Privacy Policy – Elevate

General information

Introduction and definitions

Protecting your personal data matters to us. This applies to everyone who visits our website, uses our software or takes part in our training, and to anyone who uses our services or intends to (referred to below as “user” or “you”).

This website, www.we-elevate.at (the “website”), is operated by We Elevate Sales GmbH, Gewerbering 19/1/4, 3484 Grafenwörth, Lower Austria (“We Elevate” or “we”). We process and use the personal data you provide to us when you visit and/or register on the website, on the basis of your acknowledgement of this privacy policy.

We attach great importance to handling your data responsibly and transparently, and we of course comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, EU 2016/679) (the “GDPR”) and other applicable data protection law. Using our website, software or training — or expressing interest in them — is referred to below as “using our services”. We undertake to treat your data with care and to protect it as well as we can, and we make every effort to meet the requirements of the GDPR and other data protection law.

The information below gives you a straightforward overview of what happens to your personal data when you visit this website.

Processing of personal data

Personal data. Data protection law applies to the processing of personal data. “Personal” means any data by which you can be personally identified or which can be attributed to you — for example the IP address of the device (PC, laptop, smartphone and so on) you use to access our services. Such data is processed as soon as “something happens with it”. When you use a website, for instance, your browser transmits your IP address to our provider, where it is stored automatically. That is processing (as defined in Art. 4(2) GDPR) of personal data (as defined in Art. 4(1) GDPR). These and other statutory definitions can be found in Art. 4 GDPR.

We process personal data about you when you use our services. To protect that data as well as possible against unauthorised access by third parties, we use SSL/TLS or comparable encryption for our software and website. You can recognise such an encrypted connection by the “https://” or the padlock symbol in your browser’s address bar.

Applicable law. The scope of data protection is set by law: the GDPR, the Austrian Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Federal Law Gazette I No. 165/1999) as amended (the “DSG”), and further national law (such as the Austrian Telecommunications Act, TKG) as well as international law.

Your rights. The GDPR, the DSG and other legislation give you extensive rights. These include free-of-charge information about the origin, recipients and purpose of the personal data we hold about you. You can also request that this data be corrected, restricted or erased, and you can lodge a complaint with the competent supervisory authority. Any consent you have given can be withdrawn at any time with effect for the future.

Controller. Responsibility for the processing lies with the controller within the meaning of the GDPR — the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

You can reach the controller at:

We Elevate Sales GmbH

Gewerbering 19/1/4, 3484 Grafenwörth, Austria

Legal representative: David Hofmann

Email: office@we-elevate.at

Disclosure and erasure. Data is only ever disclosed where there is a legal basis for doing so and where disclosure is unavoidable. That may be the case in particular where a processor is involved and a data processing agreement under Art. 28 GDPR has been concluded. We erase your data once the purpose and the legal basis for processing it no longer apply and no other legal obligation prevents erasure. Art. 17 GDPR gives a good overview of this.

Hosting. Our website, the servers behind our mobile application (the “Elevate app”) and our other applications and software are hosted externally. Personal data collected from users is stored on the host’s servers. This covers both the log files collected and stored automatically (see below for details) and all other data users provide.

We use external hosting so that our website is available securely, quickly and reliably, which serves the performance of our contract with our existing and prospective customers.

The legal basis for this processing is in particular Art. 6(1)(a) GDPR (see also section 4(4) DSG) where the user has given consent, as well as Art. 6(1)(b) and (f) GDPR.

Our host processes only the data required to perform its obligations and acts as our processor, meaning it is bound by our instructions. We have concluded a corresponding data processing agreement with our host.

We use the following host:

Hostinger operations, UAB

Švitrigailos str. 34, Vilnius 03230, Lithuania

Data centre location: Frankfurt am Main, Germany

Phone: +370 645 03378

Email: domains@hostinger.com

Legal bases. Processing personal data always requires a legal basis. Art. 6(1), first sentence, GDPR provides for the following:

the data subject has given consent to the processing of their personal data for one or more specific purposes;
processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
processing is necessary for compliance with a legal obligation to which the controller is subject;
processing is necessary in order to protect the vital interests of the data subject or of another natural person;
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Detailed information on data protection can also be found throughout this privacy policy.

Data processing on this website

Lawful collection of data

Personal (user) data is always used and processed in accordance with the GDPR and other applicable law, above all the DSG. We only collect personal data that is necessary to provide and administer our services, or that you have given us voluntarily.

What data do we collect?

Registering on the website. To use our services you have to register on the website and create a customer account. In doing so we collect the following personal data in particular (together, the “data”):

personal details (name, date of birth, gender, address, email address, phone number);
password (stored encrypted);
IP addresses;
billing address and other payment details;
where applicable, phone number, company name and VAT identification number;
the package you have chosen and your current contract status;
the referral code of a sales partner entered at registration (if any), together with your consent to immediate commencement of the service and the time it was given.

At registration we also adopt your browser language (German or English) as your default setting; you can change this yourself at any time.

To protect against misuse we limit failed sign-in attempts by IP address (a 15-minute lockout after repeated failures).

Legal basis. The legal basis for this processing is the performance of contractual obligations under Art. 6(1)(b) GDPR.

Referral and partner programme. If you come to us through the referral link of a registered sales partner taking part in our partner programme, we process the link between your account and the referring sales partner in order to settle commission. The sales partner concerned sees no account data beyond what is needed for that settlement.

Legal basis. This processing takes place in the performance of contractual obligations under Art. 6(1)(b) GDPR and on the basis of our legitimate interest in providing our online offering securely, quickly and efficiently under Art. 6(1)(f) GDPR.

Visiting the website. When you visit our website and use it for information purposes only — that is, when you do not register or otherwise send us information — we collect only the data your browser transmits to the server (known as “server log files”). When you access our website we collect the following data, which we need technically in order to display the site to you:

the page on our site that you visited
the date and time of access
the volume of data sent, in bytes
the source or referrer you arrived from
the browser used
the operating system used
the IP address used (anonymised where applicable)

Legal basis. This processing takes place under Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used for any other purpose. We do, however, reserve the right to review server log files retrospectively if there are concrete indications of unlawful use.

How do we collect your data?

How data reaches us. Most of the data we hold is provided by you directly. We collect your data when:

you visit our website;
you use our website (for example information about how you use it, including your interaction with the content and services offered there). Like many websites we use cookies and other unique identifiers, and we receive certain types of information whenever your browser or device accesses our website or other content provided by us or on our behalf on other sites;
you register on our website and create a customer account;
you sign up for the newsletter on our website;
you send us a message through one of the contact options on our website.
We may also obtain data indirectly, among other things through our business relationships with our service providers and sales partners.

For what purposes do we process your data?

The data we collect is used for the following purposes:

to provide our services on the website and in the Elevate app, including our digital education offering for registered customers;
to administer and organise our service offering (for example sending information about information and training events);
to set up and organise new memberships;
to deal with customer enquiries;
to send you our newsletter, where you have consented to receiving it;
to process payments, issue invoices and meet our tax and accounting obligations.

How long and where is the collected data stored?

We will not keep your data any longer than is strictly necessary to fulfil (i) the purposes set out above or (ii) statutory requirements.

Account data is stored for the duration of the contractual relationship. After the contract ends, the data is deleted or anonymised, unless statutory retention obligations prevent this — for instance invoice data and accounting records, which must be kept for seven (7) years under section 132 of the Austrian Federal Fiscal Code (BAO). Push tokens are deleted when you sign out, server logs after a short period, and technical event data from app synchronisation after 24 hours at the latest.
If you withdraw your consent to receiving marketing information, your data is deleted immediately. Deleted data may remain in our backups for a short time.
Your data is generally stored on our servers, which are located exclusively within the European Union. Your personal data is protected by appropriate organisational and technical measures, in particular against unauthorised, unlawful or accidental access, processing, loss, use and manipulation.
Despite our efforts to maintain a consistently high standard of care, it cannot be ruled out that information you disclose to us over the internet may be seen and used by others.
Please note, therefore, that we accept no liability of any kind for the disclosure of information caused by transmission errors outside our control and/or unauthorised access by third parties (for example a hacking attack on an email account or phone, or the interception of faxes).

Is your data passed on to third parties?

In order to meet contractual obligations it is sometimes necessary to pass your data on to third parties (for example service providers we use and to whom we make data available; sales partners, who however cannot see any account data beyond commission settlement, see above; authorities, and so on).

Your data is passed on solely on the basis of the GDPR or the DSG, in particular to fulfil your order or on the basis of your prior consent.
Some of the recipients named above are located outside your country or process your personal data there. We transfer your data only to service providers within the European Union.

Marketing

We would be glad to send you information about other events we organise and host that may be of interest to you. We will only do so with your prior express consent.

You can withdraw your consent to receiving such marketing information at any time. A withdrawal can be sent to office@we-elevate.at.

Withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before it was withdrawn.

Cookies

Our website uses “cookies” to make our offering more user-friendly, more effective and more secure.

A “cookie” is a small text file that our web server sends to the cookie file of the browser on your computer’s hard drive. It allows our website to recognise you as a user when a connection is established between our web server and your browser. Cookies help us determine how often our pages are used and how many users we have.

The content of the cookies we use is limited to an identification number that no longer allows any connection to be drawn to the user. The main purpose of a cookie is to recognise visitors to the website.

Two kinds of cookie are used on this website:

Session cookies: temporary cookies that remain in your browser’s cookie file until you leave our website and are deleted automatically once your visit ends.
Persistent cookies: for a better user experience, these remain stored on your device and allow us to recognise your browser on your next visit.

Where individual cookies we use also process personal data, that processing takes place under Art. 6(1)(b) GDPR for the performance of the contract, under Art. 6(1)(a) GDPR where consent has been given, or under Art. 6(1)(f) GDPR to protect our legitimate interests in the best possible functionality of the website and in a customer-friendly and effective visit.

You can set your browser to notify you when cookies are set and to (i) allow cookies only in individual cases, (ii) refuse cookies in certain cases or generally, and (iii) delete cookies automatically when the browser is closed. Disabling cookies may limit the functionality of our website.

Please note that not accepting cookies may limit the functionality of our website.

If you would like to know more about cookies, please visit www.allaboutcookies.org.

Server log files

To optimise this website in terms of system performance and usability and to provide useful information about our services, the website provider automatically collects and stores information in what are known as “server log files”, which your browser transmits to us automatically. These are:

browser type and browser version
operating system used
referrer URL
host name of the accessing computer
time of the server request
IP address

This data is needed temporarily so that our services can be displayed to you without problems. In particular it serves the following purposes:

system security of the website
system stability of the website
troubleshooting on the website
establishing a connection to the website
displaying the website and software
participation in training
booking services
delivering services

This data is not merged with other sources of personal data. We reserve the right to review it retrospectively if we become aware of concrete indications of unlawful use.

Legal basis. Processing takes place under Art. 6(1)(f) GDPR on the basis of our legitimate interest in processing this data, in particular our interest in the functionality and security of the website and software. Where possible this data is stored in pseudonymised form and deleted once the respective purpose has been achieved.

Retention period. Where server log files allow the data subject to be identified, the data is stored for a maximum of 14 days. An exception applies if a security-relevant incident occurs; in that case the server log files are retained until the incident has been resolved and fully investigated.

Google Analytics

Our website uses features of the web analytics service Google Analytics. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses so-called “cookies”; see above for an explanation of what cookies are.

Google Analytics cookies are stored and this analytics tool is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. Where consent has been requested (for example consent to the storage of cookies), processing takes place exclusively on the basis of Art. 6(1)(a) GDPR; that consent can be withdrawn at any time.

IP anonymisation. We have activated IP anonymisation on this website. As a result, Google truncates your IP address within member states of the European Union or in other states party to the Agreement on the European Economic Area before transmitting it to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide further services to the website operator relating to website and internet use. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

Browser plug-in. You can prevent cookies from being stored by adjusting your browser settings; please note, however, that you may then not be able to use all the functions of this website in full. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address), and from processing that data, by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout?hl=en.

Google’s handling of user data in Google Analytics is described in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=en

Demographic characteristics in Google Analytics. This website uses the “demographics” feature of Google Analytics. It allows reports to be produced containing statements about the age, gender and interests of site visitors. This data comes from interest-based advertising by Google and from visitor data supplied by third parties. It cannot be attributed to any specific individual. You can deactivate this feature at any time via the ad settings in your Google account, or prevent Google Analytics from collecting your data generally as described under “Objecting to data collection”.

Stripe

We offer the option of processing payment through the payment service provider Stripe, Townsend St., San Francisco, CA 94103, USA, and Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, Attention: Stripe Legal (“Stripe”).

In doing so we pass the following data to Stripe, in so far as it is necessary to perform the contract (Art. 6(1)(b) GDPR):

cardholder name
email address
customer number
order number
bank details
credit card details
credit card expiry date
credit card security code (CVC)
date and time of the transaction
transaction amount
name of the provider
location

Processing the data listed in this section is required neither by law nor by contract. Without the transmission of your personal data we cannot process a payment via Stripe. You are free to choose a different payment method.

Transfer to third countries. Stripe has implemented compliance measures for international data transfers. These apply to all of its worldwide activities in which Stripe processes personal data of natural persons in the EU, and are based on the EU standard contractual clauses (Art. 46(2) and (3) GDPR).

Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Under these clauses Stripe undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

We point out that, in the view of the Court of Justice of the European Union, there is currently no adequate level of protection for data transfers to the USA. This may entail various risks to the lawfulness and security of the processing.

Legal basis. Stripe has a dual role in its processing activities, acting both as controller and as processor.

If you have consented to Stripe processing and storing your data, that consent is the legal basis for the processing (Art. 6(1)(a) GDPR). In principle your data is also processed in order to perform the contract (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in providing an efficient and secure payment method (Art. 6(1)(f) GDPR).

As a controller, Stripe uses the data transmitted to it in order to meet regulatory obligations. This corresponds to Stripe’s legitimate interest (Art. 6(1)(f) GDPR) and serves the performance of the contract (Art. 6(1)(b) GDPR). We have no influence over that process.

Stripe acts as a processor in order to complete transactions within the payment networks. Within that processor relationship Stripe acts exclusively on our instructions and has been contractually obliged, within the meaning of Art. 28 GDPR, to comply with data protection law.

Retention period. We store your data until payment processing is complete. This includes the period necessary for handling refunds, receivables management and fraud prevention.

Further details:

https://stripe.com/privacy-center/legal

We have concluded a data processing agreement with Stripe under Art. 28 GDPR. This is a contract required by data protection law which ensures that Stripe processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

GoCardless

We use the payment provider GoCardless on our website. The service provider is the British company GoCardless Ltd, Sutton Yard, 65 Goswell Road, London, EC1V 7EN, United Kingdom.

With your express consent we can use this interface to retrieve data from your bank account (such as account holder, IBAN, balances and transaction history), for example in order to verify your identity, reconcile accounts or process a payment. This processing takes place on the basis of your consent under Art. 6(1)(a) GDPR and Art. 9(2)(a) GDPR (where applicable), in so far as payment data is affected. You can withdraw your consent at any time with effect for the future.

Data is transferred to the United Kingdom on the basis of Art. 45 GDPR in conjunction with the European Commission’s adequacy decision for the United Kingdom (Commission Implementing Decision (EU) 2021/1772).

You can view the decision here (download):

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D1772

Further details:

https://gocardless.com/legal/privacy/

Newsletter and email

Newsletter data.

If you would like to receive the newsletter offered on the website, we need an email address from you as well as information allowing us to verify that you are the owner of the address given and that you consent to receiving the newsletter. No further data is collected, or only on a voluntary basis. We use this data exclusively to send the requested information and do not pass it on to third parties.
Double opt-in. Signing up to our newsletter uses a double opt-in procedure. After signing up you receive an email asking you to confirm your registration. This confirmation is necessary so that nobody can sign up using someone else’s email address. Newsletter sign-ups are logged so that the process can be evidenced in line with legal requirements.
The data you provide to us for the purpose of receiving the newsletter is stored by us or by the newsletter service provider (see below) until you unsubscribe, and is deleted from the newsletter distribution list once you do. Data stored by us for other purposes is unaffected.
After you unsubscribe, your email address may be stored by us or by the newsletter service provider on a blocklist in order to prevent future mailings. Data on the blocklist is used only for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters (a legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage on the blocklist is not limited in time. You can object to it, provided your interests outweigh our legitimate interest.
Legal basis. The data entered in the newsletter sign-up form is processed exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw your consent to the storage of the data and the email address and to their use for sending the newsletter at any time, for example via the “unsubscribe” link in the newsletter. Withdrawal does not affect the lawfulness of processing already carried out.

Brevo:

To optimise our marketing communication and provide personalised content we use “Brevo” (formerly “Sendinblue”), a newsletter platform operated by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. The technical purpose of this service is to create and run automated email campaigns and to analyse interaction with our customers.
Brevo stores email addresses and further personal data (such as names or IP addresses at sign-up) on its servers. This data is used to send and evaluate emails on our behalf.
Brevo lets users design emails through a drag-and-drop interface. It offers ready-made templates and options for customising newsletter design. The platform records data about user behaviour, such as which links were clicked and whether emails were opened. This information is used to create targeted marketing campaigns and to measure their success.
All relevant information about the cookies, including name, purpose and retention period, is set out in our detailed list of the cookies in use. Retention periods vary depending on the type of data and statutory retention obligations. Once those periods expire, the data is deleted without delay.
We have concluded a data processing agreement with Brevo under Art. 28 GDPR. This is a contract required by data protection law which ensures that Brevo processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.
Legal basis. Brevo processes your personal data exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw that consent at any time.
Further details:

https://www.brevo.com

https://www.brevo.com/legal/privacypolicy/

https://www.brevo.com/legal/termsofuse/

We recommend checking these links regularly for changes, in particular with regard to Brevo. Further information about the rights of data subjects and the relevant contact details can be found in the general section of this privacy policy.

Social networks

We maintain a presence on social networks and platforms in order to communicate with the customers, prospects and users active there and to inform them about our services.

Facebook:

Facebook is a social media network operated by Meta Platforms Inc., or for Europe by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).
We use selected Facebook tools on our website, including what Facebook officially calls the “Facebook Business Tools” (the “tools”). These tools allow us to offer the best possible experience to you and to people interested in our products and services. They include, among others:
Facebook pixel
social plug-ins (such as the “like” or “share” button)
Facebook Login
Account Kit
APIs (programming interfaces)
SDKs (collections of programming tools)
platform integrations
plug-ins
code
specifications
documentation
technologies and services

Through these tools Facebook extends its services and is able to receive information about user activity outside Facebook.

Where data about you is collected and forwarded through our embedded Facebook elements or our Facebook page, both we and Facebook are responsible for that. Facebook alone is responsible for any further processing of that data. Our joint obligations are also set out in a publicly available agreement, which you can view here: https://www.facebook.com/legal/controller_addendum

Among other things, that agreement records that we must inform you clearly about the use of the tools on our site. We are also responsible for embedding the tools into our website in a way that complies with data protection law. Facebook, in turn, is responsible for matters such as the data security of the Facebook products. If you have any questions about Facebook’s collection and processing of data you can contact the company directly. If you put the question to us, we are obliged to forward it to Facebook.

By using selected tools on our website we want to show our services and products only to people who are genuinely interested in them. Advertising (Facebook Ads) lets us reach exactly those people. In order to show users relevant advertising, however, Facebook needs information about people’s wishes and needs, so information about user behaviour (and contact details) on our website is made available to the company. This gives Facebook better user data and allows it to show interested people relevant advertising for our products and services. The tools therefore make tailored advertising campaigns on Facebook possible.
Facebook calls data about your behaviour on our website “event data”. It is also used for measurement and analytics services. This allows Facebook to produce “campaign reports” on our behalf about the effect of our advertising campaigns. The analyses also give us a better insight into how you use our services, website and products, and we use some of these tools to improve your experience on our website. With the social plug-ins, for instance, you can share content from our site directly on Facebook.
Using selected tools may send personal data (customer data) to Facebook. Depending on the tools used, customer data such as name, address, phone number and IP address may be transmitted. Facebook uses this information to match the data against the data it already holds about you (if you are a Facebook member). Before customer data is transmitted to Facebook it is “hashed” — a data set of any size is transformed into a character string, which also serves to encrypt the data. Alongside contact details, “event data” is also transmitted; by that we mean the information we receive about you on our website, for example which sub-pages you visit or which services you use or buy from us. Facebook does not share the information it receives with third parties (such as advertisers) unless it has explicit permission or is legally obliged to do so. Event data can also be linked to contact details, which allows Facebook to offer better personalised advertising. After the matching process described above, Facebook deletes the contact details again.
In order to deliver advertising in an optimised way, Facebook only uses event data once it has been combined with other data collected by Facebook in other ways. Facebook also uses this event data for security, protection, development and research purposes. Much of this data is transmitted to Facebook via cookies; what cookies are is explained in the “Cookies” section above. Depending on the tools used and on whether you are a Facebook member, a varying number of cookies will be set in your browser. The descriptions of the individual tools go into more detail on specific Facebook cookies.

General information about Facebook’s use of cookies is available here:

https://www.facebook.com/privacy/policies/cookies/

Storing data via cookies: the data Facebook receives through our site is stored partly via cookies (for example with social plug-ins). You can disable, delete or manage individual cookies or all cookies in your browser. How this works depends on the browser you use; the “Cookies” section contains the relevant links to instructions for the best-known browsers.

If you do not want cookies at all, you can set your browser to notify you whenever a cookie is about to be set, so that you can decide for each individual cookie whether to allow it.

Transfer to third countries: Facebook processes your data in the USA (a third country) among other places. As the basis for processing by recipients established in third countries (outside the European Union, in particular the USA, Iceland, Liechtenstein and Norway), or for transfers there, Facebook uses standard contractual clauses (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Under these clauses Facebook undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

Facebook’s data processing terms, which refer to the standard contractual clauses, can be found at

https://www.facebook.com/legal/terms/dataprocessing

Retention period: as a rule Facebook stores data until it is no longer needed for Facebook’s own services and products. Facebook has servers distributed around the world on which the company’s data is stored. Customer data, however, is deleted within 48 hours once it has been matched against Facebook’s own user data.
Deleting data and preventing storage: under the GDPR you have the right to access, rectification, portability and erasure of your data. Data is only deleted completely if you delete your Facebook account entirely. Deleting your Facebook account works as follows:
click on Settings on the right in Facebook;
then click “Your Facebook Information” in the left-hand column;
now click “Deactivation and Deletion”;
select “Delete Account” and then click “Continue to Account Deletion”;
enter your password, click “Continue” and then “Delete Account”.
If you have consented to your data being processed and stored by the embedded tools, that consent is the legal basis. Facebook processes your personal data on the basis of your consent (Art. 6(1)(a) GDPR).

In principle your data is also stored and processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in quick and effective communication with you and with other customers and business partners. Nevertheless, we only use the tools where you have given consent.

Further details:

https://www.facebook.com/privacy/policy/

Most social media platforms, Facebook included, also set cookies in your browser in order to store data. We therefore recommend reading the “Cookies” section of this privacy policy carefully and reviewing the privacy policy or cookie policy of the respective provider.

Instagram:

We operate an Instagram profile. This social media platform is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
When you visit our Instagram profile and interact with us there, we process personal data — both the data made publicly available on the profile and the personal data contained in posts, comments or direct messages to us.
Transfer to third countries: Instagram processes your data in the USA (a third country) among other places. As the basis for processing by recipients established in third countries (outside the European Union, Iceland, Liechtenstein and Norway, so in particular in the USA), or for transfers there, Instagram uses standard contractual clauses (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Under these clauses Instagram undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

Retention period: the retention periods and storage locations for the data Instagram collects can vary considerably and are governed by Instagram’s privacy policy. Instagram may also store data on servers in the USA and other countries. Retention is generally determined by the applicable legal requirements and by internal policy. We have not yet been able to establish exactly how long data is stored. As soon as we have more detailed information we will of course let you know.
If you have an Instagram account you can manage your privacy settings there directly. In your account settings you can, for instance, specify what information may and may not be shared. You can also manage and disable cookies in your web browser in order to limit data collection — this is possible without an account of your own as well. Please note, however, that this may affect the functionality of our website.
Legal basis. If you have consented to your data being processed and stored by Instagram, that consent is the legal basis for the processing (Art. 6(1)(a) GDPR).

privacycenter.instagram.com

Instagram may also set cookies in your browser in order to store data. We therefore recommend reading the “Cookies” section of this privacy policy carefully and reviewing the privacy policy or cookie policy of the respective provider.

TikTok:

We use the TikTok integration (“TikTok”) on our website. The service provider is the Chinese company Beijing Bytedance Technology Ltd. For Europe, the Irish company TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, is responsible.
We have built TikTok into our website so that you can watch TikTok videos if you feel like it, and interact with them where applicable. TikTok is known in particular for funny and creative content, and we did not want to keep that from you — we enjoy the odd creative TikTok video ourselves.
When you watch TikTok videos on our website or interact with them, TikTok may collect information about your usage behaviour and your device. This may include data such as your IP address, browser type, operating system, location and other technical information. TikTok may also use cookies and similar technologies to collect information and personalise your experience.
If you have a TikTok account of your own, further information may be collected and processed, including user information (such as name, date of birth or your email address) and data about your communication with other TikTok users.
Transfer to third countries: TikTok processes your data in the USA (a third country) among other places. As the basis for processing by recipients established in third countries (outside the European Union, Iceland, Liechtenstein and Norway, so in particular in the USA), or for transfers there, TikTok uses standard contractual clauses (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Under these clauses TikTok undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

Retention period: the retention periods and storage locations for the data TikTok collects can vary considerably and are governed by TikTok’s privacy policy. TikTok may also store data on servers in the USA and other countries. Retention is generally determined by the applicable legal requirements and by internal policy. We have not yet been able to establish exactly how long data is stored. As soon as we have more detailed information we will of course let you know.
If you have a TikTok account you can manage your privacy settings there directly. In your account settings you can, for instance, specify what information may and may not be shared. You can also manage and disable cookies in your web browser in order to limit data collection — this is possible without a TikTok account as well. Please note, however, that this may affect the functionality of our website.
Legal basis. If you have consented to your data being processed and stored by TikTok, that consent is the legal basis for the processing (Art. 6(1)(a) GDPR).

Further details:

https://www.tiktok.com/

https://www.tiktok.com/legal/page/eea/privacy-policy/en

TikTok may also set cookies in your browser in order to store data. We therefore recommend reading the “Cookies” section of this privacy policy carefully and reviewing the privacy policy or cookie policy of the respective provider.

Vimeo

We have a Vimeo profile. This is a service provided by Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.
When you visit one of our pages that has a Vimeo plug-in, a connection to Vimeo’s servers is established. The Vimeo server is told which of our pages you have visited, and Vimeo also obtains your IP address. This applies even if you are not logged in to Vimeo or do not have a Vimeo account. The information Vimeo collects is transmitted to Vimeo’s server in the USA.
If you are logged in to your Vimeo account, you allow Vimeo to attribute your browsing behaviour directly to your personal profile. You can prevent this by logging out of your Vimeo account.
Legal basis. Vimeo is used in the interest of an appealing presentation of our online offering. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Where consent has been requested (for example consent to the storage of cookies), processing takes place exclusively on the basis of Art. 6(1)(a) GDPR; that consent can be withdrawn at any time.
Processing by Vimeo: Vimeo processes both data entered voluntarily, such as name, username, email address or phone number, and the content you share.
Further details:

https://help.vimeo.com/hc/en-us/sections/12397318942993-Privacy

Vimeo (embedded videos):
We use Vimeo as part of our services. Vimeo is a plug-in that allows videos from the Vimeo video platform to be embedded. The service is provided by Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.
When a website that embeds Vimeo videos through this service is visited, a connection to Vimeo’s servers is established. Vimeo thereby determines which website the connection is coming from and with which IP address.
If you are logged in to Vimeo as a member, Vimeo attributes this information to your personal user account. You can prevent this attribution by logging out of your Vimeo account before using our website.
The European Commission’s standard contractual clauses (SCCs) apply to the transfer of data to the USA. Standard contractual clauses are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Under these clauses Vimeo undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

Legal basis. The legal basis for this processing is Art. 6(1)(a) GDPR. Consent can be withdrawn at any time.
Further details:

https://vimeo.com/privacy

Data processing by the Elevate app

You sign in to the Elevate app with your existing customer account. In addition to the website, the Elevate app processes the following data:

Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Tag Manager is a service that lets us manage website and JavaScript tags (known as “tags”) through a user interface.

Google Tag Manager itself stores no cookies and records no user data for profiling. It merely triggers other tags, which may in turn collect data. Google Tag Manager does, however, record users’ IP addresses, which may also be transmitted to Google’s servers in the USA.

Transfer to third countries. Data is transmitted to the processor Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This may also mean a transfer of personal data to a country outside the European Union. Data is transferred to the USA on the basis of Art. 45 GDPR in conjunction with European Commission adequacy decision C(2023) 4745, as the recipient has undertaken to comply with the data processing principles of the Data Privacy Framework (DPF).

You can view the decision here (download):

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D1772

Legal basis. Google Tag Manager is only loaded after you have given consent. The legal basis is Art. 6(1)(a) GDPR. That consent can be withdrawn at any time.

Google Fonts

The Elevate app loads fonts from Google Fonts. Google Fonts is a tool that allows fonts to be displayed consistently. The service is provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

As soon as a website or the Elevate app that uses Google Fonts is accessed, the browser has to connect to Google’s servers. No cookies are set in the process. The visitor’s IP address is, however, recorded and used for analytics purposes.

Legal basis. The legal basis for this processing is your consent under Art. 6(1)(a) GDPR. That consent can be withdrawn at any time.

Further details:

https://developers.google.com/fonts/faq

https://policies.google.com/privacy

Firebase Cloud Messaging

For communicating with you — in particular to notify you about new posts — we use services from Google Firebase (“Firebase”), provided by Google Inc. (USA). For Europe, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) is responsible.

Using this service involves processing a device token; the notification text contains the channel name and a preview of the post. You can disable push notifications at any time in the Elevate app or in your system settings, and the token is deleted when you sign out.

Firebase is a platform for developing web and mobile apps. Google processes your data in the USA among other places. Firebase and Google actively participate in the EU-US Data Privacy Framework, which governs the correct and secure transfer of personal data of EU citizens to the USA. More information is available at

https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Google also uses standard contractual clauses (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Through the EU-US Data Privacy Framework and the standard contractual clauses, Google undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

The data processing agreement referring to the standard contractual clauses can be found at

https://firebase.google.com/terms/firebase-sccs-eu-c2p

Firebase Cloud Messaging (FCM): we use FCM to show you push notifications on your device. For this a connection to Google’s servers is established and a registration token is generated for your device or browser.

Firebase Crashlytics: we use this service to monitor the stability of the Elevate app and to analyse crashes. If an error occurs, technical data (such as device information, the time of the error and stack traces) is transmitted to Google. This helps us fix technical defects.

When a crash occurs, technical data is transmitted (device type, operating system version, crash log, pseudonymous installation ID) — no content and no real name.

Legal basis. This service is only used with your express consent (Art. 6(1)(a) GDPR). You can withdraw your consent to receiving these notifications at any time in the settings of your browser or device.

Processing also takes place to protect our legitimate interest in the error-free operation of our web and service offering (Art. 6(1)(f) GDPR).

Further details:

https://policies.google.com/privacy

https://firebase.google.com

Unpkg

We use the service “unpkg” on our website, a content delivery network (“CDN”) for npm packages operated by npm, Inc., 1999 Harrison Street #1150, Oakland, CA 94612, USA.

To improve loading times and the correct display of our website, external scripts (such as JavaScript libraries) are loaded via unpkg. For this your browser has to connect to unpkg’s servers, and unpkg thereby learns that this website has been opened from your IP address. If the files in question have already been loaded from another CDN site, your browser will usually access the cached copy. If JavaScript is enabled in your browser and you have not installed a JavaScript blocker, your browser may transmit data to unpkg.

Legal basis. If you have consented to the use of the unpkg CDN, that consent is the legal basis for the corresponding processing (Art. 6(1)(a) GDPR).

Beyond that, the service is used on the basis of our legitimate interest in providing our online offering securely, quickly and efficiently (Art. 6(1)(f) GDPR). You can prevent the transmission of data by disabling the execution of script code in your browser or by installing a script blocker (such as uBlock Origin).

Further details:

https://docs.npmjs.com/policies/privacy

jsDelivr CDN

This website uses the content delivery network (“CDN”) jsDelivr, operated by the Polish software company ProspectOne, Królewska 65A/1, 30-081 Kraków, Poland.

A CDN is a service that delivers content from our online offering — in particular large media files such as graphics or scripts — more quickly by using regionally distributed servers connected via the internet. User data is processed exclusively for the purposes named above and to maintain the security and functionality of the CDN. For this, the browser you use has to establish a connection to the CDN’s servers, and the CDN thereby learns that our website has been accessed from your IP address.

Legal basis. If you have consented to the use of the jsDelivr CDN, that consent is the legal basis for the corresponding processing (Art. 6(1)(a) GDPR). The service is also used on the basis of our legitimate interests, namely our interest in providing, analysing and optimising our services securely and efficiently, under Art. 6(1)(f) GDPR.

Further details:

https://www.jsdelivr.com/terms/privacy-policy

Cloudflare

We use the service “Cloudflare”. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”).

Cloudflare offers a globally distributed content delivery network with DNS. Technically, the transfer of information between your browser and our website is routed through Cloudflare’s network. This puts Cloudflare in a position to analyse the traffic between your browser and our website and to act as a filter between our servers and potentially malicious traffic from the internet. Cloudflare may also use cookies or other technologies to recognise internet users, but these are used solely for the purpose described here.

Transfer to third countries. Cloudflare also processes personal data in third countries, for which the EU standard contractual clauses apply. Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Through the EU-US Data Privacy Framework and the standard contractual clauses, Cloudflare undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

Legal basis. If you have consented to the use of Cloudflare’s services, that consent is the legal basis for the corresponding processing (Art. 6(1)(a) GDPR).

Beyond that, the use of Cloudflare rests on our legitimate interest in providing our services as reliably and securely as possible (Art. 6(1)(f) GDPR).

Cloudflare, Inc. is also certified under the Data Privacy Framework and therefore meets the European Commission’s requirements.

Further information on security and data protection at Cloudflare can be found here:

https://www.cloudflare.com/privacypolicy/

We have concluded a data processing agreement with the provider named above under Art. 28 GDPR. This is a contract required by data protection law which ensures that the provider processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

QR code generator (QR Code API)

We embed the QR code service api.qrserver.com (provider: GOQR.me) on our website in order to generate QR codes dynamically (for example for payment details or links). Using the service allows things like partner codes (QR codes) to be shared.

When you open our page, your browser establishes a direct connection to the provider’s servers. In doing so, your IP address and the data encoded in the respective QR code (for example URL content or payment details such as IBAN and amount) are transmitted to the provider in order to generate the image.

According to the provider, the contents of the QR codes and the generated image files are not stored permanently but are deleted from the cache after a short time (approximately 5 minutes). Technical access data (such as IP address, browser type and time) is processed in the provider’s server logs.

Legal basis. If you have consented to the use of the GOQR QR code generator, that consent is the legal basis for the corresponding processing. Under Art. 6(1)(a) GDPR that consent constitutes the legal basis for the processing of personal data as it may occur with GOQR’s services. The service is also used on the basis of our legitimate interest in a user-friendly, fast and error-free display of features on our website (Art. 6(1)(f) GDPR).

Further details:

https://goqr.me/en/legal/privacy-api.html

Portfolio feature

Using API interfaces (“API keys”) you can connect your accounts with international trading platforms (such as exchanges) to the Elevate app with read-only access. Using this service is entirely voluntary.

API stands for “application programming interface”. An API is a digital bridge that allows different software programs to communicate with one another and exchange data.

We use interfaces (APIs) and WebSocket services from the following providers and trading platforms:

Binance (https://www.binance.com), to show you current financial and market data in real time.

Further details:

https://www.binance.com/en/about-legal/privacy-portal

CoinCap (Haiku Strategies LLC, USA; https://coincap.io), to improve your portfolio view by displaying coin logos.

Further details:

https://coincap.io/terms-of-service?tab=privacy

Phemex (https://phemex.com/about), to enable data retrieval for the portfolio feature on our website.

Further details:

https://phemex.com/help-center/phemex-privacy-policy

Bitget (https://www.bitget.com/promotion/aboutus), to enable data retrieval for the portfolio feature on our website.

Further details:

https://www.bitget.com/terms/legal/360015150651

If you voluntarily use the portfolio feature of the Elevate app, we retrieve your account holdings and transactions and store them in order to display your portfolio and its analyses. API keys are stored encrypted on our servers (EU), and trading in your name and/or for your account is technically not possible.

Since we neither trade in nor broker financial products, provide no personal investment advice and give no individual recommendations regarding financial products or trading in them — and are not authorised to do so — this restriction is essential in order to meet all legal and regulatory requirements on our part. In this regard we again refer to the description of our activities as well as the risk warnings and disclaimers on our website and in this privacy policy (see below).

Market prices (for example via CoinGecko or Twelve Data) are retrieved by our server without any personal reference — your IP address is not transmitted to those providers.

For technical reasons, using these services also transmits your IP address, and optionally any API keys or authentication data provided, to the servers of the trading platforms named. This may involve a transfer of data outside the European Union.

Details of how the providers concerned process your personal data can be found in their respective privacy policies, which we have linked in this section and which also underlie our services within the portfolio feature. Please read those privacy policies carefully. By using this service you consent to the processing of your personal data by those providers.

Legal basis. You can disconnect the link at any time in the Elevate app, which immediately ends our access to your accounts and any retrieval of balances and transactions. If you have consented to the use of the APIs and WebSocket services of the trading platforms Binance, CoinCap, Phemex or Bitget, that consent is the legal basis for the corresponding processing. Under Art. 6(1)(a) GDPR that consent constitutes the legal basis for the processing of personal data as it may occur with such services.

Beyond that, the processing of personal data and the use of the APIs and WebSocket services of Binance, CoinCap, Phemex and Bitget take place on the basis of our legitimate interest in an attractive and functional display of current market data, in transparent and convenient access to your personal portfolio following explicit authentication, and in an appealing and accurate presentation of our online offering (legal basis: Art. 6(1)(f) GDPR).

We expressly point out that we are not, and do not operate, a trading platform, a crypto exchange or any other platform for trading in digital currencies and/or financial products or instruments of any kind. Our offering is limited to providing a transparent and user-friendly website.

We do not act as investment advisers or brokers, we give no personal recommendations to act, and we accept no responsibility or liability of any kind for your personal financial decisions or for the trading or investment behaviour based on them.

Please note the information and risk warnings on our website and the underlying disclaimers at https://www.we-elevate.at/ and https://www.we-elevate.at/risk-disclosure/.

Artificial intelligence

We use artificial intelligence (AI), which involves processing personal data. The specific purposes and our interest in using AI are set out below. By AI we mean, in line with the definition of an “AI system” in Article 3(1) of the AI Act, a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

Anthropic Claude

Audio and video contributions from our team are stored on our own servers (EU) and transcribed there; no external service is used for this.
For the automatic translation of our team’s contributions (German/English) we do, however, use the API of Anthropic, PBC, 548 Market St, PMB 90708, San Francisco, CA 94104, USA (“Anthropic”), in order to provide AI-supported features such as text or response generation.
Anthropic is a company specialising in the development of “safe” AI systems. We use Anthropic’s technology for our AI bots.
When you use the corresponding features in the Elevate app, your inputs (prompts) and, where applicable, technical metadata are transmitted to Anthropic’s servers and processed there. The data is processed in accordance with Anthropic’s commercial terms of use; by default, the commercial API does not use your inputs and outputs to train the AI models.
Transfer to third countries: using Anthropic’s services involves a transfer of personal data to the USA (a third country). As the basis for processing by recipients established in third countries (outside the European Union, Iceland, Liechtenstein and Norway, so in particular in the USA), or for transfers there, Anthropic uses standard contractual clauses (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Under these clauses Anthropic undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

Anthropic receives from us only editorial content produced by our team, and no personal data of registered customers (members).
Legal basis: processing takes place on the basis of your consent under Art. 6(1)(a) GDPR (where consent is requested beforehand), which you can withdraw at any time, or in order to provide our offering and answer your enquiries under Art. 6(1)(b) GDPR.
Further details:

https://privacy.claude.com/en/

We have concluded a data processing agreement with Anthropic under Art. 28 GDPR. This is a contract required by data protection law which ensures that Anthropic processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

ElevenLabs:

To add speech to the content translated via Anthropic’s API we use the service ElevenLabs for voice features (for example read-aloud functions or generated audio content). The provider is Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA (“ElevenLabs”).
ElevenLabs is an AI-supported service that allows us to transcribe voice recordings as text or to generate AI voices.
Transfer to third countries: using ElevenLabs involves transmitting data to ElevenLabs. As the basis for processing by recipients established in third countries (outside the European Union, Iceland, Liechtenstein and Norway, so in particular in the USA), or for transfers there, ElevenLabs uses standard contractual clauses (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Under these clauses ElevenLabs undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

ElevenLabs receives from us only editorial content produced by our team, and no personal data of registered customers (members).
Legal basis: your data is processed on the basis of your consent, which can be withdrawn at any time, and on the basis of our legitimate interest in appealing and modern functionality on our website (Art. 6(1)(f) GDPR).
Further details:

https://elevenlabs.io/privacy-policy

We have concluded a data processing agreement with ElevenLabs under Art. 28 GDPR. This is a contract required by data protection law which ensures that ElevenLabs processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

Further information about features of the Elevate app

Permissions. The Elevate app only requests permissions for particular features and services when the feature in question is actually used as part of a specific service to you:

notifications (push),
photos and media (only when saving images or videos to your gallery),
microphone (only when the recording feature is used by team members).

Every permission can be revoked at any time in your system settings.

Unlocking. Optional unlocking by fingerprint or face recognition takes place entirely on your device, handled by the operating system. Biometric data never leaves your device and is not accessible to us at any time.

App stores. For our business we use the app stores “Google Play” and the “Apple App Store”.

Google Play. The service provider is the American company Google Inc. For Europe, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland, together with Google Inc. “Google”) is responsible for all Google services.
Apple App Store. The service provider is the American company Apple Inc., 1 Apple Park Way, Cupertino, CA 95014, USA. For Europe, Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland (together with Apple Inc. “Apple”) is responsible.
Google and Apple process personal data about you, including account, download and diagnostic data, in the USA (a third country) among other places. Your IP address is recorded by us in this process and used for analytics purposes.
Transfer to third countries. As the basis for processing by recipients established in third countries (outside the European Union, in particular the USA, Iceland, Liechtenstein and Norway), or for transfers there, Google and Apple use standard contractual clauses (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data continues to meet European data protection standards even when it is transferred to and stored in third countries such as the USA. Under these clauses the provider undertakes to maintain the European level of data protection when processing your relevant data, even where that data is stored, processed and administered in the USA. The clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at

https://business.safety.google/adsprocessorterms/,

and Apple’s at

https://www.apple.com/legal/education/data-transfer-agreements/datatransfer-eu-en.pdf

Legal basis. The legal basis for this processing is your consent under Art. 6(1)(a) GDPR. That consent can be withdrawn at any time. Beyond that, because we are performing contractual obligations towards you, we have a legitimate interest in the processing concerned (Art. 6(1)(f) GDPR).
Further details:

https://policies.google.com/privacy

https://www.apple.com/legal/privacy/

Other information

Linked privacy policies

Our website and the Elevate app draw on services from external providers, which are named in this privacy policy and whose relevant privacy policies are linked accordingly. We expressly point out that our service offering is governed not only by this privacy policy but also by the privacy policies of those providers to which explicit reference is made here (by way of the corresponding links), and that those policies therefore also apply to the processing of your personal data.

Updates to this privacy policy

We review and update this privacy policy regularly. It was last updated on 5 August 2026.

Changes to this policy and to the services

We are entitled to amend and/or supplement this privacy policy at any time with effect for the future, in particular where the services are extended or where changes in the law require it. The current version of the policy is available at any time on our website at https://www.we-elevate.at/privacy-policy/.

Users will be made aware of any amendments and/or additions by a corresponding notice of change sent to the email address given by the user for correspondence and/or shown when signing in to the website. Consent to the amendments and/or additions is deemed to have been given unless the user objects in writing (by email) within six (6) weeks of receiving the notice of change. In the notice of change we will point out the consequences of failing to object. In any event, the user consents to the notified amendments and/or additions by continuing to use the services after receiving the notice of change.

If the user objects to the notified amendments and/or additions, further use of the services is not possible. The user then has the option of deleting their user account.

Your rights

You have the following rights:

Right of access (Art. 15 GDPR): you have the right to request copies of the data we hold about you. We may charge a small fee for producing and sending such copies.
Right to rectification (Art. 16 GDPR): you have the right to require us to correct inaccurate data concerning you.
Right to erasure (Art. 17 GDPR): you can require us to erase your data where we are processing it unlawfully or where the processing interferes disproportionately with your legitimate interests in protection. Please note that there may be reasons preventing immediate erasure, for example statutory retention obligations. Irrespective of whether you exercise your right to erasure, we will erase your data promptly and completely as soon as no contractual or statutory retention obligation prevents this.
Right to restriction of processing (Art. 18 GDPR): you have the right to require us to restrict the processing of your data where
you contest the accuracy of the data, for a period enabling us to verify it;
the processing is unlawful but you oppose erasure and request restriction of use instead;
we no longer need the data for the intended purpose but you still need it to establish, exercise or defend legal claims; or
you have objected to the processing.
Right to data portability (Art. 20 GDPR): you have the right to require us to provide the data you have given us in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance from us, provided that
we process that data on the basis of consent given by you and revocable at any time, or in order to perform a contract between us, and
the processing is carried out by automated means.

Where technically feasible, you can require us to transmit your data directly to another controller.

Right to object (Art. 21 GDPR): where we process your data on the basis of a legitimate interest, you can object to that processing at any time; this also applies to profiling based on those provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You can object to the processing of your data for direct marketing purposes at any time without giving reasons.
Right to lodge a complaint (Art. 77 GDPR): if you believe that we are infringing Austrian or European data protection law in processing your data, please contact us so that we can clarify the matter. You are of course also entitled to contact the supervisory authority responsible for you. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna.

If you wish to exercise one of these rights against us, please contact us using the details below. In case of doubt we may request additional information to confirm your identity.

Our contact details

Protecting your data is particularly important to us. You can reach us at the contact details below at any time with your questions or to withdraw consent.

We Elevate Sales GmbH

Gewerbering 19/1/4, 3484 Grafenwörth, Austria

Legal representative: David Hofmann

Email: office@we-elevate.at

Last updated: 5 August 2026