Privacy policy

1. Controller

The controller responsible for processing your personal data through this website is:

Controller

elroiADS — Elias Alois Roitinger

Address

Niederndorf 7, 4675 Weibern, Austria

Email

office@elroi-ads.com

• We have not appointed a Data Protection Officer, as we are not required to under Art. 37 GDPR.
• For visitors in the EU/EEA, we are established in Austria and no EU representative under Art. 27 GDPR is required.

2. What we collect, why, and on what basis

We keep data collection deliberately minimal. There is no account system, no newsletter, no contact form and no comment section on this site. In practice there are three categories:

2.1 Server log data

When you load a page, our hosting provider automatically records technical data that your browser transmits: IP address, date and time of the request, the page requested, referrer URL, browser type and version, and operating system. This happens for every website and is technically necessary to deliver the page and to keep the service secure and stable.

Purpose

Delivering the website, diagnosing faults, and protecting against attacks and abuse.

Legal basis

Art. 6(1)(f) GDPR — our legitimate interest in operating a functioning and secure website.

Retention

Log data is kept for a maximum of 30 days and is then deleted or anonymised, unless a specific incident requires us to retain it longer as evidence.

2.2 Booking a call

The only data you actively give us is what you enter when you book a call. Booking is handled by Cal.com, which opens in a window on this site when you click a booking button. Cal.com collects your name, email address, the appointment time, your time zone, and anything you choose to type into the notes field.

We use your email address to confirm the appointment, to send the meeting link, and to correspond with you about the call and any follow-up. We do not add you to a mailing list and we do not send marketing email unless you explicitly ask us to.

The scheduler is not loaded until you click a booking button. Until then no request is made to Cal.com and nothing about your visit reaches them.

Purpose

Arranging, holding and following up on a requested call.

Legal basis

Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract. For any later correspondence not tied to a contract, Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries).

Provision

Providing this data is voluntary, but without an email address we cannot arrange or confirm a call.

Retention

Booking and correspondence data is deleted no later than 24 months after our last contact, unless a contract results — in which case Austrian commercial and tax law (§ 132 BAO, § 212 UGB) requires us to retain the relevant records for 7 years.

Processor

Cal.com, Inc., 2261 Market Street, San Francisco, CA 94114, USA. Acting as our processor under a data processing agreement (Art. 28 GDPR).

2.3 Advertising and measurement technologies

We advertise on Meta (Facebook and Instagram) and on Google. Where we use their measurement technologies on this website — the Meta pixel and the Google Ads conversion tag or Google Analytics — they set cookies or read similar identifiers from your device in order to measure whether an ad led to a visit or an enquiry, and to build audiences for future advertising.

These technologies are not strictly necessary to run the website. We therefore only load them after you have given consent through our cookie banner, and you can withdraw that consent at any time with effect for the future. If you do not consent, they are not loaded and no data is sent to Meta or Google.

Purpose

Measuring the performance of our advertising, attributing enquiries to campaigns, and building and excluding advertising audiences.

Legal basis

Your consent — Art. 6(1)(a) GDPR, and § 165(3) Austrian Telecommunications Act 2021 for the storage of and access to information on your device.

Data involved

Online identifiers and cookie IDs, IP address, device and browser information, pages viewed and actions taken on this site, and — where the provider can match it — your Meta or Google account.

Retention

Cookie lifetimes are set by the providers and typically run from a few days up to 24 months. Data held by Meta and Google is retained under their own policies, linked below.

3. Recipients and international transfers

We do not sell your personal data. We share it only with the service providers needed to run this website and our business, and only to the extent each one needs it.

Meta and Google are established in Ireland for EU/EEA users, but both transfer personal data to the United States. Those transfers are covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which both organisations are certified, and additionally by Standard Contractual Clauses. Transfers to Cal.com in the United States are likewise covered by Standard Contractual Clauses and supplementary measures.

You should be aware that US authorities may in principle be able to access data held by US providers, and that US law does not offer data subjects the full range of remedies available in the EU. Where a transfer relies on your consent, you are consenting to that transfer with knowledge of these risks.

• Hosting and content delivery — serving this website.
• Cal.com, Inc. (USA) — appointment scheduling, loaded only when you open the booking window.
• Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland — advertising measurement, subject to consent.
• Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland — advertising measurement, subject to consent.
• Our email provider — receiving and sending correspondence.
• Professional advisers, and authorities where we are legally required to disclose.

4. Joint controllership with Meta

Where the Meta pixel is active, Meta Platforms Ireland and we act as joint controllers under Art. 26 GDPR for the collection and transmission of your data to Meta. Meta's subsequent processing of that data for its own purposes is carried out by Meta alone, and we have no influence over it and no access to the underlying raw data.

The essential terms of this joint controllership are set out in Meta's Controller Addendum. You may exercise your data subject rights against either us or Meta; for anything concerning Meta's own processing, Meta is better placed to answer.

5. Your rights

Under the GDPR you have the following rights in relation to your personal data. To exercise any of them, email us at the address in section 1 — this is free of charge and we will respond within one month.

• Access (Art. 15) — confirmation of whether we process your data, and a copy of it.
• Rectification (Art. 16) — correction of inaccurate or incomplete data.
• Erasure (Art. 17) — deletion, where one of the grounds in Art. 17 applies.
• Restriction (Art. 18) — restriction of processing in the cases listed there.
• Data portability (Art. 20) — your data in a structured, machine-readable format.
• Objection (Art. 21) — you may object at any time to processing based on our legitimate interest, including profiling. Where data is processed for direct marketing, you may object at any time and we will stop, with no need to give reasons.
• Withdrawal of consent (Art. 7(3)) — you may withdraw consent at any time with effect for the future, without affecting the lawfulness of processing before withdrawal.
• Complaint (Art. 77) — you may lodge a complaint with a supervisory authority. Ours is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at. You may also complain to the authority where you live or work.

6. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. The advertising audiences described in section 2.3 are used to decide which adverts are shown, and have no such effect.

7. Children

This website is directed at businesses and is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

8. Security

This website is served over HTTPS, so traffic between your browser and our server is encrypted in transit. We apply appropriate technical and organisational measures under Art. 32 GDPR to protect your data. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

9. Additional rights by region

The rights in section 5 are available to everyone who contacts us, wherever you live. The following regional regimes add or restate specific rights:

• United Kingdom — the UK GDPR grants equivalent rights; the supervisory authority is the Information Commissioner's Office (ico.org.uk).
• Switzerland — the revised Federal Act on Data Protection grants equivalent rights; the authority is the FDPIC (edoeb.admin.ch).
• California — under the CCPA/CPRA you have the right to know, delete, and correct personal information, and to opt out of its sale or sharing. Our use of the Meta and Google advertising technologies described in section 2.3 constitutes sharing for cross-context behavioural advertising. Declining or withdrawing consent in our cookie banner is how you opt out, and we will not discriminate against you for exercising any of these rights. We do not knowingly sell or share the personal information of anyone under 16.
• Other US states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah and Texas — you have comparable rights of access, correction, deletion and opt-out of targeted advertising, exercisable by emailing us.
• Brazil — the LGPD grants equivalent rights, exercisable at the same address.
• Canada — under PIPEDA you may request access to and correction of your personal information.

10. Changes to this policy

We update this policy when the way we handle data changes — for example if we add or remove a service provider. The date at the top always reflects the current version. Where a change materially affects you, we will make that clear on this page.