Privacy Policy

Privacy Policy

We take the protection of your personal data very seriously. We process your personal data in accordance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

1. Data Controller

Impeto Impact GmbH

Kaiserfeldgasse 19

8010 Graz, Austria

Email:

We have not appointed a Data Protection Officer as we are not legally required to do so under Art. 37 GDPR.

2. General Information on Data Processing

We only process personal data of our users to the extent necessary to provide a functional website and our content and services. Processing is generally only carried out with the user's consent. An exception applies in cases where prior consent cannot be obtained for practical reasons and processing is permitted by law.

The provision of personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide personal data. Failure to provide it may, however, mean that we cannot deliver the service you have requested.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

3. Legal Basis

Where we obtain consent for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis.

For processing necessary for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR serves as the legal basis.

Where processing is necessary for compliance with a legal obligation, Art. 6(1)(c) GDPR serves as the legal basis.

Where processing is necessary for the purposes of our legitimate interests or those of a third party, and those interests are not overridden by the rights of the data subject, Art. 6(1)(f) GDPR serves as the legal basis.

The legal basis for the storage of and access to information on the user's terminal equipment (cookies and similar technologies) is § 165(3) TKG 2021 in conjunction with Art. 6(1)(a) GDPR.

4. Hosting & Server Log Files

This website is built and hosted using the platform of Lovable (Lovable AB, Norra Stationsgatan 61, 113 43 Stockholm, Sweden). Lovable acts as our processor within the meaning of Art. 28 GDPR and engages further infrastructure subprocessors (in particular Cloudflare and Vercel) to deliver the website.

When you access our website, the following data is automatically collected and stored in server log files by the hosting infrastructure: IP address, date and time of the request, requested URL, HTTP status code, referrer URL, user agent (browser and operating system).

Purpose:

ensuring secure and stable operation, diagnosing technical issues, and protection against attacks (e.g. DDoS).

Legal basis:

Art. 6(1)(f) GDPR (legitimate interest in operating a secure and functional website).

Storage period:

server log files are deleted or anonymised after 14 days at the latest, unless longer retention is required as evidence following a security incident.

Transfer to third countries:

As Lovable, Cloudflare and Vercel are organisations with parent entities or infrastructure outside the EU/EEA, data transfers to third countries (in particular the USA) cannot be excluded. Such transfers are based on EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework (Art. 45 GDPR). A data processing agreement pursuant to Art. 28 GDPR has been concluded with Lovable.

Further information is available in the Lovable privacy policy:

5. Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and similar technologies that allow us to analyse the use of our website. The information generated is generally transmitted to a Google server and may be stored there.

IP Anonymisation:

In Google Analytics 4, IP addresses are processed only in shortened form (anonymised) and are not stored.

Transfer to third countries:

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, providing an adequate level of data protection in accordance with Art. 45 GDPR. In addition, EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR have been concluded.

Storage period:

The data we collect via Google Analytics is retained for a maximum of 14 months and then automatically deleted.

Legal basis:

The use of Google Analytics is based on your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via our

cookie settings

.

Data Processing Agreement:

We have concluded a data processing agreement with Google in accordance with Art. 28 GDPR.

Further information on the handling of user data by Google can be found in the Google privacy policy:

Browser opt-out:

You can additionally prevent the collection of data by Google Analytics by installing the browser add-on available at:

6. Cookies

Our website uses cookies. Cookies that are not strictly necessary for the operation of the website are only set with your prior consent. For detailed information on the cookies we use, including their purpose and storage period, please see our

Cookie Policy

.

7. Contact via Email

If you contact us by email, the data you provide (in particular your email address, name and any other information contained in your message) will be processed by us solely for the purpose of handling your enquiry.

Legal basis:

Art. 6(1)(b) GDPR if your enquiry relates to the conclusion or performance of a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Storage period:

Data is deleted as soon as it is no longer required for the purpose of processing your request, at the latest after 3 years, unless statutory retention obligations (e.g. § 132 BAO – 7 years for tax-relevant correspondence) require longer storage.

8. Recipients of Personal Data

Within our company, only those persons and departments receive your data that need it to fulfil contractual and legal obligations. Processors engaged by us (in particular hosting and analytics providers) may also receive data for these purposes. They are contractually bound to handle your data in accordance with Art. 28 GDPR.

Personal data is only transferred to third countries (outside the EU/EEA) on the basis of an adequacy decision (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR, in particular EU Standard Contractual Clauses).

9. Your Rights

You have the following rights with respect to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise these rights, please contact us at

.

Competent supervisory authority in Austria: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna,

10. Data Security

We use appropriate technical and organisational measures (TOMs) in accordance with Art. 32 GDPR to protect your personal data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Data transfer between your browser and our website is encrypted using TLS (HTTPS).

11. Updates to this Privacy Policy

This privacy policy is valid as of April 2026. Due to further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this policy. The current version is always available on this page.