Privacy

The following information informs you in accordance with the provisions of the EU General Data Protection Regulation (GDPR) about the following aspects:

• Collected information
• Legal basis for data processing
• Use and storage of data
• Your rights and choices

The following sections inform you about the processing of your personal data.

You fundamentally have the right to information, correction, deletion, restriction, data portability, revocation and objection regarding your personal data. If you believe that the processing of your data is unlawful or that your data protection rights have been violated, you can complain to the supervisory authority.

In Austria, this is the Data Protection Authority: https://www.dsb.gv.at

You may also turn to the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 Para. 1 GDPR). For data subjects in Germany, this is the competent state data protection authority.

Fundamentally, we do not share your data with third parties and do not engage in profiling. One clarification: if you have given your consent in the public area of this website, data is transmitted to Google in order to measure the effectiveness of our advertisements. Google acts as our processor in doing so and is therefore not a third party within the meaning of the GDPR. You can find the details in the "Google Ads" section.

When you access our website, the web server automatically stores certain data in log files. This serves to trace and defend against unauthorized access (e.g., hacker attacks). The following data may be stored, for example:

• Requested element
• Accessed URL
• Operating system
• Date and time
• Browser type and version
• IP address
• Protocol used

We use this data pursuant to Art. 6 Para. 1 lit. f GDPR to ensure the technical operation of our website, to fix errors and to prevent misuse. The log files are deleted after 90 days; a longer storage only takes place if and for as long as it is necessary to defend against or prosecute concrete attacks, or if statutory retention obligations require it.

For secure transmission of data between your computer and our web server, we use https. By using the TLS (Transport Layer Security) encryption protocol, we ensure the protection of your data during transmission. The active certificate is usually displayed with a key symbol in your Internet browser.

Our website uses cookies to store certain states (e.g., a language selection you make). A cookie is a small file generated by the web server, sent to your browser and then stored in your browser's cache. When you visit the website again, the cookie is read and the information it contains is used to display the website.

You can configure your browser to not allow cookies, or to delete or deactivate cookies on your computer at any time. If you reject all cookies, our website may not display correctly or may not function.

Apart from Google Ads, which we only activate with your consent and which is described separately below, we use exclusively technically necessary cookies and process the data pursuant to Art. 6 Para. 1 lit. f GDPR to ensure the technical operation of our website. These are:

• csrftoken – protection against cross-site request forgery; set as soon as you access a page containing a form
• sessionid_frontend – your session, for example after you have logged in
• siponline_language – the interface language you have selected
• sip_consent – your decision regarding the Google Ads consent, stored for twelve months so that we do not have to ask you again on every visit. This cookie is technically necessary and does not itself require consent.

For certain services for contacting us or booking trainings, we provide contact forms. These serve the following purposes:

• Contact form: contacting you according to your specified data, sending information brochures and letters
• Online booking of trainings: contacting you according to your specified data, sending information brochures and letters, training organization, preparation and follow-up as well as billing
• Application form: recording and processing your application, contacting you according to your specified data

We store and process the following data for the above purposes – the following data relates to information about natural persons:

• Full name
• Salutation (title and gender)
• Assigned company
• Position in the company
• Phone (business)
• Mobile phone (business)
• Fax (business)
• Email address (business)
• Email address (private, if provided)
• Address (delivery address)
• Desired and undesired contact methods (email, phone, mail, electronic communications)
• Booked and attended trainings from Spirit in Projects
• Exam vouchers from external examiners booked through us
• In-house exams from external examiners booked through us
• Personal areas of interest in specialist topics and trainings from Spirit in Projects

By submitting your data, you consent to its processing for the stated purposes. We process your data on the basis of consent pursuant to Art. 6 Para. 1 lit. a GDPR as well as for the fulfillment of (pre-)contractual obligations pursuant to Art. 6 Para. 1 lit. b GDPR. The data is stored until you revoke your consent, or for as long as statutory retention obligations require it, and is not shared with third parties.

After a live online training, participants can rate it in the participant area. The rating is voluntary and possible only for registered participants of that training. We use it to assure and improve the quality of our trainings.

From the question "I can recommend this training" we calculate an average value per course and publish it on the respective course page. Published are only that average and the number of ratings it is based on. Individual ratings, names and free-text answers are never published; they remain accessible to us internally only. We publish an average only from five ratings across at least two separate training runs, so that no individual answer can be inferred from it, and we update the published value monthly rather than continuously.

The published average contains no personal data. We process the underlying individual ratings on the basis of our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in presenting the quality of our trainings verifiably. You may object to the use of your rating at any time pursuant to Art. 21 GDPR – it is then removed from the calculation. Please use the contact details given above.

We use the web analytics service Matomo to analyze the use of our website and to continuously improve it. The legal basis for using Matomo is Art. 6 Para. 1 lit. f GDPR (legitimate interest in reach analysis).

Matomo is configured so that no tracking via cookies takes place. The IP address is shortened by 2 bytes immediately after capture (e.g., 192.168.xxx.xxx). As a result, it is only processed in pseudonymized form; direct identification of individual visitors is excluded.

Data processing takes place via the Matomo Cloud, a service of InnoCraft Ltd. (Matomo), with server locations within the European Union. Data is not shared with any other third parties.

Data is deleted after 14 months (426 days). Further information on data protection at Matomo can be found at https://matomo.org/privacy/

In the public area of this website – home page, training, course, certification and booking pages – we use Google Ads to measure the effectiveness of our advertisements. This tells us which advertisement led to a booking or an enquiry.

No Google services whatsoever are used in the training platform – that is, wherever you learn while logged in, take examinations or retrieve certificates. This separation is technically enforced: the security policy of our pages (Content Security Policy) permits connections to Google only in the public area; in the training area your browser would block them.

Google Ads is only activated with your consent. As long as you have not consented, the Google script is not loaded and not a single request is sent to Google – not even an anonymous one. The legal basis is your consent pursuant to Art. 6 Para. 1 lit. a GDPR, in conjunction with Section 165 Para. 3 of the Austrian Telecommunications Act 2021 (TKG 2021) and Section 25 Para. 1 of the German Digital Services Data Protection Act (TDDDG).

You can withdraw your consent at any time with effect for the future, using the "Cookie settings" link in the footer of every page. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

After your consent, the following data is processed: your IP address, information about your browser and device, the pages of our public area that you access, the Google click identifier (gclid) of the advertisement through which you arrived, and the event triggered – for example a completed booking together with its order value. In doing so, Google stores cookies on your device, among them _gcl_au with a lifetime of usually 90 days.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and thus to a third country, cannot be ruled out. That transfer is based on the adequacy decision of the European Commission concerning the EU-US Data Privacy Framework, to which Google LLC has subscribed, supplemented by standard contractual clauses pursuant to Art. 46 Para. 2 lit. c GDPR. Despite these safeguards, access by US authorities to your data cannot be entirely excluded. By giving your consent you also consent to this transfer.

Processing on Our Behalf

Google processes this data on our behalf and on our instructions. The basis is a data processing agreement pursuant to Art. 28 GDPR – the data processing terms for Google advertising products, which form part of our agreement with Google. We remain the controller for this processing; you therefore assert your rights under Art. 15 to 22 GDPR against us. You will find our contact details above under "Your Rights".

Independently of our consent request, you can deactivate personalised advertising in your Google account settings at https://adssettings.google.com/. Further information on data processing by Google can be found at https://policies.google.com/privacy

On our contact and course pages we offer a form with which you can send us an enquiry. We process the details you enter there — your name, your email address and, if provided, your telephone number and company — solely in order to answer your enquiry and, where applicable, to prepare an offer.

Mandatory are only your name, your email address and your message; all other fields are optional. Along with your enquiry we transmit the page from which you sent it and, if you reached us through an advertisement, the click identifier of that advertisement. This tells us which advertisement led to your enquiry. We do not draw any conclusions about you personally from this.

The legal basis is the performance of a contract or steps preparatory to a contract pursuant to Art. 6 Para. 1 lit. b GDPR, and otherwise our legitimate interest in answering enquiries addressed to us pursuant to Art. 6 Para. 1 lit. f GDPR.

Your enquiry is sent to us by email and is not stored in a separate database. We keep it for as long as it takes to deal with your enquiry conclusively, and beyond that only for as long as statutory retention obligations require.

We protect some forms on this website against automated misuse with a captcha from the provider captcha.eu. You do not have to click anything or solve a picture puzzle for it. It is used in these places:

• when you register a user account yourself
• when you register with a voucher
• when you request a new password
• when you log in, once three login attempts from your IP address have failed within fifteen minutes
• when you submit an enquiry form, where we offer one – on the contact and course pages and on the separate enquiry page

For the enquiry form on our contact and course pages, the captcha is loaded only when you submit the form; on the other pages it is loaded when the page opens. Your browser then connects to captcha.eu – first to load the provider's script from www.captcha.eu, then to retrieve a computational task from there. In doing so, captcha.eu receives your IP address and the details your browser sends with every request, in particular the browser and device identification (user agent). These details go directly from your device to the provider; they are personal data, and without them the computational task cannot be retrieved.

Your browser solves the computational task itself (proof of work). The solution is sent to us together with the form; our server then has it checked by captcha.eu. Your browser is not involved in this check, and we do not transmit any further details about you in the process. From the response we evaluate only whether the computational task was solved. We do not store the solution: our server discards it after the check, and no record of our own is created. How long captcha.eu retains the connection data arising from the retrieval is governed by the provider's own information.

The recipient of this data within the meaning of Art. 4 No. 9 GDPR is captcha.eu, a service with servers within the European Union; no transfer to a third country takes place. The legal basis is our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in protecting our forms and login procedures against automated misuse – against mass-sent enquiries, against the mass creation of accounts and against the automated trying out of passwords. We ourselves do not set a cookie on your terminal equipment for the captcha. Insofar as the procedure stores information on your terminal equipment or reads information already stored there – for example in order to run the computational task in your browser – this is strictly necessary to enable the submission of the form that you have expressly requested; we therefore do not need your consent for it (the final sentence of Section 165 Para. 3 of the Austrian Telecommunications Act 2021 (TKG 2021) and Section 25 Para. 2 No. 2 of the German Digital Services Data Protection Act (TDDDG)).

Our website contains links to Google Maps by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Maps is not embedded on our website; a connection to Google is only established when you actively click on such a link. No data is transmitted to Google until then. Information on the data processed by Google and its use can be found at https://www.google.com/intl/en/policies/privacy/

As a matter of principle, we do not transfer your personal data to third countries outside the European Union or the European Economic Area. Our hosting provider and the web analytics service Matomo are located within the EU. There are two exceptions. First, when you actively click on a link to Google Maps (USA); in that case Google processes data in the USA on the basis of your own action. We do not use embedded Google Maps content that would transmit data to Google automatically. Second, when you have consented to Google Ads in the public area of this website – the details, including the safeguards for that transfer, are set out in the "Google Ads" section. In the training platform, no transfer to a third country takes place under any circumstances.