Privacy Policy

Last updated: November 2026

1. Preamble

This privacy policy applies to all clients of Karibu GmbH, FN 448584h, Landstraßer Hauptstraße 72/2/29, 1030 Wien.

In this privacy policy, we inform you about the most important aspects of data processing within the contractual relationship with our clients (customers, website visitors) in accordance with Art. 12-14 of the General Data Protection Regulation (GDPR).

No data protection officer has been appointed, as the law does not require one.

2. Identity of the controller

The controller responsible for processing personal data is Karibu GmbH, FN 448584h, Landstraßer Hauptstraße 72/2/29, 1030 Wien.

3. Personal data

We, Karibu GmbH, collect, process and use your personal data only on the basis of the contractual relationship, for the purposes agreed with you, on the basis of your consent, or where another legal basis exists in accordance with the GDPR; in doing so, we comply with data protection and civil law provisions.

We only collect personal data that is necessary to perform and handle our services under the contract, or that you provide to us voluntarily.

Personal data is any data containing individual details about personal or factual circumstances, for example name, address, email address, phone number, date of birth, age, gender, social security number, video recordings, photos, voice recordings of persons, and biometric data such as fingerprints. Sensitive data, such as health data or data relating to criminal proceedings, may also be included.

In particular, we collect, store and process the following data of our clients to perform the contract:

Name (first name, last name, additional name, form of address, title)
Date of birth
Address (street, postal code, city, country)
Contact details (email, website, phone number, fax number)
Names of contact persons
Legally relevant numbers (VAT ID number, association register (ZVR) number, company register number)
Bank details (IBAN, SWIFT/BIC, bank code, bank account number)
any other personal data transmitted to us within the contractual relationship.

4. Use of data

We receive your data from you as our client. Your data is processed to perform the contract and to comply with any legal obligations.

We will not process the data provided to us for any purposes other than those covered by the contract, by your consent, or otherwise by a provision in accordance with the GDPR.

5. Your rights as a data subject

As our client, you have the right at any time to obtain information about your stored personal data, its origin and recipients, and the purpose of the processing, as well as the right to rectification, data portability, objection, restriction of processing, and blocking or erasure of incorrect or unlawfully processed data.

If your personal data changes, please let us know.

You have the right to withdraw any consent you have given to the use of your personal data at any time. Requests for information, erasure, rectification, objection and/or data portability (the latter provided it does not cause disproportionate effort) can be sent to the address given in section 17 of this policy.

If you believe that our processing of your personal data violates applicable data protection law or that your data protection rights have been infringed in any other way, you can lodge a complaint with the competent supervisory authority. In Austria, this is the Data Protection Authority (Datenschutzbehörde).

6. Data security

Your personal data is protected by appropriate organizational and technical measures. These measures cover in particular protection against unauthorized, unlawful or accidental access, processing, loss, use and manipulation. Despite our efforts to maintain an appropriately high standard of care at all times, we cannot rule out that information you share with us over the internet may be viewed and used by other persons.

Please note that we therefore accept no liability whatsoever for the disclosure of information due to errors in data transmission not caused by us and/or unauthorized access by third parties (e.g. hacking of an email account or phone, interception of faxes). For consumers, this exclusion of liability applies only to slight negligence.

7. Transfer of data to third parties

To perform the contract, it may also be necessary to pass your data on to third parties (e.g. partner companies, insurers, service providers we use and to whom we provide data, etc.). Your data is passed on only on the basis of the GDPR, in particular to perform the contract or based on your prior consent.

Some of the recipients of your personal data named above are located outside your country or process your personal data there. The level of data protection in other countries may not be equivalent to that of Austria. However, we transfer your personal data only to countries for which the EU Commission has decided that they have an adequate level of data protection, or we take measures to ensure that all recipients have an adequate level of data protection; for this purpose, we conclude standard contractual clauses of the EU Commission (Implementing Decision (EU) 2021/914) or rely on the EU-U.S. Data Privacy Framework. Should a transfer to other countries without the same level of data protection be necessary, we will ask for your consent.

8. Data retention period

We store the data during the contractual relationship and beyond for a period of at least 7 and at most 30 years after it ends, in particular to meet retention obligations under commercial and tax law, and for as long as warranty and damage claims require the data to be processed.

After this period, the data is deleted or anonymized to the extent that it can no longer be traced back to a person.

Among other things, you can use the website to subscribe to our newsletter, download information or book a call. We process this data (name/company, address and/or email address) for the purpose of informing customers and acquiring customers. You can withdraw your consent at any time.

10. Hosting

This website is hosted by Netlify (Netlify, Inc., USA). When you visit the website, Netlify processes technically necessary data such as IP address, date and time of access, page visited and browser type in order to deliver the website and ensure its security. We use the IP address to determine your country so we can show you the right country site; we do not store the country. Netlify receives and stores what you enter in forms (e.g. for the guide) and passes it on to ActiveCampaign (see section 16). We manage the website's content and images with Sanity (Sanity AS, Norway); images are delivered through Sanity's content delivery network, which transmits your IP address to Sanity. Netlify is certified under the EU-U.S. Data Privacy Framework. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).

On your first visit, we use a cookie banner to ask which categories of cookies you consent to. We set technically necessary cookies without consent (Section 165(3) of the Austrian Telecommunications Act 2021, TKG 2021). All other services, in particular analytics and advertising, load only after your consent (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the "Cookies" link at the bottom of every page.

12. Google Tag Manager, Google Analytics and Microsoft Clarity

With your consent, we use Google Tag Manager and Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Tag Manager manages the integration of other services on the website. Google Analytics evaluates how visitors use the website, for example which pages are viewed and for how long. IP addresses are truncated in the process. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. The data is deleted after 14 months. The legal basis is your consent (Art. 6(1)(a) GDPR).

With your consent to statistics, we also use Microsoft Clarity from Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin, Ireland ("Microsoft"). Clarity records clicks, scrolling and mouse movements as anonymized session recordings and heatmaps; form inputs are masked. Clarity loads through Google Tag Manager, so only after your consent. Data may be processed in the USA; Microsoft is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time via the "Cookies" link at the bottom of every page. See Microsoft's privacy statement for details.

13. Google Ads

Only with your consent to the "Marketing" category do we use Google Ads with conversion tracking from Google. This measures whether visitors, for example, book a call after clicking one of our ads. We only learn the total number of such actions, not who performed them. Your consent signals (Google Consent Mode) are sent to Google only after your consent; before that, no Google service loads. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR).

14. YouTube

On our website, we refer to videos from YouTube (Google Ireland Limited). A video is loaded only when you click it. Only then is data such as your IP address transmitted to YouTube and cookies may be set. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent by clicking the video (Art. 6(1)(a) GDPR).

15. Booking appointments via Calendly

To book calls, we link to Calendly (Calendly LLC, USA). When you book an appointment, Calendly processes the data you enter (e.g. name, email address, selected time and the details of your request) and transmits it to us. Calendly is certified under the EU-U.S. Data Privacy Framework. The legal basis is taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

We use ActiveCampaign (ActiveCampaign, LLC, USA) to send our newsletter. For this purpose, we store your email address and, if provided, your name with ActiveCampaign. ActiveCampaign measures whether a newsletter was opened and which links were clicked so that we can improve future issues. ActiveCampaign is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every newsletter; we then delete your data from the newsletter mailing list.

17. Our contact details

Protecting your data is particularly important to us. You can reach us at any time with your questions or concerns using the contact details provided in the legal notice (Impressum).