Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and other data protection provisions is:

2. General information on data processing

We process your data solely on the basis of the statutory provisions, in particular the GDPR, the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG 2021).

This website is aimed at business customers (B2B). We do not operate an online shop and do not offer any products or services for purchase directly via the website.

3. Hosting & server log files

This website is operated on our own infrastructure. Every page request passes through the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), which delivers the pages to your browser. In doing so, Cloudflare acts as our processor pursuant to Art. 28 GDPR and processes technical connection data, in particular your IP address. This also includes error reports that your browser sends to Cloudflare if a network error occurs while the website is loading.

When you access the website, your browser automatically transmits certain data for technical reasons. The following are recorded in our server log files: IP address (anonymised where possible), date and time of the request, browser type and browser version, operating system used and referrer URL.

We process this data in order to operate the website and ensure its security. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure and stable operation of the website.

The recipient of this data is Cloudflare, as our processor. Processing in third countries, in particular the USA, cannot be ruled out in this context. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, standard contractual clauses pursuant to Art. 46 GDPR apply. The data is not passed on to any other third parties.

The server log files are deleted automatically after 14 days.

4. Contact form

If you submit our contact form, we transmit your details in encrypted form to an interface operated by us and store them as an enquiry in our ticketing system. The following are transmitted:

• name, email address and organisation
• if provided: type of organisation, your role and your website
• your message
• if selected: the topics from the topic catalogue, and the parts and languages of an exercise that you chose on the home page
• if selected: whether you would like to take part in a pilot project for Prometheus Connect or be notified when it launches
• the language in which you use the website

You receive a confirmation only once the transmission has actually succeeded.

The interface also runs via Cloudflare, Inc. (see section 3) as a processor pursuant to Art. 28 GDPR; in doing so, Cloudflare processes technical connection data, in particular your IP address. To manage enquiries, we use the Jira ticketing system of Atlassian Pty Ltd (Level 6, 341 George Street, Sydney NSW 2000, Australia) or, as applicable, Atlassian, Inc. (USA), which likewise act as processors. Processing in third countries, in particular the USA, cannot be ruled out in this context. Both providers are certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, standard contractual clauses pursuant to Art. 46 GDPR apply. The data is not passed on to any other third parties.

To protect the form against automated abuse, we use the Cloudflare Turnstile service. Turnstile is only loaded when you open the page containing the contact form. Your browser then connects to Cloudflare, and technical data about the connection and the device is processed, in particular the IP address. Turnstile does not set cookies and does not create cross-site usage profiles. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in protection against abusive requests) in conjunction with § 165 para. 3 TKG 2021.

If you contact us directly by email instead, we receive and process your message via our email provider Proton AG (Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland) as a processor pursuant to Art. 28 GDPR. An adequacy decision of the European Commission exists for Switzerland (Art. 45 GDPR).

We use your details solely to process your enquiry and for any follow-up questions, including the preparation and transmission of contractual documents. The legal basis is Art. 6 para. 1 lit. b GDPR (pre-contractual measures) or Art. 6 para. 1 lit. f GDPR (legitimate interest in processing business enquiries). We delete your enquiry data once your request has been dealt with, including from our ticketing system, unless statutory retention obligations prevent this.

5. Customers and licensees

For our customers and licensees, we process, as controller, the data of their contact persons (name, position and business contact details) and the logs of downloads of licensed sets. We use this data to conclude and perform the contract. The legal basis is Art. 6 para. 1 lit. b GDPR.

We store this data for as long as we need it for the contract and, beyond that, to the extent required by statutory retention obligations.

6. Cookies & local storage

This website does not use cookies. Instead, we use your browser’s localStorage to store a small number of technically necessary settings between your visits. localStorage is a storage area in which data is kept only locally, in your browser. The data is never transmitted to our servers and cannot be read by third parties.

The following values are stored locally in your browser:

• prometheus-lang: your chosen interface language.
• prometheus-theme: your theme setting.
• prometheus-text-size: your text size setting.
• prometheus-colorblind: whether the colour-blind-friendly mode is enabled.
• pde.interest.selection.v1: the topics you selected in the topic catalogue (topic identifiers only, no personal data). Cleared automatically after an enquiry has been submitted successfully.
• pde.interest.parts.v1: the parts and languages of an exercise that you selected on the home page (identifiers only, no personal data). Cleared automatically after an enquiry has been submitted successfully.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in a functioning website) in conjunction with § 165 para. 3 TKG 2021, under which storing information in the user’s terminal equipment is permitted without consent where this is strictly necessary for the proper operation of the website.

You can delete these values at any time in your browser’s settings for site data or storage. On your next visit, the language, theme, text size, topic selection and the selection of exercise parts and languages will be reset to their default values.

7. Web analytics

We currently do not use any web analytics tools. Should this change, we will update this privacy policy and obtain your consent where necessary.

8. Your rights

Under the GDPR, you have the following rights: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR) and the right to object to processing based on Art. 6 para. 1 lit. f GDPR (Art. 21 GDPR).

To exercise your rights, please contact: [email protected]

9. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data infringes the GDPR: