Privacy Policy

1. Controller & contact

This policy explains the processing of personal data when you visit klimafeld.at, contact us, subscribe to our newsletter or use membership, donation and available ordering functions. The relevant framework includes the GDPR, the Austrian Data Protection Act and the Austrian Telecommunications Act 2021 (TKG 2021).

For privacy enquiries and to exercise your rights, contact the email address above. Further association details are available in our Legal Notice.

2. Website, hosting & Cloudflare

Visiting the website involves processing technical connection data, including your IP address, access time, requested URL, browser and device information, referrer and error or security events. Recipients include our technical hosting and IT service providers.

We use Cloudflare to deliver and cache website content, protect against attacks and manage technical traffic. Media are also delivered through cdn.klimafeld.at. Cloudflare receives connection and request data in this process.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, stable and efficient website. Where security functions store or access information on your device, Section 165(3) TKG 2021 also applies. Strictly necessary functions do not require cookie consent.

Provider information: Cloudflare Privacy Policy.

3. Enquiries & contact forms

When you contact us by email or form, we process the information you provide, such as your name, email address, organisation and message. Please provide only information needed for your enquiry.

Our contact page uses HubSpot forms and the associated CRM to receive and manage enquiries. Loading an embedded form sends technical connection data to HubSpot; submitting it also sends your form entries and submission information.

General enquiries are processed under Article 6(1)(f) GDPR, in particular our interest in organised communication. Article 6(1)(b) GDPR applies where an enquiry concerns a contract or pre-contractual steps. Contacting us does not by itself subscribe you to the newsletter.

HubSpot group, including HubSpot Ireland Limited and HubSpot, Inc.: Privacy Policy and Data Processing Agreement.

4. Newsletter with HubSpot

Our newsletter covers Klimafeld projects, hemp knowledge and opportunities to get involved. Registration collects your email address and express consent through a required checkbox. We also process information necessary to document and administer registration, such as the time, form and consent wording.

We use HubSpot for forms, subscription management and newsletter delivery. Embedded forms connect to HubSpot. The separate form link offered alongside an embedded form also leads to a HubSpot service.

The basis for promotional emails is your consent under Article 6(1)(a) GDPR together with Section 174 TKG 2021. Retaining consent evidence and managing an unsubscribe request may rely on Article 6(1)(c) or (f) GDPR.

You can withdraw consent at any time using the unsubscribe link in a newsletter or by emailing [email protected]. Withdrawal applies to future processing. Newsletter subscription is not required for a membership or donation.

5. Memberships, donations & payments

For membership contributions and donations, we link to Stripe Checkout or Stripe payment pages. After you follow the link, Stripe processes the contact, billing and payment data entered there, together with technical and fraud-prevention data. We receive transaction and payment information needed to allocate and administer the payment, but not your full card details.

Confirmed payments may be linked technically to the relevant membership or donation. Promotional conversion measurement is separate and described under “Statistics & advertising”.

Legal bases are Article 6(1)(b) GDPR for agreed services and memberships, Article 6(1)(c) for statutory evidence and retention duties, and Article 6(1)(f) for orderly donation administration and fraud prevention.

WooCommerce supports any shop, cart and customer-account functions you use. Orders involve contact, billing and order information. If WooPayments or PayPal is offered at checkout and you select it, the relevant payment provider receives the necessary payment data.

Provider information: Stripe, Automattic / WooCommerce / WooPayments and PayPal.

6. Cookies & your choices

We use Complianz to present and manage cookie choices, storing selected categories and related consent information. Technical functions may also need language, session and cart information. Polylang provides the website’s language selection.

Storing or accessing information on your device that is not strictly necessary requires consent under Section 165(3) TKG 2021. Optional personal-data processing for statistics and advertising relies on Article 6(1)(a) GDPR. Necessary functions rely on Article 6(1)(b), (c) or (f), depending on their purpose.

You can change your choices through “Manage consent” at the edge of the page. Strictly necessary cookies, including those needed to manage your choice, are exempt from the consent requirement. Withdrawal does not retrospectively affect processing that was lawful before withdrawal.

The Cookie Policy contains the cookie manager’s technology inventory and listed durations. Available functions and categories are also shown in the settings dialogue.

7. Statistics & advertising

Google services

The website includes Google Tag Manager, Google Analytics and Google Ads to measure website use and the effectiveness of advertising. Data may include pages visited, referrers, device information, interactions, click and campaign identifiers and information about completed actions.

Google Tag Manager manages measurement tags. Google measurement services remain blocked until you consent to the relevant optional categories. Google Tag Manager and advertising tags are loaded only after marketing consent. Your choice is communicated to Google tags through the consent controls and Google Consent Mode. You can refuse optional categories or withdraw your consent at any time through the cookie settings.

Recipients include Google group companies, particularly Google Ireland Limited. Processing outside the EEA is possible. See Google on partner websites and Google Privacy Policy.

Kliken / SiteWit

The website includes Kliken / SiteWit for advertising and visitor measurement. Processing may involve technical device and usage data, pages viewed, referral sources and campaign attribution. The provider is SiteWit Corp., doing business as Kliken. See Kliken Privacy Policy.

Cloudflare Web Analytics

Cloudflare Web Analytics is loaded only after your statistics consent to analyse page views and technical performance. Cloudflare describes this service as operating without analytics cookies or individual fingerprinting. The technical connection to Cloudflare must be distinguished from this measurement method.

Consent is the relevant basis for non-essential personal-data processing for statistics and advertising. Purely technical protection is addressed under “Website, hosting & Cloudflare”. You can refuse optional categories or withdraw consent through the cookie settings.

8. Display, external content & social networks

The website uses WordPress, Elementor and ThemeREX for presentation. Web fonts are delivered through the website or its media delivery infrastructure. An externally loaded Elementor accessibility widget provides usability options. This involves technical connection data. Necessary usability functions rely on Article 6(1)(f) GDPR, our legitimate interest in an accessible website; additional optional measurement functions require consent.

Loading external videos, forms or other content may connect your browser to the respective provider. The recipients depend on the content involved. Non-essential external content and tracking require consent.

Links to our Instagram, TikTok, YouTube and X profiles lead to external platforms, where the respective provider’s privacy information applies. A simple profile link differs from an embedded video or tracking pixel.

Provider information: Elementor Privacy Policy.

9. Recipients & international transfers

Depending on your use, hosting, CDN, security, form, CRM, email, analytics and payment providers receive the data required for their tasks. Other recipients may include competent authorities, banks and accounting service providers where necessary to meet legal obligations. Article 28 GDPR applies where providers process data on our behalf. Payment and platform providers may act as independent controllers for their own purposes.

HubSpot, Cloudflare, Google, Kliken, Elementor and payment providers may transfer data to the United States or other countries outside the EEA. Depending on the provider and recipient, relevant mechanisms include adequacy decisions under Article 45 GDPR, including for appropriately certified US recipients, or safeguards under Article 46 GDPR such as EU Standard Contractual Clauses. The providers’ notices explain their transfer arrangements. You may request information from us about the recipients and safeguards relevant to your data.

10. How long data are retained

Retention depends on the purpose and applicable legal obligations:

• Enquiries: for handling the enquiry and necessary follow-up, and beyond that only where a legal obligation or necessary legal claim justifies retention.
• Newsletter: for the subscription period. Required consent evidence and a suppression record to respect withdrawal may be retained separately after unsubscribing.
• Memberships, donations and orders: for administering the relevant relationship or transaction. Tax-relevant documents are generally subject to seven-year retention under Section 132 of the Austrian Federal Fiscal Code (BAO); ongoing proceedings or other statutory duties may require longer retention.
• Connection and security data: Standard webserver logs currently rotate at 10,240 KB, with up to ten archived files per log type retained in Plesk. This does not establish a fixed retention period in days. Other connection and security data is deleted according to operational deletion and rotation schedules, unless still required for secure operation or investigating an incident.
• Cookies and measurement data: according to function, provider settings and cookie lifetime. A locally expired cookie does not automatically delete data already sent to a provider.

Once the purpose and any overriding retention grounds cease, personal data must be deleted or anonymised. For information about a specific record and its applicable retention period, email [email protected].

11. Your rights & complaints

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time with effect for the future.

Objection: You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time without providing special grounds; this also applies to related profiling.

Contact [email protected]. We handle requests under the GDPR, generally within one month. Where necessary, we may ask for suitable information to verify your identity.

You may complain to a supervisory authority, particularly where you habitually reside or work, or where an alleged infringement occurred. In Austria: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, [email protected]. See complaint information.

12. Voluntary provision, security & updates

Reading our content does not require newsletter registration. Contact information is needed for us to reply to your enquiry; payment and, where relevant, membership data are needed to administer the requested transaction. Without required information, we may be unable to complete that transaction.

The website uses HTTPS/TLS. Technical and organisational measures are also required to protect availability, restrict access and secure data. Complete security of every internet transmission cannot be guaranteed.

We update this policy when website functions or processing activities change. This version describes the position as of 23 October 2026.