PRIVACY POLICY

1. General

The definitions used in this Privacy Policy are based on the General Data Protection Regulation (EU) 2016/679 (GDPR). VBR Innovations GmbH (commercial register no. FN 550779 w), with registered office at Grestner Straße 9, 3341 Ybbsitz, Austria (also referred to as "VBR", "we", "us"), is responsible for data processing in connection with the use of the website www.vbrracezone.com.

This Privacy Policy informs you about the nature, scope and purposes of the collection and use of your personal data by VBR in connection with your visit to and use of our website. We take the protection of your data very seriously and treat it confidentially and in accordance with applicable data protection law.

Details on the cookies and similar technologies used on this website can be found in our separate Cookie Policy.

Please note that data transmission over the internet (e.g. communication by email) may be subject to security vulnerabilities. Complete protection of data from access by third parties is not possible.

2. What is personal data?

"Personal data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person.

3. What data we process

3.1 When visiting our website (server log files)

Each time you use our website, we collect the data your browser transmits to our servers:

– IP address and IP location
– Date and time of the request
– Content of the request (specific page)
– Access status / HTTP status code
– Browser type and version
– Operating system and its interface
– Referrer URL (previously visited website)

This data is technically necessary to display the website, ensure its stability and security, and defend against attacks.
Legal basis: legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR).

3.2 Hosting (Framer)

Our website is hosted by Framer B.V. (Netherlands) and delivered via its content delivery network. In doing so, Framer processes the access data referred to in Section 3.1 on our behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with Framer. Framer does not set tracking cookies by default and does not store personal data beyond this; technical server logs are retained only for as long as necessary (see Section 6).
Legal basis: legitimate interest in reliable, secure hosting (Art. 6(1)(f) GDPR).

3.3 Cookies, tracking and web analytics

Our website uses cookies and similar technologies. Cookies that are not strictly necessary (statistics, marketing) are only set after you have given consent via our consent banner.

Legal bases: Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) in conjunction with your consent under Art. 6(1)(a) GDPR for cookies that are not strictly necessary; legitimate interest under Art. 6(1)(f) GDPR for strictly necessary cookies. You may withdraw any consent given at any time with future effect (cookie settings).

To integrate and manage our tags we use Google Tag Manager (Google Ireland Limited). The following services in particular are loaded through it:

• Google Analytics 4 (Google Ireland Limited / Google LLC) – reach and usage analysis to improve our website. This processes, among other things, online identifiers, truncated IP information, and device and usage data.

• Meta Pixel (Meta Platforms Ireland Ltd.) – measurement of advertising effectiveness and remarketing on Meta platforms (Facebook/Instagram). This processes, among other things, online identifiers and event data about your use.

A full list of the individual cookies, their purposes and storage periods can be found in our Cookie Policy. For data transfers to the USA, see Section 5.

3.4 Contacting us

If you contact us by email, telephone or contact form, we process the data you provide (e.g. name, email, phone number and your enquiry) in order to handle your request.
Legal basis: handling your request and pre-contractual measures (Art. 6(1)(b) GDPR) or legitimate interest in communication (Art. 6(1)(f) GDPR).

3.5 Event and franchise inquiry forms

Via our inquiry forms (event and franchise inquiries) we process the data you provide (e.g. name, company, email, phone, location, details of your request) in order to respond to your inquiry and prepare a possible contractual relationship. The forms are provided via our hosting platform Framer, and the entries are processed on our behalf.
Legal basis: pre-contractual measures / contract initiation (Art. 6(1)(b) GDPR) and legitimate interest in handling business inquiries (Art. 6(1)(f) GDPR).

Note: Any conversion measurement of a form submission (e.g. "Lead" events in Google Analytics 4 or the Meta Pixel) only takes place if you have consented to the corresponding cookies.

3.6 Newsletter

By providing your email address when subscribing, you allow us to send you information about our products and services. Sign-up uses the double opt-in procedure [please confirm this is implemented]. You can unsubscribe at any time (by email to office@vbr-innovations.com or via the unsubscribe link in any newsletter email). For dispatch we use HubSpot (HubSpot Ireland Limited) as a processor. The data is hosted in HubSpot's EU data centre (Frankfurt, Germany). Access by the US parent company HubSpot, Inc. cannot be entirely ruled out; see Section 5.
Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable with future effect.

3.7 Event registration

When you register for events we organise, we process the data you provide (e.g. name, email, company) to add you to the guest list and run the event.
Legal basis: contract or pre-contractual measures (Art. 6(1)(b) GDPR).

3.8 Videos on our website

The videos shown on our website are not embedded via external video platforms (such as YouTube or Vimeo). We host them ourselves:

• via the content delivery network of our hosting platform Framer (see Section 3.2), and

• via a Nextcloud instance we operate ourselves on servers located within the EU.

Playing a video therefore transmits no data to third-party providers and sets no tracking cookies. Only the technically necessary access data (in particular IP address, time and file requested) is processed to deliver the video; this is handled as described in Section 3.1 and stored in server logs only for the period stated in Section 6.
Legal basis: legitimate interest in presenting our content and in the secure operation of the website (Art. 6(1)(f) GDPR). No consent is required for this.

3.9 Social media profiles

We link to our profiles on Instagram, TikTok, LinkedIn, X and YouTube. If you follow these links, the privacy terms of the respective provider apply. You only leave our website by clicking; the mere presence of the link on our site does not transmit data to those providers.

4. Recipients / processors

We only share your data where necessary to fulfil the purposes above, where you have consented, or where there is a legal obligation. Service providers we use process data on our behalf under agreements pursuant to Art. 28 GDPR. Categories of recipients:

• Hosting / website infrastructure: Framer B.V. (Netherlands)

• Web analytics: Google Ireland Limited / Google LLC (USA)

• Marketing / reach measurement: Meta Platforms Ireland Ltd. (Ireland) / Meta Platforms, Inc. (USA)

• Newsletter dispatch: HubSpot Ireland Limited (data hosted in EU/Frankfurt; parent company HubSpot, Inc., USA)

• Video delivery: Framer B.V. (Netherlands) and our own Nextcloud instance on servers in the EU (no third-party video service)

• Tax advisors, IT service providers, authorities within the legally prescribed scope

5. Data transfers to third countries (USA)

When Google Analytics 4 and the Meta Pixel are used, personal data may be transferred to the USA. This transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF) of 10 July 2023; Google LLC and Meta Platforms, Inc. are certified under the DPF (Art. 45 GDPR). In addition, EU Standard Contractual Clauses (Art. 46 GDPR) apply.

Newsletter data is hosted via HubSpot in its EU data centre (Frankfurt); any access by the US parent company HubSpot, Inc. is safeguarded by its DPF certification and EU Standard Contractual Clauses.

Videos are delivered exclusively via our own or EU-based infrastructure (see Section 3.8); no third-country transfer takes place in this context.

Note: The adequacy decision is currently valid; an appeal is pending before the Court of Justice of the European Union (Case C-703/25 P). Despite these safeguards, access by US authorities cannot be entirely ruled out. Where you consent to statistics or marketing cookies, you also consent to the associated transfer (Art. 49(1)(a) GDPR).

6. Storage periods

We store your data only for as long as necessary for the purposes described and for our legal obligations. In particular:

• Server log files: for technical reasons, only as long as necessary, typically between 1 and 30 days; longer retention only where required for security or operational purposes and permitted by law.

• Inquiries (contact/forms): until your request has been fully handled; then deleted, unless statutory retention obligations apply.

• Contract and invoicing data: in line with tax and commercial retention periods (in Austria generally 7 years, Section 132 BAO).

• Newsletter: until you withdraw consent.

• Cookies: as set out in the durations in the Cookie Policy.

7. Your rights

Under the GDPR you have, in particular, the following rights:

– Access to your stored data (Art. 15)
– Rectification (Art. 16)
– Erasure (Art. 17)
– Restriction of processing (Art. 18)
– Data portability (Art. 20)
– Objection to processing (Art. 21)
– Withdrawal of consent with future effect (Art. 7(3))

You also have the right to lodge a complaint with a supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria · dsb@dsb.gv.at · www.dsb.gv.at

If you reside in Germany, you may also contact the data protection authority responsible for your place of residence.

8. Data security

For security reasons and to protect the transmission of confidential content, our website uses TLS/SSL encryption. You can recognise an encrypted connection by the "https://" in the address bar and the lock symbol in your browser.

9. Changes to this Privacy Policy

We will update this Privacy Policy when our data processing or the legal situation changes. The current version published here applies (see date above).

10. Contact / controller

VBR Innovations GmbH
FN 550779 w · Grestner Straße 9, 3341 Ybbsitz, Austria
office@vbr-innovations.com · +43 660 1256703