Data Privacy

Last updated: [27.02.2026]

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

FORMA STRATEGIA GMBH
Johannesgasse 16/7
1010 Vienna, Austria

VAT ID: ATU82980213
Company reg.: 672685v, Commercial Court Vienna
Email: contact@formastrategia.com

2. General Information on Data Processing

Data processing on this website is carried out in accordance with the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). Personal data is only processed to the extent necessary for the provision of the website, to ensure its security, or on the basis of explicit consent. Legal bases may include:

– Art. 6(1)(a) GDPR (consent)

– Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures)

– Art. 6(1)(f) GDPR (legitimate interest)

3. Hosting

This website is hosted by:

World4You Internet Services GmbH Wolfgang-Pauli-Str. 2/BT3/2/2.OIG, 4020 Linz, Austria

When you access the website, personal data is processed on the hosting provider’s servers (in particular IP address, time of access, technical metadata). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

4. Cookies

This website uses cookies. Strictly Necessary Cookies Required for the website to function properly. Legal basis: Art. 6(1)(f) GDPR in conjunction with § 165(3) TKG 2021. Analytics and Marketing Cookies Only set with your explicit prior consent. Legal basis: Art. 6(1)(a) GDPR in conjunction with § 165(1) TKG 2021. Details on the services used can be found in the sections below.

5. Consent Management

A consent banner is displayed upon your first visit to the website. Analytics and marketing services are only activated after you have given your active consent. Your consent is documented in accordance with Art. 7 GDPR. Your consent decision is stored in a cookie on your device for 100 days. After expiry, you will be asked for your consent again. You may withdraw your consent at any time with effect for the future. Legal basis for storing the consent decision: Art. 6(1)(c) GDPR (legal obligation to document consent).

6. Google Analytics (GA4)

If you have given your consent, this website uses Google Analytics 4.

Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland

Purpose
Analysis of user behaviour to optimise the website.
Data Processed – IP address – Device and browser information – Usage data (page views, interactions, time on site) – Pseudonymous user identifiers
Legal Basis Art. 6(1)(a) GDPR (consent).

Retention Period
User data is retained for 12 months. Cookie lifetimes are in accordance with Google’s default settings.

Data Processing Agreement
A data processing agreement pursuant to Art. 28 GDPR is in place with Google.

Recipients and Third-Country Transfers
A transfer to Google LLC (USA) cannot be excluded. Google is certified under the EU-US Data Privacy Framework. Standard contractual clauses pursuant to Art. 46(2)(c) GDPR are additionally in place.

Google’s privacy policy: https://policies.google.com/privacy

Withdrawal
Withdrawal is possible at any time via the consent tool.

7. HubSpot

If you have given your consent, services of HubSpot Ireland Limited, Dublin, are used. Purpose – Analysis of user behaviour – Technical optimisation – Management of business contacts in the context of existing or prospective business relationships Data Categories – IP address – Device information – Usage and interaction data – Cookie identifiers Tracking only takes place after consent has been given. Legal Basis Art. 6(1)(a) GDPR (tracking). Art. 6(1)(b) GDPR (CRM processing in the context of business relationships). Data Processing Agreement A data processing agreement pursuant to Art. 28 GDPR is in place with HubSpot. Third-Country Transfer Processing in the USA by HubSpot, Inc. is possible. HubSpot is certified under the EU-US Data Privacy Framework. Standard contractual clauses pursuant to Art. 46(2)(c) GDPR are additionally in place. HubSpot’s privacy policy: https://legal.hubspot.com/privacy-policy Retention Period Tracking data: in accordance with cookie lifetime (max. 180 days). CRM data: for the duration of the business relationship and applicable statutory retention periods. Withdrawal Withdrawal is possible at any time via the consent tool.

8. Links to LinkedIn

This website contains only simple hyperlinks to LinkedIn profiles and the LinkedIn company page. No data is automatically transmitted to LinkedIn when this website is loaded. Data is only transmitted to LinkedIn when you actively click on a link. From that point, LinkedIn’s privacy policy applies: https://www.linkedin.com/legal/privacy-policy LinkedIn may transfer data to the USA. LinkedIn is certified under the EU-US Data Privacy Framework.

9. Third-Country Transfers

The use of Google Analytics and HubSpot may involve the transfer of data to the USA. Legal basis: – Adequacy decision of the European Commission on the EU-US Data Privacy Framework (10 July 2023) – Additionally, standard contractual clauses pursuant to Art. 46 GDPR.

10. Retention Period

Personal data is only retained for as long as necessary for the respective purpose or as required by statutory retention obligations. Once the purpose has been fulfilled or the retention period has expired, data is deleted or anonymised.

11. Data Subject Rights

You have the right to: – Access (Art. 15 GDPR) – Rectification (Art. 16 GDPR) – Erasure (Art. 17 GDPR) – Restriction of processing (Art. 18 GDPR) – Data portability (Art. 20 GDPR) – Object (Art. 21 GDPR) – Withdraw consent (Art. 7(3) GDPR) Where data is processed for direct marketing purposes, you may object at any time (Art. 21(2) GDPR). Contact: contact@formastrategia.com

12. Right to Lodge a Complaint

You have the right to lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna https://www.dsb.gv.at.

13. Data Security

This website uses SSL/TLS encryption. Appropriate technical and organisational measures pursuant to Art. 32 GDPR are in place.

14. Updates

This privacy policy may be updated as necessary. The version published on the website at the time of your visit shall apply.