Data Privacy Statement

Privacy policy of AnyIdea GmbH, hereinafter referred to as “AnyIdea”.

General principle

AnyIdea is pleased that you are interested in our services. We take the protection of personal data seriously and take the necessary precautions so that you feel comfortable using our services, on our website and in the AnyIdea portal.

Protecting your privacy is very important to us. It is therefore a matter of course for us to comply with legal regulations on data protection. Our employees are regularly trained on data protection and data security. In the following, we would like to show you how we handle your personal data as part of our website and our digital content and products and how we protect this data.

Insofar as our website and our digital content and products refer to external sites from other providers (links), you are leaving our offer through these links. Only their operators and not AnyIdea are responsible for compliance with the data protection regulations on these linked sites.

Person responsible

AnyIdea GmbH
Steingasse 6a, 4020 Linz
austria

Data Protection Officer: DI (FH) Harald Weinberger
contact: daten@anyidea.ai

Scope of data processed

In principle, we only process our users' personal data to the extent necessary to provide a functional website and the content and services we offer. Personal data is processed on the basis of the currently applicable legal bases.

Types of data processed

• Inventory data, e.g. name, country
• Contact details, e.g. email, telephone number
• Content data, e.g. text entries, photos, videos
• Usage data, e.g. websites visited, interest in content, access times
• Meta/communication data, e.g. browser, device information, IP addresses

Categories of affected persons

• Visitors and users of our website, hereinafter referred to as “users”.
• Users of our AnyIdea portal, other digital services, content and products.

Purpose of processing

• carrying out the business operations of AnyIdea,
• providing and operating our digital offerings, their functions and content,
• answering contact requests and communication,
• safety measures,
• Reach measurement and marketing.

We process the data of our visitors, users and customers as part of our contractual services, which include the operation of AnyIdea, the implementation of campaigns, communication within the framework of these, optimization of our services, server administration, data analysis and statistics.

The purpose of processing is to provide contract services, billing, our customer service (analysis, statistics, optimization) and security measures. We process data that is necessary to establish and fulfill the contractual services and point out the need to provide them. Disclosure to external parties only takes place if it is necessary as part of an assignment. When processing the data provided to us as part of an order, we act in accordance with the instructions of the client and the legal requirements of order processing in accordance with Article 28 GDPR and do not process the data for purposes other than those in accordance with the order.

Administration, financial accounting, office organization, contact management

We process data as part of administrative tasks, organization of our operations, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process as part of the provision of our contractual services. Customers, interested parties, business partners, users and website visitors are affected by the processing. The purpose and our interest in processing lies in administration, financial accounting, office organization, archiving of data, i.e. tasks that serve to maintain our business activities, perform our tasks and provide our services. The deletion of data with regard to contractual services and contractual communication corresponds to the information provided for these processing activities.

In doing so, we disclose or transfer data to tax authorities, consultants, such as tax advisors or auditors, as well as other fee agencies and payment service providers.

On the basis of our business interests, we also store information about suppliers, organizers and other business partners, e.g. for the purpose of contacting you later. We generally store this mostly company-related data permanently.

Sharing personal data

We will only share your personal data with third parties if

• this is necessary to carry out an existing contractual relationship with you,
• it is necessary to protect our legitimate interests or those of a third party, unless the interests or fundamental rights and freedoms of you (the data subject) which require the protection of personal data prevail.
• we are required by law to
• this is necessary to enforce our claims and rights,
• we receive inquiries from regulatory bodies (e.g. supervisory authorities or law enforcement agencies, if disclosure is necessary to avert threats to public safety and order and to prosecute criminal offences).

However, as part of such a transfer, personal data may only be used for the respective purpose.

Safety measures

In accordance with Article 32 GDPR, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the different probability of occurrence and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

The measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical access to the data as well as access to, input, transfer, availability and separation of data. We have also set up procedures that ensure the exercise of data subject rights, deletion of data and response to data risks. In addition, we take the protection of personal data into account right from the development or selection of hardware, software and processes, in accordance with the principle of data protection through technology design and through privacy-friendly default settings.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or this is done as part of the use of third-party services or disclosure or transfer of data to third parties, this is only done if it is done to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Processing is carried out, for example, on the basis of special guarantees, such as the officially recognized determination of a level of data protection equivalent to the EU (e.g. for the USA through the “Privacy Shield”) or compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).

Deletion of data

Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its purpose and the deletion does not conflict with any legal storage requirements. If the data is not deleted because it is necessary for other and legally permitted purposes, its processing will be restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons.

Rights of data subjects

• You have the right to request confirmation as to whether the relevant data is being processed and to obtain information about this data in accordance with Article 15 GDPR.
• In accordance with Article 16 GDPR, you have the right to request the completion of the data concerning you or the correction of incorrect data concerning you.
• In accordance with Article 17 GDPR, you have the right to have the relevant data deleted immediately or, alternatively, to request that the processing of the data be restricted in accordance with Article 18 GDPR.
• You have the right to request that the data concerning you that you have provided to us be received in accordance with Article 20 GDPR and to request that it be transmitted to other responsible persons.
• You have the right to withdraw your consent in accordance with Article 7 (3) GDPR with effect for the future.
• You can object to the future processing of data concerning you at any time in accordance with Article 21 GDPR. In particular, the objection may be made against processing for direct marketing purposes.

Cookies

“Cookies” are small files that are stored on computers. Various information can be stored within cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or even after their visit to an online offer. Temporary cookies, or “session cookies” or “transient cookies,” are cookies that are deleted after you leave the online service and close the browser. Such a cookie can store, for example, the content of a shopping cart in an online shop or a login status. Cookies that remain stored even after the browser is closed are referred to as “permanent” or “persistent”. For example, the login status can be saved. Such a cookie can also store interests that are used for audience measurement or marketing purposes. “Third party cookies” are cookies that are offered by providers other than the person responsible for operating the online offer (otherwise, if they are only their cookies, they are referred to as “first-party cookies”).

We can use temporary and permanent cookies and explain this as part of our privacy policy.

If you do not want cookies to be stored on your computer, you will be asked to deactivate the corresponding option in your browser's system settings. Saved cookies can be deleted in the browser's system settings. The exclusion of cookies may result in functional restrictions of this online offer.

Contact

When you contact us (e.g. via contact form, e-mail, telephone or via social media), information that you provide is processed to process the contact request and process it. The information can be stored in a help desk, customer relationship management system (“CRM system”) or comparable request organization.

We delete the requests if they are no longer required. We review the requirement every two years; the legal archiving obligations also apply.

Newsletter

With the following information, we will inform you about the content of our newsletter as well as the registration, shipping and statistical evaluation procedures as well as your rights of objection. By subscribing to our newsletter, you agree to receive it and to the procedures described.

Content of the newsletter: We send newsletters, emails and other electronic notifications with promotional information (hereinafter “newsletter”) only with the consent of the recipients or legal permission. If, as part of a subscription to the newsletter, its content is specifically described, they are decisive for consent. In addition, our newsletters contain information about our services and accompanying information (e.g. security information), offers, promotions and our company. We are interested in using a user-friendly and secure newsletter system that serves both our business interests and meets your expectations and also allows us to prove consent.

Registration for our newsletter takes place in a so-called double opt-in process. This means that after registration, you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with foreign email addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements.

You can unsubscribe from our newsletter at any time, i.e. withdraw your consent. A link or email address to cancel the newsletter can be found at the end of each newsletter. We can store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time.

Performance measurement: The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file, which is retrieved from our server when the newsletter is opened or, if we use a shipping service provider, from their server. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and time of retrieval, are first collected.

This information is used to technically improve the services based on technical data or target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. Statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. The evaluations are much more useful for us to identify reading habits and adapt our content to them or to send different content based on our interests.

Unfortunately, it is not possible to cancel the performance measurement separately; in this case, the entire newsletter subscription must be cancelled.

CRM system

We use the Salesmate CRM system from Rapidops, Inc., 525 N Tryon St, Suite 1600Charlotte, NC 28203 USA. This enables us to cover various aspects of our sales, service, consulting and online marketing processes.

Salesmate is certified under the Privacy Shield Agreement and thus offers an additional guarantee that it will comply with European data protection law if data is processed in the USA. On July 16, 2020, the Court of Justice of the European Union (the “ECJ”) issued a ruling invalidating the EU-US Privacy Shield Framework as a valid basis for transferring data from the EU to the United States. The ECJ concluded that the standard contractual clauses (SCCs) issued by the European Commission for the transfer of personal data to data processors based outside the EU represent a valid basis for the transfer. Salesmate's terms and conditions automatically apply the protection of SCCs to all customers based in the EU.

Salesmate only uses user data for technical processing of inquiries and does not pass them on to third parties.

If you do not agree to data processing in the external Salesmate system, we offer you alternative contact options for submitting service requests by e-mail or telephone.

Further information and details can be found in the Privacy statement by Salesmate.

Hosting and servers

The hosting services we use are intended to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services that we use for the purpose of operating this online offer.

AnyIdea uses the company Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany as a hosting provider. The servers and data are hosted and processed in the EU.

In doing so, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data from users on the basis of our legitimate interests in providing this online service efficiently and securely.

On the basis of our legitimate interests, we, or our hosting provider, collect data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the retrieved website, file, date and time of retrieval, amount of data transferred, message of successful retrieval, browser type and version, the operating system, referrer URL (the previously visited page), IP address and the requesting provider.

Log file information is stored for a period of 30 days for security reasons (e.g. to investigate abusive or fraudulent acts) and then deleted. Data whose further storage is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

Email delivery

For the automated sending of user and system-relevant emails, we use the SendGrid Twilio below:

- Twilio Inc., 101 Spear St, Ste 500, San Francisco, CA 94105.
- Twilio Ireland Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland.

This enables us to send relevant user notifications for informational and security purposes.

Twilio is certified under the Privacy Shield Agreement and thus offers an additional guarantee of compliance with European data protection law if data is processed in the USA. On July 16, 2020, the Court of Justice of the European Union (the “ECJ”) issued a ruling invalidating the EU-US Privacy Shield Framework as a valid basis for transferring data from the EU to the United States. The ECJ concluded that the standard contractual clauses (SCCs) issued by the European Commission for the transfer of personal data to data processors based outside the EU represent a valid basis for the transfer. These SCCs are part of the Data Protection Addendum, which covers all SendGrid and Twilio services as standard and applies to everyone.

Twilio uses the data purely for the technical processing of inquiries and does not pass them on to third parties.

If you do not agree to data processing by Twilio, please contact our data protection contact regarding deactivation.

Further information and details can be found in the Privacy statement from SendGrid and the Privacy statement by Twilio.

‍

Google Analytics

On the basis of our legitimate interests (i.e. interest in analyzing, optimizing and operating our online offering economically), we use Google Analytics, a web analysis service provided by Google LLC (“Google”). Google uses cookies. The information generated by the cookie about the use of the online offer is usually transmitted to a Google server in the USA and stored there.

Google is under the Privacy Shield Agreement certifies and thus offers a guarantee of compliance with European data protection law.

Google will use this information on our behalf to evaluate the use of our online offer, to compile reports on activities within this online offer and to provide us with other services related to the use of this online offer and Internet usage. Pseudonymous user profiles can be created from the processed data.

We only use Google Analytics with activated IP anonymization. This means that the IP address is abbreviated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and abbreviated there.

The IP address transmitted by a browser is not combined with other data from Google. You can prevent cookies from being stored by setting your browser software accordingly; you can also prevent Google from collecting the data generated by the cookie and related to your use of the online offer and from processing this data by Google by using the following link Download and install the available browser plug-in.

For more information about Google's use of data, settings and objection options, please see Privacy statement from Google and in the settings for the display of Advertisements through Google.

Online presence on social media

We maintain online presences within social networks and platforms, such as Facebook, Twitter, Instagram, in order to communicate with customers, interested parties and users active there and to inform them about our services there. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.

Unless otherwise stated in our privacy policy, we process data if they communicate with us within social networks and platforms, e.g. write posts on our online presences or send us messages.

Integration of third-party services and content

On the basis of our legitimate interests (i.e. interest in analyzing, optimizing and operating our online offering economically), we use content or service offerings from third-party providers to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).

This always requires that the third-party providers of this content recognize the IP address, as they would not be able to send the content to their browser without the IP address. The IP address is therefore required to display this content. We make every effort to use only content whose respective providers only use the IP address to deliver the content. Third parties can also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on users' devices and include technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offer, as well as be linked to such information from other sources.

YouTube

We integrate the videos from the “YouTube” platform from the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy statement, Opt-out.

Google Maps

We integrate maps from the “Google Maps” service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. In particular, the processed data may include IP addresses and location data, which, however, will not be collected without their consent (usually as part of the settings of their mobile devices). The data can be processed in the USA. Privacy statement, Opt-out.

Using AnyIdea

AnyIdea is a co-creation and idea platform on which companies can generate and further develop innovative ideas, concepts and solutions.

Your personal data is collected and processed when you voluntarily join our AnyIdea platform www.anyidea.ai register and have agreed to verify the login via a Double OptIn

Data collection and purpose limitation

When carrying out idea and/or innovation campaigns, we only use data that comes directly and personally from you. This includes information from participation in previous campaigns and, if applicable, other information that you provide by entering your profile. Your data is used exclusively for the purpose of initiating and carrying out campaigns.

What personal data do we store

To identify you, we store and process: first name, last name, email address, country, campaigns in which you have participated and idea that you have submitted in these campaigns.

Depending on the additional data you have entered, we store and process:

• Ideas likes and views, points, photo, company, department, position.
• Personal preferences: Interests, companies and campaigns in which you are interested.
• Contact details: telephone or mobile number.

What do we use your data for?

Your data is processed to suggest appropriate campaigns to you and to enable you to participate in them. For this purpose, we will usually contact you via an e-mail request, push notifications and, in exceptional cases, by telephone, e.g. notification of the prize.

We also process your data to maintain our relationship with you and to send you information about upcoming or future projects via email.

If you have confirmed your participation in an innovation community, we process your data to carry out the project.

Amendment to the privacy policy

We reserve the right to adapt this privacy policy when introducing or changing new services and products so that they comply with current legal requirements. When you visit our website again or use our services and products, the latest version will then apply.

Questions and comments

If you have any questions or suggestions regarding data protection at AnyIdea, please feel free to contact our data protection officer by email.

Linz, January 2025

‍