Privacy Policy.

This is an English translation for your convenience. The German version (Datenschutzerklärung) is legally binding.

Thank you for your interest in Awareness Wien. Protecting your personal data is important to us. This policy explains which data we process, for what purposes and what rights you have. The legal bases are the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act (TKG 2021).

1. Controller

Velvered e.U.
Owner: Dragana Petrović
Linke Wienzeile 36/2, 1060 Vienna, Austria
Phone: +43 677 638 119 23
Email: kontakt@awareness-wien.at

We are not required to appoint a data protection officer. If you have any questions about data protection, please contact us directly at the address above.

2. Visiting the website and server log files

When you access our website, the web server automatically processes data transmitted by your browser: IP address, date and time, page accessed, amount of data transferred, browser type and operating system, and the previously visited page (referrer). This data is necessary for technical operation, security and error analysis. The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest, unless a security-relevant incident requires longer retention.

Hosting: Our website is operated by a European hosting provider. The server is located in the European Union. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR.

Encryption: Data is transmitted in encrypted form (TLS/HTTPS).

Fonts: The fonts used on the website are stored locally on our server. No connections are made to Google Fonts or other font providers.

3. Cookies and consent

Our website only uses technically necessary cookies and cookies you have consented to via the cookie banner. Technically necessary cookies (for example, to store your cookie settings) are permitted without consent under § 165(3) TKG 2021. All other cookies and similar technologies are only set after you have given your consent (Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time via the “Cookie settings” link in the website footer. The cookie banner is provided by the Real Cookie Banner plugin (devowl.io GmbH, Germany). Your consent is recorded locally in your browser and in our WordPress database in order to comply with the obligation to provide proof under Art. 7(1) GDPR. Details on the individual cookies can be found in our cookie policy.

4. Contacting us

Contact forms: If you use our forms (contact, free consultation, request a team), we process the data you enter: name, email address, optionally phone number, company or event, details about your event or request, and your preferred dates. The data is stored in our WordPress database (WPForms plugin) and sent to us by email. The purpose is to answer your enquiry and prepare a quote. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) or our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). Enquiries that do not lead to a contract are deleted after 12 months.

Email and phone: If you contact us by email, phone, text message or WhatsApp, we process your information to handle your request. The legal basis is Art. 6(1)(b) or (f) GDPR. Please note that with WhatsApp, the provider (WhatsApp Ireland Ltd., Meta) processes metadata; for confidential matters we recommend phone or email.

On-site help page: The “Help” page only contains links to call us, to write to us by text message or WhatsApp, and to emergency numbers. No additional data is collected when the page is accessed. Anything you confide in us on site is treated confidentially and only documented in anonymised form.

5. Clients, participants and contract processing

To carry out assignments (awareness teams, concepts) and training, we process the necessary data of our clients and participants: name, company, address, email, phone, billing details, information about the event and, for training, confirmations of participation and training records. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR). We retain billing data for seven years pursuant to § 132 of the Austrian Federal Fiscal Code (BAO). We keep records of completed training for ten years so that we can issue a duplicate to participants if theirs is lost.

Online course: We offer the online course „Awareness Basis“ via the ablefy platform (ablefy GmbH, Potsdamer Straße 125, 10783 Berlin). The contracting party for the purchase is namotto Universal Brands GmbH & Co. KG, Potsdamer Straße 125, 10783 Berlin, which processes the payment as reseller. Our website only links to the checkout page; when you visit ablefy, its privacy notice applies. To provide the course, we process your name, email address, course access, learning progress, quiz results and the certificate of attendance (Art. 6(1)(b) GDPR). ablefy processes this data on our behalf on servers in Germany. We delete course data no later than 12 months after access ends, invoice data after the statutory periods.

Incident logs and final reports: During assignments, we keep logs of situations in which the awareness team took action. These logs do not contain names or any other identifying information about affected guests. Final reports are sent exclusively to the event management and deleted after 12 months.

6. Newsletter

We do not currently send a newsletter. Should we introduce one, it will only be sent with your express consent (Art. 6(1)(a) GDPR, § 174 TKG 2021), using double opt-in and with the option to unsubscribe at any time.

7. Social media

Our website contains links to our profiles on Instagram and LinkedIn. These are simple links; no data is transmitted to Instagram or LinkedIn when our pages load. Only when you click the link do the privacy terms of Meta Platforms Ireland Ltd. apply. Meta is responsible for the processing of your data on Instagram; insofar as we are jointly responsible via statistics (“Insights”), Meta’s joint controller agreement applies. LinkedIn Ireland Unlimited Company is responsible for LinkedIn; its joint controller agreement applies to page statistics.

8. Web analytics

We currently do not use any web analytics tools that transmit data to third parties. Should we use an analytics tool in the future, this will only happen with your consent via the cookie banner, and this policy will be updated accordingly.

9. Recipients and processors

We only pass on personal data if this is necessary to perform a contract or if there is a legal obligation to do so. Processors who process data on our behalf are contractually bound under Art. 28 GDPR: our hosting provider, our email provider and the providers of the WordPress plugins we use, insofar as they process data on their own servers. Data is only transferred to countries outside the EU if there is an adequacy decision (for example the EU-US Data Privacy Framework) or standard contractual clauses.

10. Retention periods

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention obligations. Enquiries without a contract: 12 months. Contract and billing data: 7 years. Incident logs and final reports: 12 months. Server log files: 14 days. Cookie consents: until withdrawn, for a maximum of 12 months.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future. To do so, please contact kontakt@awareness-wien.at.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, phone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.

12. Data security

We use technical and organisational measures to protect your data against loss, misuse and unauthorised access: encrypted transmission, access restrictions, regular updates and backups. Confidential information from assignments is only processed by the owner and the awareness officers assigned to the respective event.

13. Changes

We update this privacy policy when the legal situation or our services change. The version published on this page applies.

Last updated: 21 October 2026