Privacy notice
Controller
Praetur e.U. (Shift & Sustain Capital Partners), Maxingstraße 38/9, 1130 Vienna, Austria · dk@praetur.com
«Data protection officer: on current assessment not required — to be confirmed by counsel.»
1 · Processing when visiting the website
- Data
- IP address (truncated), date and time, page requested, browser type, operating system, referring page
- Purpose
- Provision and security of the website
- Legal basis
- Art. 6(1)(f) GDPR — legitimate interest in secure operation
- Retention
- «server logs: add number of days, usually 7–30»
- Processor
- Cloudflare (hosting/delivery) — data processing agreement «to be verified and filed»
2 · Contact and registration forms
- Data
- Name, company, email, telephone, role, message, subject
- Purpose
- Handling your enquiry and any initiation of a business relationship
- Legal basis
- Art. 6(1)(b) GDPR (pre-contractual measures) and (a) (consent)
- Retention
- until completion, thereafter «period» for traceability; then deletion
- Recipients
- HubSpot (form processing and contact management, EU data centre) · Cloudflare (hosting) — data processing agreements «to be verified and filed»
Once the HubSpot forms go live, HubSpot must be added here as a recipient and processor — with its seat, data centre region and data processing agreement.
3 · Restricted investor area
- Data
- Name, company, role, email, telephone, language, investor qualification details, time and version of the confidentiality undertaking accepted, IP address and browser identifier at acceptance, sign-in times, log of all document accesses (time, document, action, IP address)
- Purpose
- Operation of the restricted area, evidence of the confidentiality undertaking, evidence of the proper and non-public provision of information, prevention of misuse
- Legal basis
- Art. 6(1)(b) GDPR (performance of the usage agreement) and (f) GDPR (legitimate interest in evidence and confidentiality); where a legal obligation exists, additionally (c)
- Retention
- access credentials for the duration of access; access logs «add period — proposal: 7 years by analogy with retention obligations, to be confirmed by counsel»
- Recipients
- «Supabase — data processing, region expressly EU», «Vercel — hosting», «Resend — email delivery»
The access log is a processing of personal data and is expressly named here. The portal additionally displays a visible notice. Covert logging would be a problem.
4 · Traffic measurement
We use «Plausible / Umami», a cookie-free traffic measurement without personal reference and without cross-device recognition. No data is transmitted to advertising networks. Legal basis: Art. 6(1)(f) GDPR. Server location: «EU».
5 · Cookies
Only strictly necessary cookies are set:
| Cookie | Purpose | Duration |
|---|---|---|
| SS_LOCALE | Stores the language choice | 1 year |
| sb-* | Sign-in to the restricted area | Session / 12 hours |
No consent is required for strictly necessary cookies. No marketing or analytics cookies are set.
6 · Transfers to third countries
«To be checked and completed: all services used are to be configured so that processing takes place in the EU. For Supabase the region must be set to EU when the project is created — this cannot be changed afterwards. For Resend and Vercel it must be checked whether and where a transfer takes place, and whether standard contractual clauses are in place.»
7 · Your rights
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent with effect for the future.
Write informally to dk@praetur.com.
Right to complain: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at
This English version is provided for convenience. In case of discrepancy, the German version prevails.