Privacy policy

1. Controller

The controller within the meaning of the GDPR (DSGVO) is:

BxM Consulting FlexCo
Reinprechtsdorfer Straße 49/23, 1050 Vienna, Austria
FN 680912t (Commercial Court of Vienna)
Email: office@bxm-consulting.com

2. What data we process

Through the website itself, we collect personal data only where you give it to us yourself, for example through the contact form (see section 3). There are no user accounts, no cookies, no audience measurement and no tracking services. The only other processing happens for technical reasons through hosting (see section 5).

3. Contact form

If you use the contact form, we process your name, email address, company and message in order to answer your request.

The legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in handling requests).

The data is passed to BxM Faktura, our own application for managing requests, customers, quotes and invoices. BxM Faktura runs at Vercel Inc. in the Frankfurt (EU) region, and its database at Supabase Inc. in the Frankfurt (EU) region. Vercel and Supabase process the data as processors under Art. 28 GDPR; we have a data processing agreement with both.

For the confirmation email, your name, email address, company and message are passed on after submission to our n8n instance at n8n.bxm-consulting.at. We operate this instance ourselves at Amazon Web Services (AWS) in the Frankfurt (EU) region. It is not n8n's cloud service. The legal basis is the same as for the request itself (Art. 6(1)(b) or (f) GDPR).

We store requests for the duration of processing and for six months beyond that if no business relationship results. If a contractual relationship is formed, the statutory retention periods apply.

4. Booking an appointment

To book an initial call, we link to a scheduling page of Google (Google Ireland Limited). When you open that page, data is transmitted to Google; Google's privacy policy applies. From there we receive your name, email address and the chosen appointment.

5. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you open the site, technical connection data (in particular the IP address) is processed temporarily to deliver the page and is not stored by us permanently. Vercel is certified under the EU-US Data Privacy Framework.

6. Transfers to third countries

Vercel processes some data in the USA. The transfer is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). Vercel, Supabase and Google may also process data outside the EU; in these cases the transfer is based on EU standard contractual clauses or the EU-US Data Privacy Framework.

7. Your rights

You have the right at any time to: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), object (Art. 21 GDPR), and to withdraw any consent you have given with effect for the future. Contact us at office@bxm-consulting.com. You also have the right to lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna
dsb@dsb.gv.at

8. Cookies and tracking

This website uses no cookies and no cross-site tracking. No marketing pixels and no third-party scripts for profiling are used. How we measure audience is described in section 9.

9. Audience measurement

To see how often the pages of this website are viewed, we use Vercel Web Analytics. No cookies are set, no data is stored on your device, and there is no tracking across other websites. Visitors are counted through a hash value derived from request data, which changes every day. This creates no profiles of individual people.

The data processed is the page viewed, the referring page (referrer), the country, and the browser, operating system and device type.

The provider is Vercel Inc., which processes the data for us as a processor. Its address and the transfer to third countries are described in sections 5 and 6. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in audience measurement).