Privacy Policy on the Use of our Website

1) General information

In this Privacy Policy, we inform you about the processing of personal data in the context of the use of our website. We process personal data exclusively on the basis of the applicable legal provisions (GDPR¹, DSGG² , TKG 2003³).

2) Name and contact details of the persons responsible and of the data protection officer

Responsible for the processing of personal data is:

has·to·be gmbh
FN 399512 v (Landesgericht Salzburg)
Salzburger Straße 26
A-5550 Radstadt
E-mail: datenschutz@has-to-be.com

If you have any questions about the processing of personal data in connection with the use of our website or about exercising your rights under GDPR, you can contact either us directly or our data protection officer, Dr. Katharina Vera Boesche, lawyer, c/o has·to·be gmbh, datenschutz@has-to-be.com.

3) No obligation to provide personal data

There is no obligation for you to actually provide the personal information we ask you to provide on our website. If you do not provide us with your personal data, you can still use the website, but we may not be able to offer you all our products and services and your user experience on the website may be limited.

4) Categories of personal data processed

(1) Accessing the website

When you access our website in your browser, the following personal data is processed by us:

• IP address,
• date and time of accessing our website or individual pages on the website,
• Internet Service Provider (ISP),
• operating system,
• name and version of the browser,
• website from which you accessed our website (“referrer URL"),
• clickstream data.

(2) Contact via forms, email, or telephone

If you contact us via contact forms provided for this purpose on our website, by email, or telephone, the personal data provided by you, such as name, address, email address, telephone number, etc., will be processed by us.

(3) Registration for newsletters or webinars or downloads

If you subscribe to one of our newsletters or register for one of our webinars via the registration forms provided for this purpose on our website, the personal data provided by you, such as name, email address, name of your organisation, etc., will be processed by us.
You can unsubscribe from receiving a newsletter or participating in a webinar at any time. You will find detailed information on this in the footer of each newsletter or in the respective registration confirmation.

(4) Use of cookies

General

Our website uses so-called cookies. These are small text files that are transmitted from our website to your browser and stored on your end device until you delete them. Cookies may contain personal data. Some cookies are technically necessary to ensure the functionality of the website. Others help us to make the website user-friendly and to determine the effectiveness of our online advertising.
If you would like to change your cookie settings for our website, you can do so right here:

Cookie preferences

Alternatively, you can change the general cookie settings via your browser settings.

Technically necessary cookies

Technically necessary cookies are required for the functioning of the website.

Borlabs Cookie Box

We use the services of Borlabs to manage your cookie preferences. Your cookie preference settings selected in the Borlabs cookie box are stored directly in your browser.

Google Tag Manager

This cookie from Google is used to manage some of the third-party tags on our website (Google Analytics, Bing Ads, LinkedIn Insight, Hotjar, Youtube and Facebook Pixel). If you do not give your consent to tracking by the respective provider / tags, they will not be managed by the Google Tag Manager.

Statistic cookies

Statistics cookies collect information anonymously. This information helps us understand how users use our website.

Google Analytics

If you have given your consent, we use functions of the web analysis service of Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (“Google"). Cookies are used to enable an analysis of your use of the website. The personal data generated by this (see below) is transmitted to Google and processed by Google on our behalf. If you do not allow these cookies, you can continue to use the website without restriction, but we will not be able to analyse your user behaviour on the website and thus not be able to better adapt the website to your needs in the future.
We use the Google Analytics feature Google Signals. With the help of this function, additional information is collected from users, who are logged into their browser with a Google account and have activated personalised advertising and linked to the respective Google account in order to be able to display advertising to users across devices.
We use the Google Analytics anonymizeIP function. With the help of this function, your IP address is shortened and thus anonymised on servers within member states of the European Union or of states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
Specifically, the following personal data is processed within the scope of Google Analytics:

• anonymised IP address,
• Internet Service Provider,
• referrer URL,
• user behaviour, e.g. clicks, pages viewed, length of stay, newsletter or webinar registrations, etc.,
• browser and device data such as language setting, screen resolution, etc.,
• date and time,
• location,
• search history,
• YouTube history,
• Google partner website data..

You can adjust your settings for advertising on Google here: https://adssettings.google.com/authenticated

Hotjar

If you have given your consent, we use software provided by Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St. Julian’s STJ 3141, Malta (“Hotjar") to visualise how you interact with our website. We collect information about your interactions with the website (e.g. where you click, scroll or move between pages) and use this data to create visual representations of the user experience. We obtain these insights without tracking IP or MAC addresses.
Some Hotjar tools, such as Session Records, reconstruct the individual actions you took during a website visit; others, such as Heatmaps, aggregate data points from you and hundreds of other users into one report.
In all cases, sensitive data that you may enter on the website (e.g. telephone numbers) is anonymised by default.
Specifically, the following personal data of individual, randomly selected users is processed:

• visited domain,
• screen size,
• date and time of website use,
• anonymised IP address,
• device type and browser used,
• location (country).

Marketing cookies

Marketing cookies store information about the websites visited by users. This data is used to display personalised advertisements tailored to the user’s interests.

LinkedIn Insight Tag

If you have given your consent, we use functions of the social media network LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA (“LinkedIn"). These cookies collect data on the users of our website.
Specifically, the following personal data is transmitted to LinkedIn in encrypted form and stored and evaluated by LinkedIn:

• URL of our website,
• referrer URL,
• IP address,
• browser and device data including cookies,
• page views,
• date and time.

If you have a LinkedIn account and are logged in, this data will be assigned to your personal LinkedIn account and the data stored in it. For more information on what information LinkedIn collects and what it is used for, please click on the following link: https://www.linkedin.com/legal/privacy-policy.

Facebook Pixel, Facebook Custom Audiences and Facebook Conversion

If you have given your consent, we use the “Facebook Pixel" function of the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or – if you are a resident of the EU – by the company Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook").
With the help of Facebook Pixel, it is possible for Facebook to identify you – as a user of our website – as a target person for the display of advertisements (so-called “Facebook Ads"). Accordingly, we use Facebook Pixel to display the Facebook Ads placed by us only to those Facebook users who have also shown an interest in our online offer or who have certain characteristics (e.g. interests in certain topics or products determined on the basis of the websites visited) that we transmit to Facebook (so-called “Custom Audiences"). With the help of Facebook Pixel, we also want to ensure that our Facebook Ads correspond to the potential interest of the users and do not have a harassing effect. Furthermore, with the help of Facebook Pixel, we can track the effectiveness of Facebook Ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook Ad (so-called “conversion").
You can object to the collection by Facebook Pixel and the use of your data to display Facebook Ads. To set which types of advertisements are displayed to you within Facebook, you can visit the page set up by Facebook https://www.facebook.com/settings?tab=ads and follow the instructions on the settings for usage-based advertising. The settings are platform independent, i.e. they are applied to all devices, such as desktop computers or mobile devices. You can also opt out of the use of cookies for reach measurement and advertising purposes via the Network Advertising Initiative opt-out page and additionally via the US website aboutads.info or the European website youronlinechoices.com.

bing ads

If you have given your consent, we use the remarketing function “bing ads" of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft"). Through this function, Microsoft stores a cookie on your computer if you have accessed our website via a bing ad. In this way, Microsoft and we can recognise that someone has clicked on an advertisement, been redirected to our website and reached a previously determined target page (so-called “conversion page"). We only learn the total number of users who clicked on a bing ad and were then redirected to the conversion page. No personal data of the user is collected.
If you do not want information about your behaviour – as explained above – to be used by Microsoft, you can refuse the setting of a cookie required for this – for example, by means of a browser setting that generally deactivates the automatic setting of cookies. You can also prevent the collection of data generated by the cookie and related to your use of the website, as well as the processing of this data by Microsoft, by declaring your objection via the link https://choice.microsoft.com/de-DE/opt-out. Deactivating interest-based ads is also possible at https://about.ads.microsoft.com/en-us/resources/policies/personalized-ads.

Twitter Ads

If you have given your consent, we use the “Twitter Advertising" function of Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (“Twitter"). This allows us to show you advertising content on Twitter that may be of interest to you, based on your behaviour on our website.

We use the Twitter service “Tailored Audiences". This allows us to show personalised advertising content to people who use our website while they are logged into Twitter. You can also deactivate the display of such advertising content. To do so, select the appropriate setting at http://www.twitter.com/personalization.

The following personal data is processed:

• browser cookie IDs,
• terminal IDs,
• hashed email addresses,
• demographic data,
• information and content viewed,
• actions taken.

You can also prevent the collection of the data generated by the cookie and related to your use of the website, as well as the processing of this data by Twitter, by using the link https://optout.aboutads.info/ to opt out of interest-based advertising. Please note that this setting will also be deleted when you delete your cookies.

Google Ads

If you have given your consent, we use the “Google Ads" function of Google. Google Ads enables us to draw attention to our online offer with the help of advertising media on external websites. This enables us to determine how successful individual advertising measures are. These advertisements are delivered by Google via so-called “AdServers". For this purpose, we use cookies (so-called “AdServer cookies"), through which certain parameters for measuring success, such as the display of the ads or clicks by users, are stored. If you access our website via an ad by Google, Google Ads will store cookies on your end device. These cookies usually lose their validity after 30 days. They are not intended to identify you personally. The following information is usually stored in these cookies:

• unique Cookie ID,
• number of ad impressions per placement (frequency),
• last impression (relevant for Post View Conversions),
• opt-out information (marking that the user no longer wishes to be addressed).

These cookies enable Google to recognise your browser. If a user visits certain pages of an Ads customer’s website and the cookie stored on his device has not yet expired, Google and the Ads customer can recognise that the user clicked on the ad and was redirected to this page. A different cookie is assigned to each Ads customer. Cookies can therefore not be tracked across Ads customers’ websites. We ourselves do not collect or process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Google. These evaluations enable us to recognise which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising tools; in particular, we cannot identify users on the basis of this information. Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. If you have a user account at Google and are registered, Google can assign the visit to your user account. Even if you are not registered at Google or have not logged in, it is still possible for Google to obtain and store your IP address.
You can prevent cookies from being stored by setting your browser to block cookies from the domain “www.googleadservices.com" (https://www.google.de/settings/ads). We would like to point out that this setting is deleted when you delete your cookies. In addition, you can deactivate interest-based ads via the link https://optout.aboutads.info/. Please note that this setting will also be deleted when you delete your cookies.

Hubspot

If you have given your consent, we use features provided by HubSpot, Inc, 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, with a branch at 1 Sir John Rogerson’s Quay, Dublin 2, Ireland (“HubSpot”).
The service provided by HubSpot is an integrated software solution that allows us to manage customer data and cover various aspects of our online marketing. This includes, among other things, the analysis of landing pages and reporting. Cookies are stored on the device you use.
The following personal data may be collected, for example:

• IP address,
• geographical location,
• type of browser,
• length of visit,
• pages viewed.

The information collected and the content of our website is stored on HubSpot servers in Ireland. We use HubSpot to analyse the use of our website. This allows us to constantly optimise our website and make it more user-friendly. We also use the information to determine which of our company’s services are of interest to customers and newsletter subscribers and to contact them for advertising purposes. In addition, we use the analysis to optimise our website for you.
However, we only use your IP address in a shortened version. This means that the IP address of the user is shortened by HubSpot – within member states of the European Union or contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a HubSpot server in the USA and shortened there.

External media

We include functional and content elements on our website that are obtained from the servers of their respective providers. These can be, for example, graphics, videos or maps.

Google Maps

On our website, we use the “Google Maps" service of Google. By integrating the service on our site, the following data is transferred to Google:

• IP address,
• time of the website visit,
• screen resolution of the user,
• referrer URL,
• the identifier of the browser (user agent),
• search terms.

The data transfer takes place regardless of whether you have a user account with Google via which you are logged in or whether you do not have a user account. If you are logged in, this data is directly assigned to your account. Google stores this data as a usage profile and uses it for the purposes of advertising, market research and/or designing its website to meet your needs. You have the right to object to the creation of these user profiles, but you must contact Google to exercise this right.
Further information on the purpose and scope of data collection and processing by Google can be found at http://www.google.at/intl/de/policies/privacy/. By using the Google Maps service, you consent to the processing of data by Google. We do not process the data concerned.

Vimeo

We may have embedded videos from Vimeo, Inc., 555 West 18th Street, New York, New York 10011, USA (“Vimeo") on our website.
When you call up a page with videos from Vimeo, a connection to the Vimeo servers is established. This leads to transmission of information to the Vimeo server which website you have visited. If you are logged in as a Vimeo member, Vimeo assigns this information to your personal user account. When you click on the start button of a video, this information can also be assigned to an existing user account. You can prevent this assignment by logging out of your Vimeo user account before using our website and deleting the corresponding cookies from Vimeo.
Further information on data processing and notes on data protection by Vimeo can be found at https://vimeo.com/privacy.
In addition, Vimeo calls up the Google Analytics tracker via an iFrame in which the video is called up. This is Vimeo’s own tracking, to which we have no access. You can prevent tracking by Google Analytics by using the deactivation tools that Google offers for some browsers. Users can also prevent the collection of data generated by Google Analytics and related to their use of the website (incl. IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

YouTube

On our website, we may use components of YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA (“YouTube"). YouTube is an affiliate of Google.
Each time you call up individual pages of our website on which a YouTube component (YouTube video) has been integrated, your browser is automatically caused by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. Within the scope of this technical process, YouTube and Google receive information about which specific sub-page of our website is visited by the data subject.
If you have a YouTube account and are logged in to YouTube at the same time, YouTube recognises which specific page of our website you have visited when you call up a page that contains a YouTube video. This information is collected by YouTube and Google and assigned to your YouTube account. YouTube and Google always receive information via the YouTube component that you have visited our website if you are logged in to YouTube at the same time as calling up our website; this takes place regardless of whether you click on a YouTube video or not. If you do not wish this information to be transmitted to YouTube and Google, you can prevent this transmission by logging out of your YouTube account before accessing our website.
Further information on YouTube can be found at https://www.youtube.com/yt/about/de/. The data protection provisions published by YouTube, which can be accessed at https://www.google.de/intl/de/policies/privacy/, provide information on the collection, processing and use of personal data by YouTube and Google.

5) Purposes of processing

The personal data mentioned in point 4) sub-point (1) and (2) of this Privacy Policy are processed for the following purposes:

• operation of the website including the detection and investigation of possible attacks on the website,
• processing applications and orders including negotiating and concluding contracts,
• responding to enquiries including the transmission of information on products and services,
• providing support in connection with the use of products and services (support),

The personal data mentioned in point 4) sub-point (3) and (4) of this Privacy Policy are processed for the following purposes:

• optimisation of the website including the evaluation of user behaviour and the placement of targeted advertising,
• optimisation of the user experience,
• sending newsletters,
• hosting webinars.

6) Legal basis for the processing

The personal data mentioned in point 4) sub-point (1) of this Privacy Policy are processed due to our legitimate interest in the secure and functioning operation of our website (Article 6 para. 1 lit. f GDPR).
The personal data mentioned in point 4) sub-point (2) and (3) of this Privacy Policy are processed for the fulfilment of the contract or for the implementation of pre-contractual measures. Without the processing of personal data, we cannot initiate or conclude a contract with you (Article 6 para. 1 lit. b GDPR).

The personal data mentioned in point 4) sub-point (4) of this Privacy Policy are processed, as far as the use of technically necessary cookies is concerned, on the basis of our legitimate interest in the functioning of our website (Article 6 para. 1 lit. f GDPR) or, as far as the use of non-technically necessary cookies or the registration for newsletters or webinars is concerned, on the basis of your consent (Article 6 para. 1 lit. a GDPR). You can withdraw your consent at any time with effect for the future. However, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

7) Categories of recipients

For the purposes stated in point 5), we transmit your personal data to the IT service providers we use, in particular to the following recipients:

Name and address	Area of activity
Microsoft Corporation One Microsoft Way, Redmond, WA 98052-6399, USA	Operation of cloud services, advertising and communication
WP Engine 504 Lavaca Street, Suite 1000, Austin, TX 78701, USA	Hosting of the website
The Rocket Science Group LLC 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, Georgia 30308, USA	Email services
Google Ireland Ltd. Gordon House, Barrow Street, Dublin 4, Ireland	Management of third-party tags (necessary), web analytics and external media (only with consent)
Salesforce.com Germany GmbH Erika-Mann-Str. 31, 80636 München, Germany	CRM

If you have given your consent to the use of the resp. cookies, we also transfer personal data to the following recipients:

Name and address	Area of activity
Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland	Advertising, communication
LinkedIn Corporation 2029 Stierlin Court, Mountain View, CA 94043, USA	Advertising, communication
HubSpot, Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141, USA	CRM, web analytics, newsletter
Hotjar Ltd. Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta	Web analytics
Vimeo, Inc. 555 West 18th Street, New York New York 10011	External media
Twitter, Inc. 1355 Market Street, Suite 900, San Francisco, CA 94103	Personalised advertisements

Some of the above-mentioned recipients have their headquarters or connections in countries outside the European Union or the Agreement on the European Economic Area (third countries). The level of data protection in third countries may not correspond to that of the European Union.
However, we only transfer personal data to recipients with headquarters or connections in such third countries for which the European Commission has decided that they have an adequate level of data protection or we take additional measures to ensure an adequate level of data protection.
We enter into personal data protection agreements with all the above recipients. With recipients in the US, we additionally conclude the Standard Contract Clauses (SCC)⁴ published by the European Commission. Detailed information on this is available on request at datenschutz@has-to-be.com.

8) Duration of the storage of personal data

Personal data will only be stored by us for as long as absolutely necessary to achieve the purposes stated in point 5) and as this is permissible under applicable law, in particular for as long as statutory retention obligations exist or the limitation periods for potential legal claims have not yet expired.

9) Data subject rights

According to the GDPR, you have the following rights:

• you have the right to obtain information about whether and which personal data we process about you and to whom we transfer it,
• you have the right to request the rectification, restriction of processing or erasure of your personal data processed by us if you consider that they are inaccurate or incomplete or are being processed in part or in whole unlawfully,
• you have the right to object to the processing of your personal data processed by us on the legal basis of legitimate interest if you consider that your interests override ours,
• you have the right to receive personal data provided by you in a structured, commonly used and machine-readable format and to obtain its transfer to a third party designated by you,
• you have the right to revoke any consent you have given for the processing of personal data at any time with effect for the future. However, this does not affect the lawfulness of the data processing carried out on the basis of your consent until revocation,
• you have the right to lodge a complaint with the competent data protection authority.

Should you wish to exercise any of the above-mentioned rights, please contact us or our data protection officer.

10) Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy from time to time due to a changing factual or legal situation. The current version can be found on our website at any time.

Version: July 2021