Privacy / Datenschutz
Keep the data route explicit.
Controller
WebArs e.U., owner Teodor Turlea, Karl-Popper-Straße 5/130, 1100 Vienna, Austria. Contact: turlea@webars.at.
Setup Pass and brief
Selections in the Setup Pass and brief builder are processed locally in the browser. They are not automatically stored or transmitted. If you continue to the request page, selected country, modules, goal, language and timing are carried there as visible URL parameters.
Contact request: data, purpose and legal basis
Only deliberate submission sends the entered data through this domain. Required fields are name, email address, company, first market, and the description of the offer and intended audience. The selected starting point is transmitted with the request; information about the existing setup and URL-based brief context is optional. These data are used to review, route and answer the request and to take steps at your request before a possible contract, under Article 6(1)(b) GDPR. There is no legal or contractual obligation to provide the data, but without the required fields the request cannot be processed through the form.
Recipients and CRM processing
The form endpoint sends the request to the configured WebArs CRM at crm.webars.at. The CRM records the request, its source, submission time and a technical submission ID so authorised WebArs personnel can review, assign and answer it. Hosting and other technical service providers may receive data only where this is necessary to operate and secure the request route and act under the controller's instructions or another applicable legal basis. No form data are sent to the CRM before the submit button is deliberately activated.
Hosting, connection data and international processing
This website and its server-side form route are hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Vercel processes technically necessary request, IP, device, diagnostic and log data to deliver, maintain and secure the service. Vercel states that customer data may be processed in the United States and other locations used by Vercel or its subprocessors; applicable contractual transfer mechanisms are described in the Vercel Data Processing Addendum. Further information is available in Vercel's Privacy Notice and Data Processing Addendum.
Abuse protection
A hidden form field and an IP-based limit of five attempts per ten minutes protect the endpoint against automated abuse. The rate-limit state is held only in volatile process memory and entries outside the ten-minute window are no longer used.
Storage period and criteria
Request and CRM data are retained while the request is being reviewed and answered and, where relevant, while pre-contractual steps are ongoing. If no contract results, the data are deleted when they are no longer needed for the request unless legal documentation or retention duties, applicable limitation periods, or the establishment, exercise or defence of legal claims require longer storage. If a contract results, relevant data may be transferred to the customer record and retained for the applicable statutory commercial and tax periods. The decisive criteria are therefore the status of the request, whether a contract results, statutory duties and the need to handle or defend claims. Vercel applies its own contractual deletion and retention rules to hosting and service-generated data.
Consent-based first-party statistics
Statistical first-party measurement starts only after you expressly allow it in the displayed notice. The stored categories are the visited page, external referrer domain or “direct”, country, device class and a newly derived visitor-day bucket. The browser keeps your choice and – only after consent – a random identifier in local storage. The server-side relay uses that identifier only to calculate the daily bucket; it is not stored as an analytics record.
We do not store IP addresses, full user-agent strings, query strings, form or brief data, CRM IDs, or links to individuals or enquiries. No advertising profile is created. You can withdraw consent for the future through “Statistics settings”; the local identifier is then removed. An active Do Not Track or Global Privacy Control signal prevents measurement. Where the Swiss Federal Act on Data Protection applies, the same data-minimisation limits are used; this statement is not a legal assessment of an individual case.
Automated decisions
The request is not subject to solely automated decision-making with legal or similarly significant effects.
Your rights
Subject to the legal requirements, you may request access, rectification, erasure, restriction of processing and data portability, and you may object where processing is based on legitimate interests. You may also lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, at dsb@dsb.gv.at. To exercise rights concerning this website or CRM request, contact turlea@webars.at.