Privacy Policy

1. Data Controller

The data controller responsible for this website is:

2. What Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, and password (hashed) when you create an account
• Payment data: payment method details processed securely through Stripe (we do not store your full card number)
• Usage data: pages visited, training progress, quiz results, and course completion status
• Technical data: IP address, browser type, device type, and operating system, collected automatically when you visit the website
• Communication data: messages you send via the contact form, including your name, email, and message content

3. How We Use Your Data

We process your personal data for the following purposes:

• To provide and maintain your training account and course access
• To process payments and issue invoices
• To track your training progress and issue certificates
• To respond to your enquiries and provide customer support
• To improve our website and training products
• To comply with legal obligations (e.g. tax records)

4. Legal Basis for Processing (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): processing necessary to deliver the training services you purchased
• Legitimate interest (Art. 6(1)(f)): website analytics and service improvement
• Consent (Art. 6(1)(a)): marketing cookies and optional newsletter communications
• Legal obligation (Art. 6(1)(c)): tax and accounting records as required by Austrian law

5. Third-Party Service Providers

We share data with the following processors, all of whom are contractually bound to protect your data:

• Stripe (payment processing, USA) for secure credit card transactions
• Supabase (authentication and database, USA/EU) for account management and training progress
• Vercel (hosting, USA) for website delivery and performance
• Google Analytics (analytics, USA) for understanding website usage (with your consent)
• Meta / Facebook Pixel (advertising, Meta Platforms Ireland Limited, Dublin, Ireland) for measuring advertising effectiveness and remarketing (with your consent). Privacy policy
• Microsoft Clarity (analytics, Microsoft Ireland Operations Limited, Dublin, Ireland) for session recordings, heatmaps, and behaviour analysis to improve usability (with your consent). Privacy policy

Where data is transferred outside the EEA, appropriate safeguards are in place (e.g. EU Standard Contractual Clauses or adequacy decisions).

6. Data Retention

We retain your personal data only for as long as necessary for the purposes described above:

• Account and training data: for the duration of your account, plus 30 days after deletion request
• Payment and invoice records: 7 years (Austrian tax law requirement)
• Analytics data: 26 months
• Contact form messages: 12 months

7. Embedded Media and Social Platforms

Our website embeds content from third-party platforms. When you visit a page containing embedded content, data (including your IP address, browser data, date, time, and cookies) may be transmitted to the respective provider and stored by them.

• Vimeo (Vimeo Inc., 555 West 18th Street, New York, USA) for training video playback. Privacy policy
• YouTube / Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for embedded videos. Privacy policy
• Instagram / Meta (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) for embedded social content. Privacy policy
• Facebook / Meta for social sharing functions. Privacy policy

If you are logged into any of these platforms while visiting our website, your account may be associated with the data transmitted. We have no control over data collected directly by these third parties.

8. Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies to analyse how visitors use our website.

IP anonymisation is active on this website, meaning your IP address is shortened within EU/EEA member states before transmission. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.

You can prevent Google Analytics from collecting your data by:

• Declining analytics cookies via our cookie consent banner
• Adjusting your browser settings to block cookies
• Installing the Google Analytics opt-out browser plugin

For more information, see Google Analytics and data protection.

9. Facebook Pixel (Meta)

This website uses the Facebook Pixel, a service provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland). The Facebook Pixel places cookies on your device to track conversions from Facebook ads, build targeted audiences for future ads, and remarket to people who have previously visited this website.

When you visit our website, the Pixel collects data including your IP address, browser information, pages visited, and actions taken (such as purchases). This data is transmitted to Meta and may be linked to your Facebook account if you are logged in.

The Facebook Pixel is only activated with your explicit consent via our cookie consent banner. You can also manage your ad preferences directly with Meta at facebook.com/adpreferences.

10. Microsoft Clarity

This website uses Microsoft Clarity, a behaviour analytics service provided by Microsoft Ireland Operations Limited (South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity captures how visitors use our website through session recordings and heatmaps.

Clarity collects data including mouse movements, clicks, scrolling behaviour, and page content. This data is anonymised and does not include sensitive input fields (such as passwords or payment details). Clarity may also share data with Microsoft Advertising for product improvement purposes.

Microsoft Clarity is only activated with your explicit consent via our cookie consent banner. For more information, see the Clarity cookie consent documentation.

11. International Data Transfers

Some of our third-party service providers process data in the United States and other countries outside the European Economic Area. Following the invalidation of the EU-US Privacy Shield by the European Court of Justice, there is a theoretical risk that US authorities may access data stored in the United States.

To ensure adequate protection of your data, all providers processing data outside the EEA have entered into EU Standard Contractual Clauses (SCCs) with us, or operate under an EU adequacy decision (such as the EU-US Data Privacy Framework where applicable).

By accepting non-essential cookies via our consent banner, you also consent to the associated data transfers to third countries. You may revoke this consent at any time, though some website functionality may become limited.

12. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Object to processing based on legitimate interest
• Data portability to receive your data in a structured, machine-readable format
• Withdraw consent at any time for consent-based processing

To exercise any of these rights, email office@orloffs.com. We will respond within 30 days.

13. Cookies

Our website uses cookies. For detailed information about which cookies we use and how to manage them, please see our Cookie Policy.

Technically necessary cookies are placed automatically. All other cookies require your explicit consent via our cookie consent banner.

14. Data Security

We use encryption during data transmission (TLS/SSL) and maintain suitable technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration. Access to personal data is restricted to authorised personnel only.

15. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Austrian Data Protection Authority: