have actively agreed in the consent banner.

1. Controller

Hubtimal GmbH
Innstraße 10/4a, 6020 Innsbruck, Austria
Commercial register number: FN 683496t
VAT ID: ATU83458125
Email: team@hubtimal.com
Represented by Managing Director: Matthias Max Deimann

We are not obliged to appoint a data protection officer, and have not appointed one. For all questions regarding data protection and to exercise your rights, an informal message to team@hubtimal.com is sufficient.

2. Overview of Data Processing

We only process personal data to the extent necessary and only on a valid legal basis in accordance with Art. 6 GDPR.

Recipients. Only the service providers named in this policy will receive your data. Some of them work as processors in accordance with Art. 28 GDPR exclusively according to our instructions. Some advertising and platform providers (Sections 10 and 11) process data partly under their own responsibility or jointly with us. Beyond this, we only pass on data to the extent necessary for our accounting and tax advice or if we are legally obliged to do so, for example to authorities or courts.

Obligation to provide data. You are under no legal or contractual obligation to provide us with personal data. However, without the information marked as a mandatory field, we cannot process an enquiry or appointment booking. You can use the website in full without giving your consent.

Automated decisions and profiling. Automated decision-making with a legal or similarly significant effect in accordance with Art. 22 GDPR does not take place. If you have consented, we evaluate your user behaviour on the website in HubSpot and assign it to your contact as soon as you are known to us via a form or booking. This allows us to better assess and prepare enquiries. This is profiling within the meaning of Art. 4 No. 4 GDPR.

3. Hosting and Provision of the Website: Framer

The website is hosted and delivered via Framer (Framer B.V., Netherlands). Your browser loads images, fonts and other content from Framer's Content Delivery Network (framerusercontent.com).

When you access the website, Framer processes technically necessary server log files, in particular your IP address, date and time of access, page accessed, referrer URL, browser type and operating system. This data is required for secure and stable operation.

The legal basis is our legitimate interest in the secure, stable and fast provision of the website (Art. 6 para. 1 lit. f GDPR). We have a data processing agreement with Framer in accordance with Art. 28 GDPR. Framer uses sub-processors, including providers based in the USA. Transfers to the USA are then safeguarded in accordance with Section 12.

Framer Analytics. For simple audience measurement, we use Framer's statistics function. It operates without cookies and only provides us with aggregated statistics, for example on page views and the origin of visitors. The legal basis is our legitimate interest in analysing and improving our website (Art. 6 para. 1 lit. f GDPR).

Fonts. Your browser loads some fonts (Google Fonts) directly from servers of Google Ireland Limited (fonts.gstatic.com). Your IP address is transmitted to Google. The legal basis is our legitimate interest in a uniform presentation of the website (Art. 6 para. 1 lit. f GDPR). Transfers to the USA are safeguarded in accordance with Section 12.

4. Consent Management

We use Cookie-Script (cookie-script.com) to manage your consents. The tool stores your decision, a random consent ID, date and time, the version of the banner and technical information about your browser. This allows us to prove that consent has been given and to respect your choice on subsequent visits.

The legal basis is our legal obligation to prove consent (Art. 6 para. 1 lit. c GDPR in conjunction with Art. 7 para. 1 GDPR). Storing your selection on your terminal device is strictly necessary within the meaning of Section 165 para. 3 of the Telecommunications Act 2021 (TKG 2021). There is a data processing agreement with the provider. We store your selection for 30 days, after which we will ask again.

In the banner, you can reject all services at the first level with one click. You can withdraw your consent at any time with effect for the future via the "Cookie Settings" link at the bottom of each page.

For all services requiring consent in Sections 5, 9 and 10, the legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR and Section 165 para. 3 TKG 2021 for storing and retrieving information on your terminal device.

5. Google Tag Manager (only with consent)

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager is a tool with which we integrate the services mentioned in Sections 9 and 10 and fire them depending on your consent. It does not set cookies itself. However, when the Tag Manager is loaded, your IP address is transmitted to Google. Therefore, we only load the Tag Manager after you have agreed to at least one category. Transfers to the USA are safeguarded in accordance with Section 12.

6. Contact by Email

If you write to us by email, we process your email address, your name and the content of your message in order to process your request. The legal basis is the performance of pre-contractual measures or the fulfilment of a contract (Art. 6 para. 1 lit. b GDPR), or, for other enquiries, our legitimate interest in responding (Art. 6 para. 1 lit. f GDPR).

Our emails are routed through Google Workspace of Google Ireland Limited. We have a data processing agreement with Google in accordance with Art. 28 GDPR. Transfers to the USA are safeguarded in accordance with Section 12.

7. Contact Form, Appointment Booking and CRM: HubSpot

Our contact forms and the booking of a free consultation are run via HubSpot of HubSpot Ireland Limited, One Sir John Rogerson’s Quay, Dublin 2, Ireland.

The information you enter is processed, such as name, email address, company, telephone number, message and requested appointment. We store this in our CRM to process your enquiry, prepare the appointment and manage any resulting business relationship. After booking an appointment, you will receive a calendar invitation with the link to the online meeting.

The legal basis is the performance of pre-contractual measures or the fulfilment of a contract (Art. 6 para. 1 lit. b GDPR) as well as our legitimate interest in efficient customer communication (Art. 6 para. 1 lit. f GDPR).

The data is processed in a HubSpot data centre within the EU. We have a data processing agreement with HubSpot in accordance with Art. 28 GDPR. If, in individual cases, a transfer to the USA occurs, for example through support or the parent company, it is safeguarded in accordance with Section 12.

The forms also work without consent. We only set HubSpot tracking cookies if you have agreed (Section 9).

To protect against spam, the contact form uses the reCAPTCHA service of Google Ireland Limited. When the form is loaded, reCAPTCHA checks whether the input comes from a human and, to do so, processes your IP address and information about your browser, among other things. The legal basis is our legitimate interest in protection against abusive enquiries (Art. 6 para. 1 lit. f GDPR). Transfers to the USA are safeguarded in accordance with Section 12.

8. Online Meetings

We conduct consultation sessions by video conference via Google Meet (Google Ireland Limited). This involves processing the data necessary to conduct the meeting, such as name, email address, video and audio, as well as technical connection data. The legal basis is Art. 6 para. 1 lit. b GDPR. We have a data processing agreement with Google.

9. Audience Measurement and Website Analytics (only with consent)

HubSpot Analytics (HubSpot Ireland Limited): Analysis of which pages are accessed and how visitors reach the website. As soon as you are known to us via a form or booking, we assign this data to your contact in the CRM (see profiling in Section 2).

Google Analytics 4 (Google Ireland Limited): Pseudonymous audience and behaviour analysis using cookies. Google Analytics 4 does not store complete IP addresses.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR and Section 165 para. 3 TKG 2021). Transfers to the USA are safeguarded in accordance with Section 12.

10. Advertising and Retargeting (only with consent)

In order to measure the success of our campaigns and build advertising audiences, we use the following services with your consent. They set cookies or comparable technologies and transmit data to the respective provider.

Google Ads Conversion Tracking and Remarketing (Google Ireland Limited).

Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). We are joint controllers with Meta for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR). The details are regulated by the joint controllership agreement, which can be accessed at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for further processing after transmission. You can assert your rights against us and against Meta.

LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland).

Microsoft Advertising / UET Tag (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR and Section 165 para. 3 TKG 2021). These services may involve a transfer of data to the USA, safeguarded in accordance with Section 12. You can withdraw your consent at any time via "Cookie Settings" at the bottom of each page.

11. Our Company Page on LinkedIn

We operate a company page on LinkedIn (linkedin.com/company/hubtimal). For the page statistics ("Page Insights") that LinkedIn generates about the use of our page, we are joint controllers with LinkedIn Ireland Unlimited Company (Art. 26 GDPR). The details are regulated by LinkedIn's Page Insights Joint Controller Addendum. We only receive anonymised statistics. The legal basis is our legitimate interest in presenting our company and communicating with interested parties (Art. 6 para. 1 lit. f GDPR). LinkedIn is solely responsible for all other processing on LinkedIn. You can find details in LinkedIn's privacy policy.

The link to LinkedIn in our footer is a simple link. Data is only transferred when you click on it.

12. Transfers to Third Countries

Some of the named providers or their sub-processors are based in the USA. We base transfers to the USA on the EU Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, provided the recipient is certified there. Additionally or alternatively, the Commission's EU Standard Contractual Clauses (2021 version) apply.

13. Storage Period

We only store personal data for as long as is necessary for the respective purpose or as long as there are legal retention obligations.

• Proof of consent: 30 days

• Enquiries without a subsequent order: 24 months after the last contact, then deleted

• Data from business relationships (offers, contracts, invoices, business correspondence): for the duration of the business relationship and then 7 years according to Section 132 BAO and Section 212 UGB, longer in the case of ongoing proceedings

• Analytics and advertising cookies: according to the cookie lifetime of the respective service (details in the consent banner) or until your withdrawal

14. Data Security

The website is TLS-encrypted throughout. You can recognise this by the padlock symbol in your browser's address bar. In addition, we apply appropriate technical and organisational measures in accordance with Art. 32 GDPR.

15. Your Rights

You have the right at any time to

• Access (Art. 15 GDPR),

• Rectification (Art. 16 GDPR),

• Erasure (Art. 17 GDPR),

• Restriction of processing (Art. 18 GDPR),

• Data portability (Art. 20 GDPR),

• Objection (Art. 21 GDPR, see Section 16),

• Withdrawal of consent granted with effect for the future (Art. 7 para. 3 GDPR).

An informal message to team@hubtimal.com is sufficient. We will reply within one month.

You also have the right to lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.