Privacy Policy - leu-advisory.com

1. Data Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection provisions is:
Leu Advisory Services GmbH
Mag. Rainer Leu
Julius-Raab-Platz 4, 1010 Vienna, Austria
Email: office@leu-advisory.at

No data protection officer has been appointed, as the legal requirements under Art. 37 GDPR and Section 5 of the Austrian Data Protection Act (DSG) do not apply.

2. General Information on Data Processing
The protection of your personal data is important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, the Austrian Data Protection Act – DSG, and the Austrian Telecommunications Act – TKG). In this privacy policy, we inform you about the nature, scope, and purpose of the collection and use of personal data on our website leu-advisory.com.
Personal data is any information relating to an identified or identifiable natural person (e.g. name, address, email address, IP address). Use of our website is generally possible without providing personal data. Where personal data is collected on our pages, this is done, as far as possible, on a voluntary basis.
Please note that data transmission over the internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

3. Legal Bases for Processing
We process personal data on the basis of the following legal grounds, depending on the respective purpose:
your consent (Art. 6(1)(a) GDPR), e.g. for the newsletter, web analytics, and non-essential cookies;
the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR);
compliance with legal obligations (Art. 6(1)(c) GDPR), e.g. statutory retention periods under tax law;
the protection of our legitimate interests (Art. 6(1)(f) GDPR), e.g. in the technical provision and security of the website.

4. Your Rights as a Data Subject
Under the GDPR, you have extensive rights. In particular, these are:
the right of access (Art. 15 GDPR)
the right to rectification (Art. 16 GDPR)
the right to erasure (Art. 17 GDPR)
the right to restriction of processing (Art. 18 GDPR)
the right to data portability (Art. 20 GDPR)
the right to object to processing (Art. 21 GDPR)
the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
To exercise your rights, an informal message to office@leu-advisory.at or a letter to the address stated above is sufficient.
If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the supervisory authority:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria
Phone: +43 1 52 152-0 | Email: dsb@dsb.gv.at | www.dsb.gv.at

5. Hosting and Server Log Files
Our website is hosted by an external service provider. The personal data collected on this website is stored on the hosting provider’s servers. The provider is:
ALL-INKL.COM – Neue Medien Münnich, owner René Münnich
Hauptstraße 68, 02742 Friedersdorf, Germany
The servers are located in Germany. We have concluded a data processing agreement (DPA) with the hosting provider in accordance with Art. 28 GDPR, ensuring data-protection-compliant processing. The legal basis is our legitimate interest in the secure and efficient provision of our website (Art. 6(1)(f) GDPR).
The provider automatically collects and stores information in so-called server log files, which your browser automatically transmits. These are:
browser type and browser version
operating system used
referrer URL
hostname of the accessing device
time of the server request
IP address
This data is not merged with other data sources. It is collected to ensure trouble-free operation and the security of the website (Art. 6(1)(f) GDPR).

6. Cookies and Consent Management
Our website uses cookies. Cookies are small text files that are stored on your device and saved by your browser. They do not harm your computer and do not contain viruses.
A general distinction is made between technically necessary cookies, which enable the basic operation of the website, and non-essential cookies (e.g. for statistics/analytics or marketing).
When you access our website, a cookie consent banner gives you the option to grant or refuse your consent to the use of non-essential cookies. Technically non-essential cookies and the services based on them (in particular Google Analytics) are only set or loaded after you have expressly consented (Art. 6(1)(a) GDPR in conjunction with Section 165(3) of the Austrian Telecommunications Act 2021). You can withdraw or change your consent at any time via the cookie settings on the website, with effect for the future.
Technically necessary cookies are set on the basis of our legitimate interest in a functioning website (Art. 6(1)(f) GDPR). You can also set your browser to inform you about the setting of cookies and to allow them only in individual cases or to exclude them generally. Disabling cookies may limit the functionality of this website.

7. Contact Form and Contact by Email
If you send us inquiries via the contact form or by email, your details from the form, including the contact data you provide there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not share this data without your consent.
This data is processed on the basis of Art. 6(1)(b) GDPR, provided your inquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR). The data remains with us until the purpose of storage no longer applies or you request its deletion, unless statutory retention obligations prevent this.

8. Newsletter (Mailchimp)
Our website offers you the option of subscribing to a free newsletter. To send the newsletter, we use the service Mailchimp, a newsletter dispatch service provided by the US company:
The Rocket Science Group LLC d/b/a Mailchimp (an Intuit Inc. company)
405 N. Angier Ave NE, Atlanta, GA 30308, USA
For newsletter registration we use the so-called double opt-in procedure: after registering, you will receive an email asking you to confirm. Only after this confirmation is your email address added to the mailing list. This ensures that no one can register using someone else’s email address.
The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by unsubscribing from the newsletter – for example, via the unsubscribe link at the end of each newsletter email. The lawfulness of data processing already carried out remains unaffected by the withdrawal. After you unsubscribe, your email address will be deleted from the mailing list.
Mailchimp also processes the data of newsletter recipients in the USA. Mailchimp is certified under the EU-U.S. Data Privacy Framework (DPF); in addition, the European Commission’s standard contractual clauses serve as a safeguard for data transfers to the USA pursuant to Art. 46 GDPR. We have concluded a data processing agreement (DPA) with Mailchimp in accordance with Art. 28 GDPR. Further information can be found in Mailchimp’s privacy policy:
https://www.intuit.com/privacy/statement/

9. Web Analytics with Google Analytics (GA4)
This website uses features of the web analytics service Google Analytics 4 (GA4). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies that enable an analysis of the use of the website (e.g. pages accessed, time spent, approximate origin of visits). The information collected is generally transmitted to and stored on Google’s servers.
Google Analytics is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) of the Austrian Telecommunications Act 2021. Google Analytics is only loaded after you have given your consent in the cookie consent banner. You can withdraw your consent at any time via the cookie settings, with effect for the future. In GA4, IP addresses are shortened by default and not stored permanently, so that no direct personal reference is established via the IP address.
In the course of using Google Analytics, personal data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework (DPF); in addition, the European Commission’s standard contractual clauses apply (Art. 46 GDPR). We have concluded a data processing agreement with Google in accordance with Art. 28 GDPR.
You can also prevent collection by Google Analytics via a browser add-on: https://tools.google.com/dlpage/gaoptout. Further information on how Google handles user data can be found in Google’s privacy policy: https://policies.google.com/privacy.

10. Google Fonts
This website uses so-called Google Fonts, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for the uniform display of fonts.
If the fonts are embedded locally on our server, no connection to Google’s servers takes place. If the Google Fonts are loaded dynamically from Google servers, your browser establishes a connection to Google when the page is accessed, whereby Google becomes aware that our website was accessed via your IP address. In this case, use is based on our legitimate interest in a uniform and appealing presentation of our online offering (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR). For any data transfer to the USA, Google relies on the EU-U.S. Data Privacy Framework. Further information:
https://policies.google.com/privacy
Implementation note: We recommend embedding the Google Fonts locally on the all-inkl server. This eliminates the data transfer to Google entirely, and this section can be simplified accordingly.

11. External Links and LinkedIn
Our website contains a link to our LinkedIn profile (provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). This is a simple link; no active social media plugin that transmits data to LinkedIn merely upon accessing our page is embedded. Only when you click the link and switch to LinkedIn will your data be processed by LinkedIn. Information on this can be found in LinkedIn’s privacy policy:
https://www.linkedin.com/legal/privacy-policy
The respective providers are always responsible for the content of external pages to which we link. We carefully review linked content at the time of linking, but we accept no liability for subsequent changes.

12. Storage Period and Deletion
We process and store your personal data only for as long as is necessary to achieve the respective storage purpose or as required by statutory retention obligations. Once the purpose no longer applies or these periods expire, the corresponding data is routinely deleted.
Data stored within the scope of business relationships is subject in particular to the seven-year retention period under tax law pursuant to Section 132 of the Austrian Federal Fiscal Code (BAO). In these cases, the legal basis for continued storage is compliance with a legal obligation (Art. 6(1)(c) GDPR).

13. SSL/TLS Encryption
For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser bar. When encryption is active, the data you transmit to us cannot be read by third parties.

14. Validity and Changes to this Privacy Policy
This privacy policy is currently valid. As our website develops or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can be accessed on this page at any time.
Last updated: July 2026
This English version is a translation provided for the convenience of international visitors. In the event of any discrepancy, the German version of this privacy policy shall prevail.