Privacy notice for clients and cooperation partners

For us, Degeler Consulting e.U., Bruno-Marek-Allee 5/10/6, 1020 Vienna, Austria („Degeler Consulting", „we", „us"), the protection of your personal data is a high priority. We comply with the applicable data protection law, in particular the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act (TKG).

This notice tells you how, why and for how long we process personal data of clients and cooperation partners while delivering our services.

Controller

What is personal data?

Personal data is any information relating to an identified or identifiable natural person: name, date of birth, email address, IP address, and so on.

Processing activities

General contact

When you contact us via the addresses above or any other channel, we process your personal data (name, email, phone, postal address, the content of your enquiry plus any documents you attach) for the purpose of handling and answering it. Legal basis: performance of (pre-)contractual obligations under Art. 6(1)(b) GDPR or our legitimate interest under Art. 6(1)(f) GDPR in answering you promptly. Contact data is retained for six months after the last interaction unless a business relationship arises (then statutory retention of 7 years applies under § 132 BAO and § 212 UGB) or legal-claim defence requires longer storage.

Business relationship and contract performance

To enter into and perform our service contracts we process two categories of data subjects: client data and the data of the client’s employees we work with. Specifically:

• Master data of the company and its contacts (legal name, address, contact-person name, email, phone, position).
• Contractual data (contracts, amendments, invoices, order data, payment records).
• Engagement content (documents, processes, strategies, conversations with employees), necessary to deliver the consulting work itself.

Legal basis: Art. 6(1)(b) GDPR (contract performance) for client data, and our and the client’s legitimate interest under Art. 6(1)(f) GDPR for processing employee data of the client. Sensitive data under Art. 9 GDPR is processed only with explicit consent: by default we do not process sensitive data. Storage: for as long as the business relationship exists, plus statutory retention (7 years per § 132 BAO and § 212 UGB) and defence of legal claims.

Recording and AI analysis of conversations

We record some conversations (e.g. with personnel) and run them through AI to extract action items, agendas and improvement strategies. We process the participant’s name, image, voice and conversation content. Recording happens only on your explicit consent under Art. 6(1)(a) GDPR. We inform you about the processing, the legal basis and your rights (including your right of withdrawal under Art. 7(3) GDPR) before recording starts. The recording is shared with all participants afterwards.

Recordings may incidentally contain Art. 9 GDPR sensitive data; this is not the purpose of processing, and any sensitive data is processed only with explicit consent under Art. 9(2)(a) GDPR. The downstream AI analysis serves our legitimate interest under Art. 6(1)(f) GDPR in efficient contract performance. You retain a right to object under Art. 21 GDPR. You will not be subject to a fully automated decision under Art. 22 GDPR: outputs are always reviewed by a human and combined with other data sources.

CRM database

Marketing. We process client master data and contract data to maintain the relationship and inform you about our services. Postal marketing relies on our legitimate interest (Art. 6(1)(f) GDPR); electronic direct marketing (e.g. newsletters) only on your explicit consent under Art. 6(1)(a) GDPR + § 174 TKG. Withdraw any time via privacy [at] degeler [dot] consulting or the unsubscribe link. Data is kept for 3 years after your last contact unless you object earlier.

Networking. We maintain a CRM of professional contacts (name, company, contact details, role, focus area) so we can connect partners with the right people in our network. Legal basis: Art. 6(1)(f) GDPR (legitimate interest); electronic outreach only with consent (Art. 6(1)(a) GDPR). We review the CRM regularly and remove contacts inactive for more than two years.

Event photography. At events and workshops we may take photos of participants for internal documentation and external marketing (e.g. social media). Legal basis: Art. 6(1)(f) GDPR; you can object under Art. 21 GDPR at the event or by emailing privacy [at] degeler [dot] consulting. Close-up shots are taken only with explicit consent.

Storage period

We retain personal data only for as long as necessary for the stated purpose. Data we no longer need is deleted or irreversibly anonymised. We may retain data longer where required to defend legal claims, subject to statutory limitation periods (especially § 1484 ff ABGB).

Recipients

We treat your data confidentially and apply a strict need-to-know principle. Where transfer is necessary, recipients (acting as independent controllers) may include courts, authorities, and external third parties (legal advisors, insurers, auditors). We also use processors (e.g. virtual assistants, IT providers) under Art. 28 GDPR; they are bound by confidentiality and act only on our instructions. Transfers to non-EU countries without an adequacy decision happen case by case under appropriate safeguards (Art. 46 GDPR) or your consent.

Security

Data security is a baseline. We have implemented appropriate technical and organisational measures under Art. 32 GDPR to maintain confidentiality and security of your personal data.

Your rights

You have the right to:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent (Art. 7(3) GDPR), e.g. by email to privacy [at] degeler [dot] consulting,
• object (Art. 21 GDPR), in particular against profiling.

You also have the right to lodge a complaint with the competent supervisory authority. In Austria:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Vienna
Email: dsb@dsb.gv.at

Before filing a formal complaint or if you have any questions, please reach out to us at privacy [at] degeler [dot] consulting first. We’re happy to help.

The complete legally binding version is available in German.