Privacy policy

usethismoment.com/en · As of: [date of publication] · Version v09 (draft, English) · Based on the German privacy policy v09

1. Who is responsible for your data

Adrienn Kühl, sole trader
Schönbrunngasse 32c, 8010 Graz, Austria
Email: info@usethismoment.com · Phone: +43 676 70 74 006

usethismoment is a product brand of Adrienn Kühl. We have not appointed a data protection officer because the law does not require one for us. If you have questions about data protection, please write to info@usethismoment.com. You may write in English, German or Hungarian.

2. The key points

• We do not use cookies for advertising or statistics, and we do not use any analytics or advertising services. That is why there is no cookie banner on this website.
• Fonts and images are stored on our own server. Viewing our pages does not send any data to Google or other third parties.
• We need your email address for a purchase. Stripe handles the payment; we do not see your card details.
• We keep receipts for seven years because tax law requires it. We delete everything else sooner.

3. Visiting the website

When you open a page, our server processes technically necessary data: IP address, date and time, the address requested, the page you came from, browser and operating system, and the status code of the response.

• Purpose: delivering the pages, server security, defending against attacks and fixing errors.
• Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
• Retention: the logs are deleted automatically after [14] days. If we need an entry to investigate an attack, we keep it until the investigation is complete.
• Hosting: an IT service provider rents and maintains the server on our behalf (processor, Art. 28 GDPR). The server is located at Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany, in the data centre of its “European Union” region (according to Contabo in Lauterbourg, France). Contabo acts as a further processor (sub-processor).

You can download the sample cards without signing up. Only the data listed above is processed.

Our pages do not set cookies. The exception is Stripe's payment area (section 4).

4. Purchase and payment

4.1 What we process when you order

• email address, order number, products bought, price, date and time,
• country of the billing address, country of issue of the card, payment method and, if Stripe asks for it, your name (of which we store only the first name for addressing you),
• your declarations before the purchase (consent to immediate supply and acknowledgement of the loss of the right of withdrawal) with the time they were given,
• for the download: a random code for your personal link (we store only a hash value from which the code cannot be recovered), the number of downloads, when they took place and which file was downloaded.

You enter payment details (card number, account details, Apple Pay or Google Pay data) directly with Stripe. We only learn whether the payment succeeded, the payment method, the card's country of issue and the Stripe payment reference. We need the country to check that you live in the sales area (terms, section 1.5). In the Stripe dashboard we can also see, among other things, the last four digits of the card; we use them only to verify that an order is yours when you contact us (for example about a changed email address). We do not store them on our server.

• Purpose: concluding and performing the contract, supplying the files, contract confirmation and receipt, proof of your declarations on the right of withdrawal, accounting.
• Legal basis: contract (Art. 6(1)(b) GDPR); keeping receipts under the Austrian Federal Fiscal Code (Art. 6(1)(c) GDPR in conjunction with § 132 BAO); proof of your declarations on the right of withdrawal based on legitimate interest (Art. 6(1)(f) GDPR).
• Required: without an email address we cannot deliver the files or conclude the contract.

4.2 Stripe

Payments are handled by Stripe. For customers in Europe, our contractual partner is Stripe Payments Europe, Limited, based in Ireland; Stripe Technology Company, Limited, also in Ireland, is Stripe's main establishment in the EU.

• Stripe processes payment data on our behalf to carry out the payment (processing on behalf).
• For its own purposes, Stripe is a controller in its own right, for example for fraud prevention, compliance with financial regulations and cooperation with banks. Stripe also checks payments automatically. This can lead to a payment being declined. Stripe's privacy policy applies to this processing: stripe.com/privacy.
• Stripe may transfer data to companies of the Stripe group in the USA. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Stripe is certified, and on the European Commission's standard contractual clauses.

Stripe keeps the payment data, including email address and name, under its own rules, also because payment service providers are legally required to do so. This is governed by Stripe's privacy policy, not by section 4.3.

We load Stripe's payment area only when you click “Continue to payment” or “Buy as a gift”. Only then does your browser connect to Stripe's servers. Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention (§ 165(3) Austrian Telecommunications Act 2021).

4.3 Retention

• Receipt and order data without your name and without your email address (order number, products, price, date, payment method, country, Stripe payment reference, any refund): seven years from the end of the calendar year in which the purchase took place (§ 132 BAO). We keep the receipt as a copy without your name and without your email address. Via the Stripe payment reference the data can still be linked to you.
• Proof of your declarations on the right of withdrawal: together with the order data.
• Your email address, your first name, the download link code and the download data: as long as we send you new links (terms, section 5.2), that is, for two years after purchase, then deleted; if we send a new link shortly before this period ends, until that link expires (at most 30 days). Until then we need them to send you a new link. When they are deleted, the personal link to the Course Licence Add-on (terms, section 8.4) also stops working. This also applies if we refunded the price after a withdrawal; in that case we keep the details for questions and chargebacks (Art. 6(1)(f) GDPR).
• Rejected orders for which we refunded the payment (for example, residence outside the sales area, terms, section 1.5): email address and name for 120 days from the order so that we can deal with questions about the refund and with card chargebacks (Art. 6(1)(f) GDPR), then deleted. If the refund has not been completed by then, we keep them until it has. We keep the other details of the payment and the refund for seven years from the end of the calendar year (Art. 6(1)(c) GDPR in conjunction with § 132 BAO).
• If proceedings concerning an order are pending (for example, a complaint, a legal dispute or a request from an authority), we delete the data concerned only once they are concluded.

5. Order emails

We send the contract confirmation, the download link and the acknowledgement of an online withdrawal via the email service Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France) [confirm contracting entity from Brevo contract]. Brevo processes your email address, the content of the email and delivery data (for example, whether the email was accepted) on our behalf (Art. 28 GDPR). Brevo stores the data in the EU but uses sub-processors that may process data outside the EU, including in the USA and India [check against the sub-processor list in the Brevo DPA]. This is based on the European Commission's standard contractual clauses and, for certified recipients in the USA, the adequacy decision for the EU-US Data Privacy Framework.

We have switched off the tracking of opens and clicks for these emails.

• Legal basis: contract (Art. 6(1)(b) GDPR).
• Retention: at Brevo, delivery logs [per Brevo setting, e.g. 90 days]. On our server we delete the content of the email right after sending and the sending record after 90 days. We keep the receipt from the contract confirmation as a copy without your name and without your email address with the order data (section 4.3).

We only send you marketing emails if you have expressly signed up for them (section 8).

6. Buying as a gift

If you buy a card set as a gift, we also process the recipient's name and email address, your message and the name by which you want to be referred to in the email to the recipient.

• Purpose: delivering the download link to the recipient.
• Legal basis: our legitimate interest and the buyer's legitimate interest in delivering the gift (Art. 6(1)(f) GDPR).
• Source: the data comes from the buyer. The recipient receives a short notice referring to this privacy policy in the email with the download link (Art. 14 GDPR).
• Retention: as long as we send new links (section 4.3), then deleted. The recipient's data does not appear on the receipt.

We do not use the recipient's address for anything else.

7. Contact by email

If you write to us, we process your email address, your name and the content of your message to answer your request. For questions about an order, the legal basis is the contract (Art. 6(1)(b) GDPR); otherwise it is our legitimate interest in answering requests (Art. 6(1)(f) GDPR). The mailbox info@usethismoment.com is hosted by Google (Google Workspace, Google Ireland Limited, Dublin, Ireland; sections 10 and 11). We delete messages once the request has been dealt with and no retention obligation applies, at the latest after three years (Hungarian consumer law requires complaints to be kept for this period). Messages that belong to an order are kept with the order data.

8. Newsletter [only if offered on usethismoment.com]

If you sign up for the newsletter, we process your email address and, if you wish, your first name to send you the newsletter. Your sign-up only takes effect once you confirm it via the link in our confirmation email. We store the time of sign-up and confirmation as proof. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021). You can withdraw it at any time, using the unsubscribe link in every issue or by email. The newsletter is sent via Brevo (section 5). [Decide whether opens and clicks are measured; if so, describe here.] After you unsubscribe we delete your address; we keep proof of consent and withdrawal for [three years].

9. Withdrawing from the contract online

On the page “Withdraw from contract here” you can declare your withdrawal online. For this we process your name, your email address, the order number, your statement and the date and time of receipt, and we send you an acknowledgement of receipt by email.

• Legal basis: the legal obligation to provide this function and the acknowledgement (Art. 6(1)(c) GDPR in conjunction with Art. 11a Directive 2011/83/EU and § 13a Austrian FAGG) and the contract (Art. 6(1)(b) GDPR).
• Retention: three years from receipt, so that we can show, if asked, that and how we handled the withdrawal (Art. 6(1)(f) GDPR), then deleted. The last item of section 4.3 (pending proceedings) also applies here.

10. Who receives your data

• IT service provider for operating and maintaining the server, Austria, processor,
• Contabo GmbH (hosting), Germany, data centre in France, sub-processor,
• Stripe (payment), Ireland, partly processor, partly controller in its own right (section 4.2),
• Brevo / Sendinblue SAS (email delivery), France, processor,
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (mailbox info@usethismoment.com via Google Workspace), processor,
• the tax office, as far as necessary for accounting and tax.

We do not sell data and do not pass it on for advertising.

11. Transfers outside the EU

We ourselves do not transfer data to countries outside the EU and the EEA. Stripe (section 4.2) and Brevo's sub-processors (section 5) may transfer data to third countries, based on standard contractual clauses and, for the USA, the EU-US Data Privacy Framework. Google (mailbox, section 10) may also process data in third countries for maintenance and support, based on standard contractual clauses and the EU-US Data Privacy Framework.

12. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless a retention obligation applies,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

To do so, write to info@usethismoment.com. We reply within one month. To make sure nobody else receives your data, we reply to the email address you ordered with, or ask a short question first.

You can lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live or work. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at. If you live in Switzerland, you can also contact the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. You can also take legal action before a court.

13. No automated decisions

We do not make decisions about you that are based solely on automated processing. For Stripe's automated fraud checks, see section 4.2.

14. Security

The connection to the website is encrypted (HTTPS). Download links are personal, expire after 30 days and allow at most 15 downloads. The files are not stored publicly on the server. We back up the database daily on the server and additionally via Contabo's backup function; backups are overwritten after at most 14 days; we only take server snapshots before maintenance work and also delete them after at most 14 days. Deleted data therefore also disappears from the backups no later than 14 days later.

15. Changes

If we start using new services or the law changes, we will update this privacy policy. The version published on this page applies.