COOKIE POLICY

This Cookie Policy explains how VBR Innovations GmbH uses cookies and similar technologies on the website www.vbrracezone.com (the "Website"), on what legal basis we do so, and how you can give, manage and withdraw your consent.

It supplements our Privacy Policy. Where this policy concerns personal data, the information in our Privacy Policy applies in addition (your rights, storage periods, data transfers).

1. Controller

VBR Innovations GmbH
Grestner Straße 9, 3341 Ybbsitz, Austria
Commercial register no.: FN 550779 w (Regional Court St. Pölten)
VAT ID: ATU76645579
Email: office@vbr-innovations.com
Phone: +43 660 1256703

2. What are cookies and similar technologies?

Cookies are small text files stored on your device (computer, smartphone, tablet) when you visit a website. Among other things, they let us recognise your device, remember your settings or analyse how the Website is used.

This policy covers not only classic HTTP cookies but any technology used to store information on, or read information from, your device – in particular:

• Local Storage / Web Storage – for example, to save your personal best time in our interactive games

• Tracking pixels / pixel tags – for example, the Meta Pixel

• comparable tracking identifiers – for example, device or browser identifiers

Cookies may be set by us ("first-party cookies") or by third parties whose services we integrate ("third-party cookies"). By lifespan, we distinguish session cookies, which are deleted when you close your browser, and persistent cookies, which are stored for a defined period.

3. Legal bases

In Austria, two sets of rules apply in parallel:

• Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021): storing information on, or accessing information already on, your device is only permitted with your prior consent – unless the storage or access is strictly necessary to provide a service you have expressly requested ("strictly necessary cookies").

• GDPR (Regulation (EU) 2016/679): where cookies process personal data, that processing is based on your consent under Art. 6(1)(a) GDPR. For strictly necessary cookies we rely on our legitimate interest under Art. 6(1)(f) GDPR in the secure and functional operation of the Website.

For visitors from Germany, the relevant provision is Section 25 TDDDG (formerly TTDSG). In substance it mirrors Section 165(3) TKG 2021, as both implement Art. 5(3) of the ePrivacy Directive (2002/58/EC).

4. Your consent – and how to change it at any time

When you first visit the Website, we display a consent banner. Cookies that are not strictly necessary are only set after you have actively given consent. You can:

• accept or decline individual categories – declining is just as easy as accepting,

• withdraw or adjust any consent you have given at any time, with future effect.

You can open and change your settings at any time via the "Cookie settings" button at the bottom of every page.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Strictly necessary cookies cannot be disabled via the banner, as the Website cannot operate without them; however, you can delete them via your browser settings (see Section 7).

5. Cookies and technologies we use

5.1 Strictly necessary cookies and storage

These are required for the basic operation, security and delivery of the Website. No consent is required for them.

• Storage of your cookie choice
  Provider: VBR (first party) · Purpose: stores which categories you have accepted or declined, so you are not asked again on every page view · Type: cookie or local storage · Duration: up to 12 months

• Technical delivery and security of the Website
  Provider: Framer B.V. (Netherlands) · Purpose: secure delivery of page content via the content delivery network of our hosting platform, protection against abuse · Type: cookie or storage · Duration: session

5.2 Functional storage

These improve convenience and functionality without tracking you across websites.

• Best time in our interactive games
  Provider: VBR (first party) · Purpose: stores your personal best time in our browser games locally on your device · Type: local storage · Duration: until you clear it in your browser
  These values remain solely on your device and are not transmitted to us or to any third party.

5.3 Statistics and analytics cookies (consent only)

These help us understand how the Website is used so that we can improve it. The service used is Google Analytics 4, integrated via Google Tag Manager.

• _ga
  Provider: Google Ireland Limited · Purpose: distinguishes users · Type: cookie · Duration: 2 years

• _ga_CMSW10MPMT
  Provider: Google Ireland Limited · Purpose: stores the session state for Google Analytics 4 · Type: cookie · Duration: 2 years

Google Tag Manager itself is a management tool that loads the tags we use. By default it does not set its own analytics cookies, but it controls the delivery of the other services.

5.4 Marketing and targeting cookies (consent only)

These are used to measure the effectiveness of advertising and to show you more relevant content (remarketing). The service used is the Meta Pixel, integrated via Google Tag Manager.

• _fbp
  Provider: Meta Platforms Ireland Ltd. · Purpose: identifies browsers for advertising and remarketing · Type: cookie · Duration: 3 months

• fr
  Provider: Meta Platforms Ireland Ltd. · Purpose: ad delivery and reach measurement · Type: cookie · Duration: 3 months

5.5 Videos – no consent required

We do not embed videos from external platforms such as YouTube or Vimeo. All videos are delivered via the content delivery network of our hosting platform Framer and via a Nextcloud instance we operate ourselves on servers within the EU. This sets no third-party cookies and transmits no data to external video services.

5.6 Newsletter

We use HubSpot to send our newsletter. Sign-up data is hosted in HubSpot's EU data centre in Frankfurt. The sign-up itself does not set any additional marketing cookies on this Website. Details of how we process your newsletter data can be found in our Privacy Policy.

6. Data transfers to the USA

Google and Meta are US companies. When Google Analytics 4 and the Meta Pixel are used, personal data – such as online identifiers or IP-related information – may be transferred to the USA.

This transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF) of 10 July 2023: both Google LLC and Meta Platforms, Inc. are certified under the DPF, so an adequate level of data protection within the meaning of Art. 45 GDPR exists for transfers to these recipients. In addition, the providers rely on EU Standard Contractual Clauses (Art. 46 GDPR).

The adequacy decision is currently valid; an appeal against it is pending before the Court of Justice of the European Union. Should the decision be annulled, transfers will continue on the basis of the Standard Contractual Clauses. Despite these safeguards, access by US authorities cannot be entirely ruled out. By consenting to statistics or marketing cookies, you also consent to the associated data transfer (Art. 49(1)(a) GDPR).

Newsletter data is hosted via HubSpot in its EU data centre in Frankfurt; any access by the US parent company HubSpot, Inc. is safeguarded by its DPF certification and EU Standard Contractual Clauses. No third-country transfer takes place for the delivery of our videos.

7. Managing and deleting cookies in your browser

Independently of our consent banner, you can manage or delete cookies in your browser at any time. In common browsers such as Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari, the relevant settings are found under "Settings → Privacy" or "Cookies".

Please note: fully blocking cookies may cause parts of the Website to stop working correctly. Deleting cookies in your browser does not replace withdrawing your consent via the consent banner.

8. Your rights

Under the GDPR you have, in particular, the following rights:

• Access to the data processed about you (Art. 15)

• Rectification of inaccurate data (Art. 16)

• Erasure (Art. 17)

• Restriction of processing (Art. 18)

• Data portability (Art. 20)

• Objection to processing (Art. 21)

• Withdrawal of consent with future effect (Art. 7(3))

You also have the right to lodge a complaint with a supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria
dsb@dsb.gv.at · www.dsb.gv.at

Visitors from Germany may also contact the data protection authority responsible for their place of residence.

9. Changes to this Cookie Policy

We will update this policy when the technologies we use or the legal situation change. The current version published here, with the date stated above, applies.

10. Contact

If you have questions about this Cookie Policy, contact us at office@vbr-innovations.com