Privacy Policy

This Privacy Policy informs you, in accordance with Art. 13 and 14 GDPR and the Austrian Datenschutzgesetz (DSG, Austrian Data Protection Act), about which personal data we process when you visit this website or contact us with an inquiry, for what purpose, on what legal basis and for how long.

1. Controller

Controller

Ing. Simon Gorski, MA
SG5 Digital Solutions
Währinger Strasse 80-82/1, 1180 Vienna, Austria

Email

[email protected] (opens your email app)

Phone

+43 677 62 999 140

No data protection officer has been appointed, as there is no legal obligation to do so. Please direct data protection inquiries to the email address stated above.

2. Principles & Legal Bases

We process personal data only to the extent necessary for operating the website, responding to your inquiries and providing our services. Depending on the case, the legal bases are:

• Art. 6(1)(a) GDPR — your consent, for example when playing a YouTube video.
• Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures, for example for inquiries and trial access.
• Art. 6(1)(f) GDPR — our legitimate interest in a secure, functioning web presence and in responding to inquiries.
• Art. 6(1)(c) GDPR — statutory retention obligations, for example under the Bundesabgabenordnung (BAO, Austrian Federal Fiscal Code) and the UGB (Austrian Commercial Code).

3. Hosting, Cloudflare & Server Log Files

This website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centers within the European Union. Hetzner is bound by a data processing agreement pursuant to Art. 28 GDPR. When you access the website, the web server automatically records the following data in log files:

• IP address of the requesting device
• date and time of access
• page or file accessed, amount of data transferred and HTTP status code
• browser type, operating system and referrer URL

The purpose is to ensure operation, defend against attacks and analyze errors. The legal basis is Art. 6(1)(f) GDPR. The log files are automatically deleted after 30 days unless a security-relevant incident requires longer retention.

Cloudflare (content delivery network, DNS & security)

We use the Cloudflare service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (in the EU: Cloudflare Germany GmbH, Rosental 7, 80331 Munich). Cloudflare acts as a reverse proxy between your browser and our server: every request to this website passes through Cloudflare's network, which encrypts the connection, caches content, blocks attacks (e.g. DDoS) and sets the security headers. In doing so, Cloudflare necessarily processes your IP address and the connection data listed under server log files. Cloudflare sets no cookies in normal operation; only during a security check may a technically necessary cookie be set temporarily. Cloudflare also obfuscates the email addresses shown on this website against automated harvesting (email obfuscation via a script served by Cloudflare itself).

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, fast and reliable operation). According to Cloudflare, data of visitors from Europe is processed in data centers within the EU; a transfer to the USA cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the Standard Contractual Clauses apply (see section 12). Further information: cloudflare.com/privacypolicy.

4. Contact and Inquiry Forms

This website contains several forms. In each case, we process only the data you enter there:

Contact form

Name, email address, industry (optional), message

InsightHub trial environment

Name, company (optional), email address, shop or website URL, shop platform or type of business, inventory management or booking system (optional)

WP PMS demo request

Name, business (optional), email address, website (optional), number of rooms (optional), message (optional)

Test call with the AI phone assistant ("We call you")

Phone number, consent, time, page requested from; during the call, the details you give the assistant (e.g. name, company, request)

The purpose is to process your inquiry, set up trial access and handle any follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding). The data is transmitted TLS-encrypted.

The data is deleted once your inquiry has been fully processed and no contract is concluded — at the latest after twelve months. If a contract is concluded, we retain the data within the statutory retention periods (generally seven years pursuant to § 132 BAO). The data is not passed on to third parties for their own purposes. To deliver form messages to our mailbox we use the email delivery service Postmark of ActiveCampaign, LLC, 1 N Dearborn St, 5th Floor, Chicago, IL 60602, USA (processor, certified under the EU-US Data Privacy Framework, with Standard Contractual Clauses in addition). Postmark stores the transmitted message content for up to 45 days for delivery and verification purposes. The messages are then received and stored in our mailbox with an email hosting provider established in Germany.

Test call with the AI phone assistant. On the AI phone assistant pages you can leave your phone number; our assistant then calls you once so you can try it out. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting the form and can withdraw at any time with effect for the future (an email is sufficient). The call is made through our own InsightHub platform: the telephone connection is provided by Twilio Ireland Ltd., 3 Dublin Landings, Dublin 1, Ireland; speech recognition by Deepgram, Inc., San Francisco, USA (processed in the EU region without storage at the provider; standard contractual clauses pursuant to Art. 46(2)(c) GDPR), speech output by Microsoft Azure AI Speech of Microsoft Ireland Operations Ltd., Dublin (EU region). The call is not recorded as audio; we store your phone number, time and duration, and a text transcript of the conversation, which you can decline at the start of the call. We keep your number and the details given during the call as an inquiry (lead) so we can get back to you. The test call is limited to phone numbers in Austria, Germany and Switzerland and to a few calls per number and day. We delete the data like other inquiries without a contract, at the latest after twelve months.

5. Accessibility Scanner and Newsletter

With our free Accessibility Scanner (www.sg5.biz/en/tools/accessibility-scanner/) you can have a website checked for accessibility. We send you the report by email. In doing so we process:

Your details

email address, address of the scanned website, selected options (e.g. mobile view), language

Proof of consent

time, IP address and version of the consent text

Access credentials (optional)

user name, password and login address of a website in maintenance mode, or HTTP credentials — only if you enter them

The purpose is to carry out the scan, to send you the report and — as confirmed when submitting — to send you occasional emails with accessibility tips and information about products and services of SG5 Digital Solutions (newsletter). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by email to [email protected]. The lawfulness of processing carried out before the withdrawal remains unaffected.

The scan runs on our own server at Hetzner Online GmbH in Germany. The scanner opens the publicly accessible pages of the given website the way a visitor would. The report can be accessed for 30 days via a randomly generated link that cannot be guessed; anyone who knows this link can view the report. Optional access credentials are stored encrypted until the scan starts, used exclusively for that one scan and deleted afterwards. They appear neither in the report nor in any log.

Your email address, the scanned website and the proof of consent are stored in our own customer management system InsightHub, which we also operate on our servers at Hetzner in Germany. We send the report via Postmark (see section 4). To prevent abuse we limit the number of scans per IP address and day; for this, a hash of the IP address with time stamps is stored for a short time.

6. Contact by Email, Phone and WhatsApp

If you contact us by email or phone, we process the information you provide in order to handle your inquiry (Art. 6(1)(b) and (f) GDPR). The following additionally applies to contact via WhatsApp: WhatsApp is a service of WhatsApp Ireland Limited (Meta Platforms), 4 Grand Canal Square, Dublin 2, Ireland. When messages are exchanged, WhatsApp receives metadata such as your phone number and the time of communication; message content is end-to-end encrypted. A transfer to the USA is possible; Meta is certified under the EU-US Data Privacy Framework. Use WhatsApp only if you agree to this — alternatively, you can reach us at any time by email or phone. Information: whatsapp.com/legal/privacy-policy-eea.

7. Cookies & Local Storage

This website does not use tracking, analytics or marketing cookies and does not use any web analytics services. Only technically necessary storage operations in the browser are used (for example to play embedded videos after you have agreed), for which no consent is required (§ 165(3) TKG 2021, Austrian Telecommunications Act). Should we use analytics or marketing cookies in the future, this will only happen after your express consent via a consent banner.

For the Accessibility Scanner (see section 5) the following also applies: if you tick “Remember my scans in this browser”, we store a random identifier (sg5_a11y_vid) in your browser's local storage so that later scans of the same website can be compared with your earlier ones. The legal basis is your consent (§ 165(3) TKG 2021, Art. 6(1)(a) GDPR). Without the tick no identifier is stored; an existing one is deleted the next time you submit without the tick. While a scan is running we store its identifier in the browser session (sg5_a11y_active), which is technically necessary and disappears when you close the tab. For SG5 staff, a technically necessary cookie or local storage entry (sg5_a11y_key) unlocks internal access to the scanner.

Also in local storage: your choice regarding YouTube videos (sg5_yt, see section 9) and — only if you open a personal demo page through a demo link with a code — that demo code (ih_c), so the demo also appears on further pages; an expired code is deleted automatically. Neither entry contains personal data, and neither is sent to us.

8. Fonts

The fonts used on this website (Montserrat, Roboto) are served locally from our own server. When the fonts are loaded, no connection is established to servers of Google or other third parties, and no data is transmitted to third parties.

9. YouTube Videos

Videos from YouTube are embedded on the product pages. We use the privacy-enhanced mode (youtube-nocookie.com) and load videos only when you click “Play video”. Until then, no connection to YouTube is established. By clicking, you consent to a connection being established to servers of Google Ireland Limited (Art. 6(1)(a) GDPR). In the process, your IP address and browser information are transmitted; YouTube may set cookies and, if you are signed in to Google, associate the playback with your account. A transfer to the USA is possible (EU-US Data Privacy Framework). You can withdraw your consent at any time by not playing any further videos. After the first playback your browser remembers this in a local storage entry (“sg5_yt”, no personal data, never sent to us); the notices on the video thumbnails are then no longer shown. Each video is still loaded only when you click it. You can delete the entry via your browser’s stored site data or with the button below. Information: policies.google.com/privacy.

Withdraw YouTube consent

10. External Links

This website links to external offerings, such as those of the Wirtschaftskammer Österreich (Austrian Economic Chamber), the Rechtsinformationssystem des Bundes (Austrian Federal Legal Information System) and the European Commission, as well as to our demo and help pages. When you follow these links, the privacy policies of the respective provider apply. Merely visiting our website does not transmit any data to these providers.

11. Recipients & Processors

We disclose personal data only to the following categories of recipients, in each case bound by data processing agreements pursuant to Art. 28 GDPR or on the basis of legal requirements:

• Hetzner Online GmbH, Gunzenhausen, Germany — hosting (data centers in the EU)
• Cloudflare, Inc., San Francisco, USA — content delivery network, DNS and security (see section 3)
• ActiveCampaign, LLC (Postmark), Chicago, USA — delivery of form messages and scanner reports (see sections 4 and 5)
• Email hosting provider (established in Germany) — our mailbox
• Google Ireland Limited — only when YouTube videos are played
• WhatsApp Ireland Limited — only if you contact us via WhatsApp
• Twilio Ireland Ltd., Dublin, Ireland — telephone connection for the test call with the AI phone assistant (see section 4)
• Deepgram, Inc., San Francisco, USA — speech recognition for the test call, EU region (see section 4)
• Microsoft Ireland Operations Ltd., Dublin, Ireland — speech output (Azure AI Speech) for the test call, EU region (see section 4)
• Tax advisors, authorities and courts, where required by law

Data is neither sold nor disclosed for advertising purposes.

12. Transfers to Third Countries

Personal data is transferred to countries outside the EU or the EEA only in the cases described in sections 3, 4, 5 and 8, to Cloudflare, ActiveCampaign (Postmark), Meta and Google — all four certified under the EU-US Data Privacy Framework, with the European Commission's Standard Contractual Clauses applying in addition (Art. 46(2)(c) GDPR) — and, for the test call with the AI phone assistant, to Deepgram, Inc. (US company, processing in the EU region) on the basis of the Standard Contractual Clauses; Twilio and Microsoft process telephony and speech output in the EU region, a transfer to the USA is possible on the basis of the Standard Contractual Clauses.

13. Retention Periods

Server log files

30 days

Accessibility Scanner: reports and scan jobs

30 days

Accessibility Scanner: email address and proof of consent

until consent is withdrawn; the proof of consent thereafter for up to three years

Inquiries without a contract

until fully processed, at the latest twelve months

Test call with the AI phone assistant: phone number, lead and transcript

like inquiries without a contract, at the latest twelve months; immediately upon withdrawal of consent

Contract and invoice data

seven years pursuant to § 132 BAO and § 212 UGB

Email correspondence

as long as required for the business relationship, thereafter within the statutory retention periods

14. Data Security

This website is delivered TLS-encrypted (https). We take appropriate technical and organizational measures to protect your data against loss, misuse and unauthorized access, and continuously adapt them to the state of the art.

15. Your Rights

You have the following rights in relation to us:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, contact [email protected] (opens your email app). If you believe that the processing of your data violates data protection law, you may lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Vienna, [email protected] (opens your email app), www.dsb.gv.at.

16. No Automated Decision-Making

We do not use automated individual decision-making or profiling within the meaning of Art. 22 GDPR. The AI products described on this website (InsightHub) process data exclusively on behalf of our customers; they are not used for your visit to this website.

17. Customers of InsightHub and WP PMS

For customers of our products, the respective contractual terms and a data processing agreement pursuant to Art. 28 GDPR apply in addition. The data processing agreement for InsightHub is available at www.sg5.biz/products/insighthub/legal/dpa/. For the use of WP PMS on our customers' websites, the respective operator is the controller responsible under data protection law. For the InsightHub platform, the InsightHub privacy policy, the terms of use and the data processing agreement apply in addition.

18. Changes to This Policy

We will update this Privacy Policy if the legal situation or our offering changes. The current version can always be found on this page.

Last updated: October 2026

← Back to homepage