Privacy policy

This is a convenience translation. Only the German version is legally binding.

1. Controller

Elke Mayr, Projekt SiteBoost (in formation), Pohlgasse 38/15, 1120 Vienna, Austria. Email: kontakt@siteboost.at, phone: +43 699 1121 1959. Further details in the Impressum.

2. Sign-up and contact forms

Data: name, email address, company, role or function, whether you are a construction company or a technology provider, optionally phone number and your message, the time of sign-up and the page you came from (for example a QR code).

Purpose and legal basis: we answer your enquiry and invite you to the pilot phase. The legal basis is the preparation of a collaboration (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Optional checkbox: if you tick it, we inform you by email about news on SiteBoost or about the pilot phase. The legal basis is your consent (Art. 6(1)(a) GDPR, for promotional emails also § 174 TKG 2021). You can withdraw it at any time by email.

3. Company profile for providers

Registration: company name, optionally website, first and last name and email address of the contact person, optionally role or function, and the time at which the terms of use for providers were accepted. Company name, name and email address are mandatory; without them no profile can be created.

In the profile: company details (description, headquarters, parent company, logo), further details of the contact person (phone, role, location) and the product entries with texts, assignments, images, documents, references and notes to SiteBoost.

Purpose and legal basis: we provide the profile, review the entries, publish them and get in touch with questions. The legal basis is the user agreement under the terms of use (Art. 6(1)(b) GDPR).

What becomes public: after our review, the product entries as well as the company name, logo, website and description of the company. The contact person and their contact details are not published.

People shown in images: if images show people, the provider confirms on submission that they have consented.

Access and emails: access to the profile works through a personal link without a password. After the registration is sent, we email it to the address entered; until then the details exist only encrypted in this link, and only the click on it creates the profile and stores them. On request, we send the link again to the email address of the registered contact person; for this, we check whether the address entered belongs to a profile. The SiteBoost team receives an internal notification of each confirmed registration.

4. Website operation and server logs

When the website is accessed, our hosting provider automatically processes IP address, date and time, the page accessed, browser and operating system. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). This data is stored only as long as necessary for this purpose and then deleted.

5. Cookies and storage on your device

We do not set cookies for advertising or tracking purposes and do not store anything on your device for analytics. These are the only cookies:

• Profile access(sb_portal): only if you choose “Stay signed in on this device”. Contains the access to your company profile, valid for 180 days. Unticking it in the profile or deleting it in the browser removes it. The legal basis is your explicit choice (§ 165(3) TKG 2021).
• Admin sign-in: only for the SiteBoost team, technically necessary.

6. Audience measurement

We use our hosting provider's analytics tool, without cookies and without storage on your device. It records the page accessed, the referring page, country and region, browser, operating system, device type and time, as well as anonymous events such as clicks on “Add product”, steps of the registration and of the product entry, and saving an entry. Names, email addresses, form contents and personal links are not transmitted; addresses of company profiles are shortened before sending.

Visits are recognised by a value formed from the request and discarded after 24 hours; the IP address is not stored and no user profiles are created. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). Reports are available for up to twelve months.

7. Who receives the data

We do not sell data and do not pass it on for advertising purposes. For operation we use service providers that process data on our behalf (processors under Art. 28 GDPR):

• Website hosting and audience measurement: service provider based in the USA
• Database and files (form entries, profiles, product entries, images, documents): service provider based in the USA; stored on servers in Frankfurt am Main, Germany
• Sending the emails about the company profile: service provider based in the USA
• Mailbox kontakt@siteboost.at: service provider based in Austria

Data processing agreements are in place with all service providers. Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or the EU standard contractual clauses; we provide a copy of the safeguards on request. We will name the specific service providers on request to kontakt@siteboost.at. Published product and company information is visible to all visitors of the website.

8. How long we store data

• Form data: until your enquiry is dealt with or until withdrawal, at most twelve months after the end of the pilot phase.
• Company profiles: as long as the profile exists; we delete it at any time on request. Profiles in which no product has been submitted twelve months after the last change are deleted.
• Audience measurement: aggregated reports, available for up to twelve months.
• Server logs: only as long as necessary for secure operation.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time; the lawfulness of processing carried out until then remains unaffected. An informal email to kontakt@siteboost.at is enough, including to have a company profile deleted.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to processing for direct marketing at any time without giving reasons.

If you believe that the processing of your data breaches data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

10. No automated decisions

We do not make decisions based solely on automated processing and do not carry out profiling. The SiteBoost team reviews entries itself.

11. Changes

We adapt this policy when the website or the services used change, at the latest when the platform launches. Version: October 2026.