1. Privacy at a glance
Updated: 29 October 2026. This notice describes the new xhauer.com website and the information, download and registration pages migrated to it. Separately operated offerings on de.xhauer.com, journal.xhauer.com and linked provider websites also have their own notices.
Controller
XHAUER Media GmbH, Stephansplatz 8/20, 1010 Vienna, Austria. Contact for privacy questions and data subject rights: team@xhauer.com.
Current operation without a prior consent request
The analytics and advertising services described in section 6 load automatically on the public website. There is currently no cookie consent banner or choice before they load. This website does not currently obtain consent for these services. Simply visiting or continuing to use the website does not constitute consent.
The map, Google reviews via Trustindex and embedded videos also load without an additional approval step. A connection to the provider may occur on page load or when a section loads automatically, before a video is played. Videos do not automatically start with sound.
This description of current operation does not replace legally required consent. Non-essential access to terminal equipment generally requires prior consent under section 165(3) of the Austrian Telecommunications Act 2021. A privacy notice alone does not obtain that consent. See the Austrian Data Protection Authority's cookie guidance.
Our analytics and advertising tags do not run in the password-protected development preview or CMS administration. External content such as maps, videos and reviews may also load in the preview.
2. Hosting and technical delivery
The new website, Payload CMS and PostgreSQL database run through Elestio. The contracting entity is ELESTIO LIMITED, 29 Merrion Square, Dublin 2, D02 RW64, Ireland. CMS media uses S3-compatible Elestio Object Storage; the configured storage location is Frankfurt. Fonts and our own design assets are served locally through the website, without a browser request to Google Fonts.
Delivery and security may involve server logs containing IP addresses, timestamps, requested addresses, status codes, browser information and technical errors. Their purpose is reliable, secure operation under Article 6(1)(f) GDPR. Logs and backups are retained only as needed for operation, security, recovery or statutory obligations.
The existing Raidboxes WordPress installation remains available during migration for backup and recovery. The new website does not currently include Matomo; this does not delete existing historical Matomo data.
Information: Elestio privacy, Elestio data processing agreement, Raidboxes privacy.
3. General Information and Mandatory Information
International transfers on this website
International providers may process data outside the EEA and associate it with provider accounts. The linked provider notices explain applicable transfer mechanisms, recipients and retention rules. This notice does not assert an unverified certification, contract or exact retention period. A transfer mechanism does not replace consent required for tracking.
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.
Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.
Information about the controller
The controller responsible for data processing on this website is:
XHAUER Media GmbH Stephansplatz 8/20 1010 Vienna, Austria Email: team@xhauer.com
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).
We reply on working days between 10 am and 5 pm within 60 minutes.
Storage period
Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for erasure or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these reasons cease to apply.
Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.
Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)
IF THE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).
Right to lodge a complaint with the competent supervisory authority
In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from „http://“ to „https://“ and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Encrypted payment transactions on this website
If, after the conclusion of a contract subject to a fee, there is an obligation to provide us with your payment data (e.g. account number for direct debit authorisation), this data is required for payment processing.
Payment transactions using common means of payment (Visa/MasterCard, direct debit) are carried out exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection by the fact that the address line of the browser changes from „http://“ to „https://“ and by the lock symbol in your browser line.
With encrypted communication, the payment data you transmit to us cannot be read by third parties.
Information, erasure and rectification
Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to rectification or erasure of this data. You can contact us at any time regarding this and any other questions on the subject of personal data.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time. The right to restriction of processing exists in the following cases:
- If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
- If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure.
- If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.
- If you have lodged an objection pursuant to Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
Objection to advertising emails
We hereby object to the use of contact data published as part of the legal notice (imprint) obligation for sending unsolicited advertising and information material. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example through spam emails.
4. Cookies, forms and contact
Cookies and similar storage
Cookies and similar technologies may recognise a browser, attribute advertising contacts, analyse use and deliver external content. As described in section 1, advertising and analytics tags load without a prior choice. This new instance does not use Borlabs Cookie and currently has neither a Borlabs consent log nor a working cookie preference panel.
CMS sign-in uses essential session functions. On some migrated offer pages, the browser also stores when a notice was shown so that it does not appear on every visit. That setting is not tracking consent.
Downloads, newsletters and registration
When you submit a form, we process its stated fields, such as name and email address, the selected resource, source page and campaign parameters. Migrated download and registration forms send these details through our server to the existing Mailchimp audience, including tags and interest groups corresponding to the selection. This enables delivery of requested resources and the messages described in the individual form. Newsletter consent and unsubscribe options are separate from cookie consent.
To limit abuse, short-lived cryptographically derived counters are stored for IP and email addresses. These counters contain no clear-text addresses and are removed after their time window expires. This protects the forms under Article 6(1)(f) GDPR.
We process information provided by email or telephone to handle your enquiry. Depending on its purpose, this is for steps before a contract or its performance under Article 6(1)(b) GDPR, or our legitimate interest in answering enquiries under Article 6(1)(f) GDPR.
5. Social media and external links
Social media icons in the navigation, team section and footer are normal links. Following a link opens the external website; the icons themselves do not embed a social media feed. Separately described advertising pixels and tags still load automatically.
When visiting external offerings such as OnePage, our journal, Google Drive, Calendly, Webinaris or Digistore24, the destination's privacy information also applies. Opening a new browser tab does not prevent processing by the destination.
6. Analytics, measurement and advertising
Processing and current loading behaviour
We use the following existing measurement and advertising integrations to analyse page views, reach, interactions, campaign attribution and advertising results, and to support audiences and remarketing. Data may include IP addresses, device and browser details, page addresses, referrers, timestamps, cookie and advertising identifiers and usage events. Providers may associate this data with existing accounts or visits to other websites.
These integrations currently load automatically without a prior consent request. Non-essential device access and associated processing generally require consent under section 165(3) of the Austrian Telecommunications Act 2021 and Article 6(1)(a) GDPR. Such consent is not currently obtained here. We do not claim another blanket legal basis for all tracking.
Google Tag Manager, Google Analytics and Google Ads
The existing Google Tag Manager loads tags and triggers configured in its published container, including Google Analytics 4 usage statistics and Google Ads conversion measurement and remarketing. Depending on the trigger, measured interactions include page views, telephone and consultation links and existing thank-you pages. Recipients include Google entities, particularly Google Ireland Limited and Google LLC. Google privacy, Google advertising settings.
Meta Pixel and Conversions API
The Meta Pixel records page views and form, download, scroll and time-on-page events. These events are also sent to Meta from our server with a shared event identifier to associate browser and server events and avoid double counting. Transmitted data may include IP address, browser identifier, page address, timestamp and existing _fbp and _fbc Meta cookie identifiers. The new server integration does not send form contents such as names or email addresses to Meta's server endpoint. Recipients include Meta entities, particularly Meta Platforms Ireland Limited and Meta Platforms, Inc. Meta privacy.
LinkedIn Insight Tag
The existing LinkedIn Insight Tag loads through Tag Manager. It enables attribution of visits and defined conversions to LinkedIn advertising, audience analysis and remarketing. LinkedIn may associate this data with existing member accounts. LinkedIn privacy, LinkedIn cookie policy.
TikTok Pixel
The existing TikTok Pixel measures page visits, advertising performance and audiences. Browser, device, cookie and campaign identifiers may be transmitted to TikTok. TikTok privacy.
Microsoft Clarity
Clarity loads through the existing Tag Manager and may analyse interactions, scrolling, clicks and session behaviour to improve the website. Its scope also depends on provider account configuration and regional restrictions. Microsoft privacy.
Reddit Pixel
The published Tag Manager container includes the Reddit Pixel for advertising measurement, attribution and audiences. It may send online identifiers and usage information to Reddit. Reddit privacy.
Leadfeeder / Dealfront
The existing Leadfeeder tracker supports identification of visiting companies and analysis of company visits and marketing activity. It processes information including IP addresses, visited pages and technical usage data and may combine it with business information. Leadfeeder privacy.
Matomo currently not included
This new website does not currently load Matomo or send it new measurement events. Historical statistics remain in the previous installation.
Retention and available controls
Provider retention and attribution depend on account settings, cookie lifetimes and the linked notices; there is no single retention period for every service. Browsers can block and delete cookies, and providers offer advertising and privacy controls. These settings may technically limit transfers but do not replace a consent mechanism on our website. Questions, objections and deletion requests can be sent to team@xhauer.com.
7. Newsletter
Newsletter data
If you would like to receive the newsletter offered on the website, we need an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. No further data is collected, or only on a voluntary basis. To handle the newsletter, we use newsletter service providers, which are described below.
MailChimp
This website uses the services of MailChimp to send newsletters. The provider is The Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.
MailChimp is a service that can be used, among other things, to organise and analyse the sending of newsletters. If you enter data for the purpose of receiving the newsletter (e.g. email address), this data is stored on MailChimp’s servers in the USA.
With the help of MailChimp, we can analyse our newsletter campaigns. When you open an email sent with MailChimp, a file contained in the email (a so-called web beacon) connects to MailChimp’s servers in the USA. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked. Technical information is also recorded (e.g. time of access, IP address, browser type and operating system). This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients.
If you do not want any analysis by MailChimp, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message.
The data processing is based on your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by unsubscribing from the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.
The data you provide to us for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe. Data stored by us for other purposes remains unaffected.
Data transfers to the USA are based on the Standard Contractual Clauses of the EU Commission. Details can be found here: https://mailchimp.com/eu-us-data-transfer-statement/ and https://mailchimp.com/legal/data-processing-addendum/#Annex_C_-_Standard_Contractual_Clauses.
After you have been removed from the newsletter distribution list, your email address may be stored by us or the newsletter service provider in a blacklist in order to prevent future mailings. The data from the blacklist is only used for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.
For more details, please refer to MailChimp’s privacy provisions at: https://mailchimp.com/legal/terms/.
Data processing agreement
We have concluded a data processing agreement (DPA) with the above-mentioned provider. This is a contract required by data protection law which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
8. Automatically loaded content and external tools
OpenStreetMap map
The footer map loads directly from OpenStreetMap. The provider receives information including IP address, browser details and the map request. The map shows our business address; this website does not request access to your device location for it. OpenStreetMap privacy.
Google reviews through Trustindex
The review widget loads automatically through Trustindex. IP addresses, browser information and other usage data needed for the widget may be transmitted to Trustindex and resource providers. Displayed reviews originate from Google; we do not make our own Google Places API request to display them. The provider is Trustindex Ltd., Hungary. Trustindex privacy.
Vimeo and YouTube
Embedded video players load automatically, potentially as their section approaches the viewport on longer pages. Loading the player already connects to Vimeo or YouTube/Google and may transmit IP addresses, browser details, referrers and identifiers. The Vimeo player for our customer interviews uses dnt=1; this does not prevent the technical connection to the provider. Playback still requires an intentional interaction with the player. Vimeo privacy, Google privacy for YouTube.
Other forms and linked offerings
Migrated appointment, contact and webinar pages may contain Calendly, Pipedrive and Webinaris forms. These separate forms open using their load control. The provider processes information subsequently entered there. Loading one form is not general consent to all advertising tags on this website.
The absence of a prior consent request described in section 1 also applies to automatically loaded maps, reviews and videos. Provider notices explain their further processing; referencing them does not mean consent has been obtained.
9. Online Marketing and Affiliate Programmes
The following information concerns the separate offerings and services actually used. It does not mean that all listed services load when the homepage is visited. References to consent in those separate workflows do not describe a cookie consent request operating on this website.
We do not use the following programmes on all of our web pages. Some tools are only used on certain pages. You will be asked for your consent separately in each case and can accept or decline the use of the respective tools.
Affiliate programmes on this website
The website operator participates in affiliate partner programmes. If you click on an advertisement on our website that participates in the affiliate programme and then carry out a transaction (e.g. a purchase), we receive a commission from our affiliate partners. For this, it is necessary that our affiliate partners can identify you and trace that you reached the respective product via the advertisement placed on our site and carried out the predefined transaction. For this purpose, our affiliate partners use cookies or comparable recognition technologies (e.g. device fingerprinting).
The data is stored and analysed on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the correct calculation of its affiliate commission. If corresponding consent has been requested (e.g. consent to the storage of cookies), the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.
We participate in the following affiliate programmes:
Amazon Associates programme
The provider is Amazon Europe Core S.à.r.l. For details, please refer to Amazon’s privacy policy at: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010.
10. eCommerce and Payment Providers
The following information concerns the separate offerings and services actually used. It does not mean that all listed services load when the homepage is visited. References to consent in those separate workflows do not describe a cookie consent request operating on this website.
We do not use the following providers on all of our web pages. Some tools are only used on certain pages. You will be asked for your consent separately in each case and can accept or decline the use of the respective tools.
Payment services
We integrate payment services from third-party companies on our website. When you make a purchase from us, your payment data (e.g. name, payment amount, bank details, credit card number) is processed by the payment service provider for the purpose of payment processing. The respective contractual and data protection provisions of the respective providers apply to these transactions. The payment service providers are used on the basis of Art. 6(1)(b) GDPR (contract processing) and in the interest of a payment process that is as smooth, convenient and secure as possible (Art. 6(1)(f) GDPR). Insofar as your consent is requested for certain actions, Art. 6(1)(a) GDPR is the legal basis for the data processing; consent can be withdrawn at any time with effect for the future.
We use the following payment services / payment service providers on this website:
CopeCart
The provider of this payment service is CopeCart GmbH, Ufnaustraße 10, 10553 Berlin, Germany (hereinafter „CopeCart“). For details, please refer to CopeCart’s privacy policy: https://www.copecart.com/datenschutz/.
Digistore24
Some of our products, services and content are offered by Digistore24 as a reseller. The provider and contractual partner is Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany. Digistore24 GmbH, as the controller, sets out in its own privacy policy which data Digistore24 stores and processes when this website is accessed. Further information can be found in Digistore24’s privacy policy: https://www.digistore24.com/dataschutz.
Digistore24 WordPress plugin
The WordPress plugin makes it possible to integrate various Digistore24 services on one’s own website, e.g. the social proof bubble, the affiliate advertising material generator or other tools.
With each integration, non-personal data is loaded from the Digistore24 server (e.g. a JavaScript file).
During this loading, your web browser retrieves a web page from the Digistore24 server. Our server has no influence on the extent to which your web browser transmits data to the Digistore24 server. Our server itself does not transmit any data to the Digistore24 servers in this context.
Digistore24 GmbH, as the controller, sets out in its own privacy policy which data Digistore24 stores and processes when this web page is accessed. Digistore24’s privacy policy can be found here: https://www.digistore24.com/dataschutz
Conversion tools / shopping cart
Digistore24 makes it possible to integrate various services on one’s own website via HTML and JavaScript codes, e.g. the social proof bubble or the Digistore24 shopping cart.
With each integration, non-personal data is loaded from the Digistore24 server (e.g. a JavaScript file).
During this loading, your web browser retrieves a web page from the Digistore24 server. Our server has no influence on the extent to which your web browser transmits data to the Digistore24 server. Our server itself does not transmit any data to the Digistore24 servers in this context.
Digistore24 GmbH, as the controller, sets out in its own privacy policy which data Digistore24 stores and processes when this web page is accessed. Digistore24’s privacy policy can be found here: https://www.digistore24.com/dataschutz
11. Audio and Video Conferences
The following information concerns the separate offerings and services actually used. It does not mean that all listed services load when the homepage is visited. References to consent in those separate workflows do not describe a cookie consent request operating on this website.
We do not use the following tools on all of our web pages. Some tools are only used on certain pages. You will be asked for your consent separately in each case and can accept or decline the use of the respective tools.
Data processing
To communicate with our customers, we use, among other things, online conferencing tools. The individual tools we use are listed below. If you communicate with us via video or audio conference over the internet, your personal data will be collected and processed by us and by the provider of the respective conferencing tool.
The conferencing tools collect all data that you provide or use in order to use the tools (email address and/or your telephone number). Furthermore, the conferencing tools process the duration of the conference, the start and end (time) of participation in the conference, the number of participants and other „context information“ in connection with the communication process (metadata).
Furthermore, the provider of the tool processes all technical data required to handle the online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection.
If content is exchanged, uploaded or otherwise provided within the tool, it is also stored on the servers of the tool providers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared while using the service.
Please note that we do not have full influence on the data processing operations of the tools used. Our options are largely determined by the corporate policy of the respective provider. Further information on data processing by the conferencing tools can be found in the privacy policies of the respective tools used, which we have listed below this text.
Purpose and legal bases
The conferencing tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6(1)(b) GDPR). Furthermore, the use of the tools serves to generally simplify and accelerate communication with us or our company (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Insofar as consent has been requested, the tools concerned are used on the basis of this consent; consent can be withdrawn at any time with effect for the future.
Storage period
The data collected directly by us via the video and conferencing tools will be deleted from our systems as soon as you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.
We have no influence on the storage period of your data that is stored by the operators of the conferencing tools for their own purposes. For details, please contact the operators of the conferencing tools directly.
Conferencing tools used
We use the following conferencing tools:
Zoom
We use Zoom. The provider of this service is Zoom Communications Inc., San Jose, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. For details on data processing, please refer to Zoom’s privacy policy: https://zoom.us/de-de/privacy.html.
Data transfers to the USA are based on the Standard Contractual Clauses of the EU Commission. Details can be found here: https://zoom.us/de-de/privacy.html.
Data processing agreement
We have concluded a data processing agreement (DPA) with the above-mentioned provider. This is a contract required by data protection law which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
12. Own Services
The following information concerns the separate offerings and services actually used. It does not mean that all listed services load when the homepage is visited. References to consent in those separate workflows do not describe a cookie consent request operating on this website.
Handling of applicant data
We offer you the opportunity to apply to us (e.g. by email, by post or via an online application form). Below, we inform you about the scope, purpose and use of your personal data collected as part of the application process. We assure you that the collection, processing and use of your data will be carried out in accordance with applicable data protection law and all other statutory provisions and that your data will be treated in strict confidence.
Scope and purpose of data collection
If you send us an application, we process the associated personal data (e.g. contact and communication data, application documents, notes taken during job interviews, etc.) insofar as this is necessary for deciding on the establishment of an employment relationship. The legal basis for this is Section 26 BDSG under German law (initiation of an employment relationship), Art. 6(1)(b) GDPR (general initiation of a contract) and, if you have given your consent, Art. 6(1)(a) GDPR. Consent can be withdrawn at any time. Within our company, your personal data will only be passed on to persons involved in processing your application.
If the application is successful, the data you have submitted will be stored in our data processing systems on the basis of Section 26 BDSG and Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.
Data retention period
If we are unable to offer you a position, you decline a job offer or you withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). The data will then be deleted and the physical application documents destroyed. The retention serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), deletion will only take place when the purpose for further retention no longer applies.
Longer retention may also take place if you have given your corresponding consent (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.
Google Drive
We have integrated Google Drive on this website. The provider is Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Drive enables us to integrate an upload area on our website where you can upload content. If you upload content, it is stored on Google Drive’s servers. When you enter our website, a connection to Google Drive is also established so that Google Drive can determine that you have visited our website.
Google Drive is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in a reliable upload area on its website. If corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.
Data processing agreement
We have concluded a data processing agreement (DPA) with the above-mentioned provider. This is a contract required by data protection law which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
XHANA: AI-powered content assistant
XHANA is a service of XHAUER Media GmbH through which customers submit content via WhatsApp, from which LinkedIn posts are created with the help of AI and published after express approval.
Clarification of roles
For the content that our customers have processed via the service (transmitted messages, voice recordings, images, documents, the customer profile „Second Brain“ and any information about third parties contained therein), the respective customer is the controller under data protection law; we process this data as a processor on the basis of a data processing agreement pursuant to Art. 28 GDPR (Annex 1 to our General Terms and Conditions, including the complete list of our sub-processors and the respective transfer mechanisms). Data subjects whose data is contained in customer content should contact the respective customer as the controller for information and other data subject rights; we forward any such requests we receive to the customer without undue delay. The following paragraphs concern the processing for which we ourselves are the controller.
General Terms and Conditions: https://drive.google.com/file/d/1kowPBCEgj4FzmGJjQzRoGfAKHf1loRi-/view?usp=sharing Data Processing Agreement: https://drive.google.com/file/d/1WOmBNBc1y4PYDCCMBzHlQoaHsJAjVQOp/view?usp=sharing
Sign-up (trial period and claim of a licensed seat)
When you sign up via our forms, we process your name, email address, WhatsApp phone number, company details and role in order to set up access and to initiate or perform the contract (Art. 6(1)(b) GDPR). The form data is transmitted to our systems via the service provider Zapier Inc. (USA, see section „Zapier“).
Proof of contract acceptance
We log your acceptance of our General Terms and Conditions and the data processing agreement with a timestamp, document version, source and phone number (Art. 6(1)(f) GDPR: documentation and preservation of evidence). We retain these logs for up to three years after the end of the contract.
Communication via WhatsApp
Communication with XHANA takes place via the WhatsApp Business Platform. In the process, your phone number, message content and metadata are processed by Meta Platforms Ireland Limited (Cloud API) and WhatsApp Ireland Limited (both Merrion Road, Dublin 4, Ireland); any transfer to affiliated companies in the USA takes place on the basis of the EU-US Data Privacy Framework (WhatsApp LLC is actively certified), and alternatively on the basis of EU Standard Contractual Clauses.
Connection with LinkedIn
So that XHANA can publish and analyse your approved posts on LinkedIn, you connect your LinkedIn profile via LinkedIn’s official interface. In doing so, we receive from LinkedIn your member ID, access keys (stored in encrypted form) and performance data on the posts you publish via XHANA and on your profile, such as impressions, reactions, comments and your follower count. From other members, we receive only figures, no content and no profile data. The purpose is to publish your posts and to present your analytics in the Content Hub and in the weekly report via WhatsApp; the legal basis is Art. 6(1)(b) GDPR. The recipient of the post content is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For the weekly report, Anthropic (see „Use of artificial intelligence“) processes only aggregated weekly figures. We store this data for as long as you use XHANA. If you revoke access in your LinkedIn settings or the contract ends, we delete it; upon request to team@xhauer.com, we will also delete it earlier at any time.
Use of artificial intelligence
When interacting with XHANA, you are communicating with an AI system (notice pursuant to Art. 50(1) of Regulation (EU) 2024/1689). To create content, we use generative AI models from external providers via their business customer interfaces: Anthropic PBC (USA) and OpenAI Ireland Ltd or OpenAI OpCo, LLC (Ireland/USA). Transfers to the USA take place on the basis of the EU Standard Contractual Clauses. Both providers are contractually obliged not to use the processed content to train their AI models; inputs and outputs are deleted there by default within 30 days.
Other service providers
For operating the service and for storage, we use in particular: Supabase Pte. Ltd. (Singapore; data storage in the EU, Paris region; EU Standard Contractual Clauses) and ELESTIO LIMITED (Ireland; hosting in Germany). In the context of processing on behalf of our customers, Uploadcare Inc. (USA; EU-US Data Privacy Framework) is also used for media processing. Details and updates can be found in Annex B of our data processing agreement.
Service improvement and training of our own models
To improve our service and to train, fine-tune and evaluate our own or internally operated AI models, we exclusively use data that has previously been completely and irreversibly anonymised and cleansed of direct and indirect customer references as well as customer-specific confidential information (details in Section 6.4 of our General Terms and Conditions). The anonymisation takes place as the final step of the processing on behalf of the customer, on the customer’s documented instructions (Section 2.1 of the data processing agreement); only the resulting anonymous data is used by us under our own responsibility. Customers can object to this use at any time, informally and with effect for the future.
No automated decision-making
No automated decision-making within the meaning of Art. 22 GDPR takes place; posts are only published after human review and express approval by the customer.
Storage period
We store sign-up and contract data for the duration of the business relationship; consent logs for up to three years after the end of the contract; documents subject to statutory retention obligations (in particular under Section 132 of the Austrian Federal Fiscal Code, BAO) for seven years. For content processed on behalf of our customers, the deletion periods of the data processing agreement apply (deletion within 90 days after the end of the contract).
Contact for data protection enquiries regarding XHANA: team@xhauer.com