Formunauts (hereinafter referred to as “Formunauts”) is pleased that you are visiting our website. Data protection and data security when using our website are very important to us. We would therefore like to inform you at this point about the personal data we collect during your visit to our website and while providing our services and about the intended purposes.

As changes to the law or changes to our internal processes may require an adaptation of this privacy statement, we ask you to read this privacy policy regularly. The privacy policy can be accessed any time under “Privacy Policy,” saved, and printed out.

§ 1 Data controller and scope

The controller according to the EU General Data Protection Regulation (hereinafter referred to as “GDPR”) and other national data protection acts of the Member States, in particular the Data Protection Act (hereinafter referred to as “DSG” as well as other data protection regulations, is:

• Formunauts GmbH
• Theobaldgasse 20/1/7
• 1060 Wien, Austria
• E-Mail: privacy@formunauts.at
• Phone (UK): +44 (0) 150 350 5045

This privacy policy applies to the services offered by Formunauts and in particular to the subsequent data processing, especially in connection with the product Formunauts App and Formunauts Marketplace (together hereinafter referred to as “Services”, together with the website hereinafter referred to as “Services”) which can be accessed under the domain https://formunauts.at, https://formunauts.com and https://donutapp.io and its various subdomains.

§ 2 Data protection officer

The controller’s external data protection officer is:

• RA Dr. Daniel Stanonik LL.M.
• Salztorgasse 2/15
• 1010 Wien
• E-Mail: office@stanonik.at
• Telefon (AT): +43 (0) 904 33 55

§ 3 Principles of processing personal data

Personal data are all information relating to an identified or identifiable natural person. This includes information such as your name, age, address, telephone number, date of birth, email address, IP address, or user behaviour. Information that cannot (or only with disproportionate effort) be referred to your person, e.g., by anonymising the information, is not personal data. The processing of personal data (e.g., the collection, retrieval, use, storage, or transmission) always requires a legal basis or your consent.

Processed personal data will be deleted as soon as the purpose of the processing has been fulfilled and no legally prescribed retention obligations are to be observed.

In case we process your personal data for the provision of certain services, please find below information about the specific processes, the scope and purpose of data processing, the legal basis for processing, and the respective storage period.

§ 4 Individual processing operations

4.1 Provision and use of our website 

a. Description and scope of data processing

When you access and use our website, we collect the personal data that your browser automatically transmits to our server. This information is temporarily stored in a log file. When you use our website, we collect the following data, which are technically necessary for us to display our website to you and to guarantee stability and security:

• IP address of the requesting computer
• date and time of access
• name and URL of the retrieved file
• the web page from which access is made (referrer URL)
• the browser used and, if applicable, the operating system of your computer, as well as the name of your access provider
• the type of device through which access is made (tablet, mobile phone, laptop, etc.)
• the country from which the access is made

b. Legal basis

Art. 6 para 1 lit. f GDPR serves as the legal basis for the aforementioned data processing. The processing of the mentioned data is necessary for the provision of a website and thus serves the protection of a legitimate interest of our company. 

c. Processing period

The above-mentioned data will, with exception to section 7 of this privacy policy, be deleted when their processing is no longer necessary. The collection of data for the provision of our website and the storage of data in log files is absolutely necessary for the operation of our website. Consequently, there is no possibility of objection on the part of the user. Further storage may take place in individual cases if this is required by law.

4.2 Contractual relationships

a. Type and scope of data processing

Formunauts may process the following personal data due to an existing contractual relationship or due to a precontractual relationship in connection with the Services. These data will only be processed in order to provide the (pre-)contractually agreed services:

• Name
• E-mail
• Telephone number
• Address
• Birthdate

b. Legal basis

The aforementioned data processing is due to the existing (pre)contractual relationship based on Art 6 para 1 lit b GDPR.

c. Processing period

These data will be stored for up to 7 years after the (pre)contractual relationship has come to term. Data processing which exceeds the (pre)contractual period is based on Art 6 para 1 lit c and f GDPR. Formunauts’ legitimate interest lies in the necessary organization of its contracts as well as in the reacquisition of customers.

4.3 Newsletter

a. Description and scope of data processing

Our website provides the possibility to subscribe to our free newsletter. In order provide this service we need to process the following data:

• Name
• E-mail

For our newsletter campaigns we us the so-called double opt-in procedure, meaning we will only register your subscription and send you e-mails, once you’ve confirmed your subscription and e-mail-address by clicking a link in the respective confirmation e-mail. Your confirmation must be promptly after receiving the confirmation e-mail, otherwise your subscription will be automatically deleted from our data base. This procedure is necessary I order to verify, that you in fact own the e-mail-address provided for the subscription.

b. Legal basis

The aforementioned data processing is based on your freely given consent according to Art 6 para 1 lit a GDPR.

Declaration of consent:

By entering my personal data and clicking the button “ready for take off” I consent to the processing of my e-mail-address and of my first and last name in order to receive regular newsletter. I may unsubscribe from this newsletter at any time, by clicking the respective link. 

I can withdraw my consent to aforementioned processing at all time via e-mail to privacy@formunauts.at or via letter to Theobaldgasse 20/1/7, 1060 Vienna.

c. Processing period

The above-mentioned data will be processed for the duration of your subscription. Your data will be deleted after unsubscribing from our newsletter. We may continue processing your data in case we are legally obligated to do so.

4.4 Contacting

a. Type and scope of data processing

You have the possibility to get in contact with Formunauts via the request form on our website. This request form also refers to this privacy policy when it asks for your consent to the related data processing. The following data will be processed, should you choose to get in contact with Formunauts via the request form:

• Name
• E-mail
• Your personal message

We require your e-mail-address in order to make reference to your request an to answer it. The personal data we collect via our request form are not shared with third parties.

b. Legal basis

The aforementioned data processing is based on your freely given consent according to Art 6 para 1 lit a GDPR.

Declaration of consent:

By entering my personal data and clicking the button “Send” I consent to the processing of my e-mail-address and of my first and last name and my personal message in order to answer my request. 

I can withdraw my consent to aforementioned processing at all time via e-mail to privacy@formunauts.com or via letter to Theobaldgasse 20/1/7, 1060 Vienna.

c. Processing period

The above-mentioned data will be processed until your request has been finally processed. Afterwards your data will be deleted. We may continue processing your data in case we are legally obligated to do so.

4.5 Formunauts Marketplace “Formunauts One”

a. Type and scope of data processing

Formunauts Marketplace is a platform to connect face-to-face contractors (agencies) and potential clients interested in carrying out a face-to-face campaign. The interested client or the face-to-face contractor may give Formunauts the following information in order get in contact with them:

• Name
• E-mail
• Telephone number
• Personal message
• Position in company
• Company name
• Experience in the industry

b. Legal basis

The aforementioned data processing is due to the existing (pre)contractual relationship based on Art 6 para 1 lit b GDPR.

c. Processing period

These data will be stored for up to 7 years after the (pre)contractual relationship has come to term. Data processing which exceeds the (pre)contractual period is based on Art 6 para 1 lit c and f GDPR. Formunauts’ legitimate interest lies in the necessary organization of its contracts as well as in the reacquisition of customers.

§ 5 Data processing as “processor”

In providing its Services Formunauts my process data on behalf of third parties. If you are an employee or a donor, whose data have been collected or processed through our Services, Formunauts may not be the responsible “data controller” as defined by the GDPR. For further information you should always contact the data controller responsible for the processing of your personal data. Formunauts does not warrant the accuracy of the following information which is provided for pure transparency purposes. As Formunauts processes your data on behalf of a third party your data processing may differ (within the scope of Formunauts’ contract with the data processor) from the information provided below.

5.1. Registration/ user account

If you are using Formunauts App, you must have a user account. Such an account is created either by Formunauts on behalf of the data controller, using your personal data, or by the data controller itself. It is not possible for you to create your own user account. The following data is processed in this case:

• Username
• Email
• Telephone number
• Address

For further information please contact the responsible data controller. If you are not able to identify the data controller responsible for the processing of your personal data we may assist you by contacting privacy@formunauts.com

5.2. Donors, signatories of petitions, interested parties

Your data may have been collected by use of Formunauts App. This Service is being used by one of our clients for a specific processing purpose. Upon the collection of your personal data, you were informed about the identity of the person on whose behalf your data was collected. This person is the responsible data controller. The kinds of collected personal data as well as the purposes of their processing are determined by the data controller. Data which are collected using Formunauts App are stored in Frankfurt, Germany and will be deleted 30 days after our client has retrieved the data form our servers.

For further information please contact the responsible data controller. If you are not able to identify the data controller responsible for the processing of your personal data, we may assist you by contacting privacy@formunauts.com.

§ 6 Disclosure of your personal data

Formunauts will not share or disclose your personal data unless:

• You have given your explicit consent to such disclosure according Art 6 para 1 lit a GDPR
• It is legally permissible and in accordance with Art 6 para 1 lit b GDPR necessary to fulfil our contract with you
• We are in accordance with Art 6 para 1 lit c GDPR legally obligated to disclose your data
• The disclosure of your data is, in accordance with Art 6 para 1 lit f GDPR, justified by legitimate business interest of Formunauts and/or necessary for the defense against and the enforcement of legal claims. However, Formunauts will only disclose your data on such grounds if your right to privacy does not outweigh Formunauts legitimate interests.

The aforementioned does not apply to the transmission of data to “processors” as defined by the GDPR.

We will always provide for adequate technical and organizational measures in order stay compliant with the GDPR.

In case we transfer your data outside of the European Union, we justify such transfers as follows: the European Commission has published an adequacy decision on the recipient country or we have implemented appropriate safeguards as laid out out by Art 46 GDPR. This includes particularly the execution of Standard Contractual Clauses with the data recipient and (if required) the implementation of additional safeguards.

§ 7 Use of cookies

7.1. Type and scope of data processing

We use cookies on our website. Cookies are small files which are sent by us to the browser of your terminal device and stored there as part of your visit to our website. Some functions of our website cannot be offered without the use of technically necessary cookies. Other cookies allow us to perform various analyses. Cookies are, for example, able to recognise the browser you are using when you visit our website again and to transmit various information to us. We can use cookies to make our website more user-friendly and effective, for example, by tracking your use of our website and by determining your preferred settings (e.g., country and language settings). In case third parties use cookies to process information, they will collect the information directly from your browser. Cookies do not cause any damage to your terminal device. They cannot run programmes or contain viruses.

Various types of cookies are used on our website, the type and function of which are explained in more detail below.

Our website uses transient cookies, which are automatically deleted when you close your browser. This type of cookie allows us to collect your session ID. This makes it possible to assign different requests from your browser to a common session and enables us to recognise your terminal device during subsequent visits to the website.

Our website also uses persistent cookies that are stored in your browser for a longer period of time and transmit information to us. The respective storage time differs depending on the cookie. You can delete persistent cookies independently using your browser settings.

a. Required cookies

These cookies are required for technical reasons so that you can visit our website and use the functions we offer. In addition, these cookies contribute to the safe and correct use of our website.

b. Performance cookies

These cookies enable us to analyse website usage and improve the performance and functionality of our website. Information is collected, for example, about how visitors use our website, which pages are most frequently accessed, or whether error messages are displayed on certain pages.

7.2. Legal basis

We will only save cookies to your device if you have given us your consent, meaning this data processing is based on Art 6 para 1 lit a GDPR. The use of required cookies is based on our legitimate interest in the operation and optimization of our website in accordance with Art 6 para 1 lit f GDPR.

7.3. Storage time

As soon as the data transmitted to us via cookies is no longer necessary for the purposes described above, this information will be deleted. Further storage might take place in individual cases if this is required by law.

7.4. Configuration of browser settings

Most browsers are preset to accept cookies by default. However, you can configure your browser so that it only accepts certain cookies or no cookies at all. We would like to point out, however, that if cookies are deactivated on our website by your browser settings, you may no longer be able to use all the functions of our website. You can also use your browser settings to delete cookies already stored in your browser or display the storage time. In addition, it is possible to set your browser so that it notifies you before cookies are stored. Since functions may vary on different browsers, we would ask you to use your browser’s help menu for the configuration of options.

If you would like a comprehensive overview of all third-party access to your Internet browser, we recommend that you install specially developed plugins.

§ 8 Tools for tracking and analysis

8.1. Type and scope of data processing

We use tracking and analysis tools to ensure continuous optimisation and needs-based design of our website. With the aid of tracking measures, it is also possible for us to statistically record visitors’ use of our website and further develop our online offer for you.

Our website uses Matomo, an open-source software for the statistical analysis of visitor traffic. Matomo uses cookies. The information generated by these cookies about your use of our website is stored on the web server. You can prevent the setting of cookies by adjusting the settings on your browser. We would like to point out, however, that in this case you may not be able to use all the functions of this website to their full extent.

Opt-out complete; your visits to this website will not be recorded by the Web Analytics tool. Note that if you clear your cookies, delete the opt-out cookie, or if you change computers or Web browsers, you will need to perform the opt-out procedure again.

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.

You are not opted out. Uncheck this box to opt-out. You are currently opted out. Check this box to opt-in.

The tracking opt-out feature requires cookies to be enabled.

After being processed and before being stored, the IP address is anonymised. However, we want to emphasise that despite the fully activated anonymisation function, total anonymisation cannot be achieved – only pseudonymisation. During use, Matomo creates an internal hash value, which is generated from various factors such as the IP address, resolution, browser, the plugins used, and the operating system. Even with the anonymisation function activated, this heuristic uses the full IP address for internal purposes so, with some effort, it is possible to convert the values back to the IP address and thus reliably determine the other information.

8.2. Legal basis

We will only save cookies to your device and perform the aforementioned data processing if you have given us your consent, meaning this data processing is based on Art 6 para 1 lit a GDPR. You are free to withdraw your consent at any time.

8.3. Processing period

As soon as the data transmitted to us via cookies is no longer necessary for the purposes described above, this information will be deleted. Further storage might take place in individual cases if this is required by law.

§ 9 Hyperlinks

Our website contains hyperlinks to websites of other providers. When you activate these hyperlinks, you will be redirected from our website directly to the other providers’ website. You can recognise this, for example, by the change in the URL. We cannot accept any responsibility for the confidential handling of your data on these third-party websites, as we have no influence on whether these companies comply with data protection regulations. Please inform yourself about the handling of your personal data by these companies directly on their websites.

§ 10 Rights of the data subject

Under the GDPR, you, as the data subject of the processing of personal data, have the following rights:

• Pursuant to Art. 15 GDPR, you can request information about your personal data processed by us. In particular, you can request information about the purposes of the processing; the categories of personal data concerned; the categories of recipients to whom your data have been or will be disclosed; the envisaged period for which your personal data will be stored; the existence of the right to rectification, erasure, restriction of processing, or objection to such processing of your personal data; the existence of the right to lodge a complaint; the source of your data where the personal data is not collected by us; the transfer of your personal data to third countries or international organisations; as well as the existence of automated decision-making, including profiling, and if necessary, meaningful information about the logic involved.
• Pursuant to Art. 16 GDPR, you can request the immediate rectification of inaccurate personal data concerning you or the completion of incomplete personal data stored by us.
• Pursuant to Art. 17 GDPR, you can request the erasure of your personal data stored by us, provided that the processing is not necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation; for reasons of public interest; or for the establishment, exercise, or defence of legal claims.
• Pursuant to Art. 18 GDPR, you can request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful, we no longer need the data and you oppose their erasure because you require them for the establishment, exercise, or defence of legal claims. You are also entitled to the right under Art. 18 GDPR if you have objected to processing pursuant to Art. 21 GDPR.
• Pursuant to Art. 20 GDPR, you can request that the personal data you have provided us with be received in a structured, current, and machine-readable format, or you can request that the data be transmitted to another controller.
• Pursuant to Art 7 para. 3 GDPR, you can withdraw your consent at any time. As a consequence, we will in future no longer be permitted to continue the data processing based on this consent.
• Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your habitual residence or place of work, or our registered office. In Austria, the supervisory authority is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Tel: +43-1-52 152-0, Email: dsb(at)dsb.gv.at, Web: www.dsb.gv.at.
• When processing your personal data on the basis of legitimate interests pursuant to Art. 6 para. 1 lit f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 insofar as there are reasons which arise from your particular situation or if the objection refers to direct marketing. In the case of direct marketing, you have a general right to objection, which we will implement without you needing to specify any particular situation.

§ 11 Right to object

When processing your personal data on the basis of legitimate interests pursuant to Art. 6 para 1 lit f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 insofar as there are reasons which arise from your particular situation or if the objection refers to direct marketing. In the case of direct marketing, you have a general right to objection, which we will implement without you needing to specify any particular situation.

§ 12 Data security and security measures

We are committed to protecting your privacy and treating your personal data confidentially. In order to avoid manipulation, loss, or misuse of your data stored by us, we take extensive technical and organisational security precautions that are regularly reviewed and adapted to technological progress. This includes, among other things, the use of recognised encryption methods (SSL SHA256 CA). However, we would like to point out that due to the structure of the Internet, it is possible that the rules of data protection and the above-mentioned security measures may not be observed by other persons or institutions for which we are not responsible. In particular, unencrypted data – e.g., if this is done by email – can be read by third parties. We have no technical influence on this. It is the responsibility of the user to protect the data provided by him/her against misuse by encryption or in any other way.