Privacy Notice

Information obligation according to DSGVO Art. 13

Version of 14 September 2026.

Controller for data collection:

HedgeGo GmbH
Promenadegasse 51
A-1170 Vienna
E-mail: gm@hedgego.com
Telephone: +43 664 2009011

No data protection officer has been appointed, as this is not required by law.

Purpose(s) of data processing:

Website – technology
Legal basis: legitimate interest (GDPR Art. 6 para. 1 f)
for system-related cookies or log files
Groups of persons: Website visitors
Deletion periods: Tracking/log data: after 3 months
Recipient groups: IT technology

Making contact
Legal basis: Consent to processing (GDPR Art. 6 para. 1 a)
Pre-contractual measures in the course of forms or other information input
Groups of persons: Customers, guests
Deletion periods: Personal identification data: 1 year after last contact if no contractual measures are taken
Recipient groups: IT technology

Market analysis
Legal basis: fulfilment of a contract (GDPR Art. 6 para. 1 b)
Groups of persons: Customers, employees
Deletion periods: Contact data: after termination of the contract or cooperation, Personal identification data: Tax law according to § 132 para. 1 BAO: 7 years
Recipient groups: Banks, IT technology, tax consultants, dispatch service providers
Transmission to third countries: see the section on payment processing below.

Feasibility analysis
Legal basis: fulfilment of a contract (GDPR Art. 6 para. 1 b)
Data processed: company name and address, contact name, e-mail address, telephone number, VAT identification number, the materials you ask us to examine, and the price history you upload
Groups of persons: Customers
Deletion periods: uploaded data files are forwarded to us by e-mail and deleted from the website immediately afterwards; analysis data is deleted if no follow-up order is placed within three months; order and accounting records are kept for 7 years under tax law (§ 132 para. 1 BAO)
Recipient groups: IT technology, payment service provider, e-mail dispatch provider
Your purchase price data is not passed to an asset manager or a bank at any point.

Payment processing
Legal basis: fulfilment of a contract (GDPR Art. 6 para. 1 b)
Payments are processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland, and its affiliated companies.
Data processed: name, e-mail address, billing address, VAT identification number and payment data
Groups of persons: Customers
Deletion periods: in accordance with Stripe’s own retention rules and, for invoices, 7 years under tax law (§ 132 para. 1 BAO)
Transmission to third countries: Stripe also processes data in the United States. The transfer takes place on the basis of the European Commission’s standard contractual clauses and Stripe’s certification under the EU-US Data Privacy Framework.
Card details are entered on Stripe’s own payment page and are never received or stored by us. Stripe’s privacy policy is available at stripe.com/privacy.

E-mail dispatch
Legal basis: fulfilment of a contract (GDPR Art. 6 para. 1 b); for the newsletter, consent (GDPR Art. 6 para. 1 a)
E-mails are sent through Brevo, operated by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.
Data processed: e-mail address, name and the content of the message, including attached data workbooks
Groups of persons: Customers, guests
Deletion periods: dispatch records are deleted after 3 months; newsletter data until consent is withdrawn
Transmission to third countries: no transmission to third countries.

Website statistics
Legal basis: legitimate interest (GDPR Art. 6 para. 1 f)
Visitor statistics are collected and stored on our own server. The data is not passed to third parties and is not used to identify individual visitors.
Groups of persons: Website visitors
Deletion periods: after 12 months
Transmission to third countries: no transmission to third countries.

Data subjects have the following rights vis-à-vis the controller:

– Right to confirmation
– Right to information
– Right to rectification
– Right to erasure
– Right to restriction of processing
– Right to object to processing (only in the case of legitimate interest)
– Right to data portability (only with contractual relationship or consent)
– Right to lodge a complaint with the supervisory authority

If the processing is based on consent, the data subject has the right to withdraw consent at any time (marketing for own purposes); the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If photos are published on the homepage or in social networks, the data will also be published and thus made available to an indefinite group of recipients.

There is no intention to process your data for automated decision-making including profiling (data analysis of behaviour, habits, preferences, etc.).