Privacy policy

01 Controller

InnovationLAB GmbH, Bahnhofstraße 41, 6300 Wörgl, Austria · FN 674080w, Regional Court of Innsbruck · VAT ID ATU83268768

Data protection contact: datenschutz@heydata.eu or hallo@innovationlab.tirol

Supervisory authority: Austrian Data Protection Authority (DSB), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at

02 Legal bases

We process personal data on the basis of Art. 6(1) GDPR: consent (a), contract or pre-contractual steps (b), legal obligation (c) and legitimate interests (f). Our services are aimed exclusively at businesses (B2B). Client projects and platform services are additionally governed by the respective contracts and the data processing agreement (DPA).

03 Hosting of this website and server logs

This website runs on our own server with Hostinger International Ltd., Larnaca, Cyprus (EU), in the Frankfurt am Main data centre, Germany. A data processing agreement under Art. 28 GDPR is in place with Hostinger.

For every request the web server stores technically necessary data: IP address, date and time, requested address, status code, amount of data transferred, referring page and browser identifier. The purpose is secure operation and defence against attacks (Art. 6(1)(f) GDPR). Logs are deleted after 14 weeks at the latest.

04 No cookies, no tracking, no third-party content

This website sets no cookies and uses no analytics or advertising tools. Fonts (Bai Jamjuree), icons, images and videos are loaded exclusively from our own server; no data is transmitted to third parties such as Google when you visit. Links to other websites (e.g. Google Maps for directions, callana.ai or reference projects) only open when clicked; from then on the provider's privacy policy applies.

So that the “AI – but how?” window does not reappear on every visit, your browser stores in its local storage (localStorage) under “il_lead” only the time it was last shown and whether you sent a request. The entry contains no identifier, is never transmitted to our server and serves solely to avoid disturbing you repeatedly (§ 165(3) TKG 2021). You can delete it at any time in your browser settings.

For user accounts of our platform services we use only technically necessary cookies (session, CSRF protection) based on Art. 6(1)(b) GDPR and § 165(3) Austrian Telecommunications Act 2021. Processed there are email address, encrypted password, roles and permissions, and login and activity timestamps.

05 Appointment requests, email and phone

If you request a consultation via the form or ask for a first analysis in the “AI – but how?” window, we process your name, optionally your company, your email address or phone number, the preferred date and time, optionally your message, the selected language and, for the first analysis, the page on which you made the request. Instead of an email address you can enter a WhatsApp number there; we then reply via WhatsApp (WhatsApp Ireland Ltd., Dublin). The data is checked on our server and sent as an email to hallo@innovationlab.tirol; it is sent via the mailbox info@innovationlab.at at Hostinger International Ltd. (Cyprus) and received in a mailbox at World4You Internet Services GmbH, Linz, Austria. The data is not stored on the web server itself.

To prevent abuse we briefly store an irreversible hash of your IP address (24 hours at most) to limit the number of requests.

Calls to +43 512 385015 are first answered by Callana, our AI phone assistant. The call is processed to record your request and pass it to our team; AI language models are used for this (see 08). On request Callana puts you through to a person.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps). Requests without a contract are deleted 6 months after the last contact; if a contract is concluded, statutory retention periods apply (7 years, § 132 BAO). We don't use your data for advertising and send no automated follow-up emails.

06 Third-party services and channel integrations (platform)

Clients of our platform services (e.g. web concierge, Conversations, Callana) can connect their own access to external services such as the WhatsApp Business API, Instagram Messaging API or Facebook Messenger API. For their end customers' data we act as a processor on behalf of our clients; the client is the controller towards its end customers. Details are set out in the DPA that forms part of every client contract.

07 Processors

• Hosting: Hostinger International Ltd., Larnaca, Cyprus (Frankfurt am Main data centre)
• Email sending (info@innovationlab.at): Hostinger International Ltd., Larnaca, Cyprus
• Email receiving (hallo@innovationlab.tirol): World4You Internet Services GmbH, Linz, Austria
• AI language models (platform services and Callana only): see 08

Transfers to third countries take place only on the basis of the EU-US Data Privacy Framework or EU Standard Contractual Clauses. We'll send a complete, current list by email on request.

08 AI language models

Communication content of our platform services and of Callana is processed – on behalf of and as instructed by our business clients – by external AI providers, depending on configuration: OpenAI OpCo LLC (San Francisco, USA), Anthropic PBC (San Francisco, USA), Google LLC (Mountain View, USA) or others. Transfers to the USA rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. No automated individual decisions with legal or similarly significant effects within the meaning of Art. 22 GDPR are made; AI supports human communication.

09 Retention periods

• Server logs of this website: 14 weeks at most
• Abuse protection (IP hash): 24 hours at most
• Appointment requests and contact: 6 months without a contract, 7 years with a contract
• User accounts (platform): until the account is deleted, then statutory periods (up to 7 years, § 132 BAO)
• Session cookies (platform): until the end of the session or logout
• Communication data (platform): according to the DPA and client configuration

10 Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Please send requests to datenschutz@heydata.eu. You can lodge complaints with the Austrian Data Protection Authority (see 01).

11 Changes

We update this policy when the law or our services change. The version published here applies; registered users of our platform are informed of material changes by email.