Privacy Policy

The protection of your personal data is a particular concern to us. We process your data exclusively on the basis of statutory provisions, in particular the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

This privacy policy informs you about the nature, scope and purpose of the processing of personal data on our website culturos.io as well as all associated sub-pages and services.

culturOS Software GmbH

Dr. Auner Straße 22/2/1.3

8074 Raaba-Grambach, Österreich

When you access our website, the browser automatically transmits information to the server, which is temporarily stored in so-called server log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file retrieved
• Amount of data transferred
• Notification of successful retrieval (HTTP status code)
• Browser type and version
• Operating system
• Referrer URL (previously visited page)

Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring trouble-free operation).

Retention Period: Server log files are automatically deleted after 30 days.

Our website is hosted with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located exclusively in Germany.

We have concluded a Data Processing Agreement (DPA) with Hetzner pursuant to Art. 28 GDPR. No transfer of personal data to third countries takes place in the context of hosting.

Legal Basis: Art. 6(1)(f) GDPR.

Our website uses cookies. Cookies are small text files that are stored on your device.

Strictly Necessary Cookies

These cookies are required for the operation of the website and cannot be disabled. They serve, for example, session management and the storage of your cookie preferences.

Legal Basis: Art. 6(1)(f) GDPR (legitimate interest).

Analytics and Marketing Cookies

Optional cookies are only set with your express consent. Via our consent management tool you can grant, withdraw or adjust your consent at any time.

Legal Basis: Art. 6(1)(a) GDPR (consent).

Adjust your cookie settings via the cookie banner that is displayed when you first visit the website.

We use HubSpot (HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA) as a CRM system to manage customer relationships, inquiries and demo bookings.

Data processed includes in particular: name, email address, company, telephone number as well as interaction data (e.g. emails opened, pages visited).

We have concluded a Data Processing Agreement (DPA) with HubSpot. HubSpot is certified under the EU-U.S. Data Privacy Framework (DPF). EU Standard Contractual Clauses (SCC) apply in addition.

Legal Basis: Art. 6(1)(b) GDPR (performance of contract / pre-contractual measures) as well as Art. 6(1)(f) GDPR (legitimate interest in efficient customer management).

If you contact us via the contact form or by email, the information you provide (name, email address, message) is stored in our CRM system (HubSpot) for the purpose of processing your inquiry.

The data will be deleted as soon as it is no longer required for the purpose of its collection, typically after the conversation has concluded, provided that no statutory retention obligations apply.

Legal Basis: Art. 6(1)(b) GDPR (pre-contractual measures) as well as Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

For booking demo appointments we use HubSpot Meetings. The data you enter (name, email address, company, requested appointment) is processed in this context.

Legal Basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures).

We currently do not use any web analytics tool. Should an analytics tool (e.g. Matomo or Plausible) be integrated in the future, this section will be updated accordingly.

Use will then take place exclusively on the basis of your consent (Art. 6(1)(a) GDPR) or on the basis of legitimate interests for cookieless solutions (Art. 6(1)(f) GDPR).

Our website contains links to our profiles on social networks (LinkedIn, Instagram). These are simple hyperlinks, no data is transferred to the networks when the page is loaded.

Only when you click on a link are you redirected to the respective platform. The privacy policies of the respective provider then apply.

Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in external presentation).

Our AI agent ora uses language models from Anthropic PBC (548 Market Street, San Francisco, CA 94104, USA) to process natural-language queries in the context of organisational development.

The transfer takes place on the basis of EU Standard Contractual Clauses (SCC) and a Transfer Impact Assessment (TIA). Anthropic contractually undertakes not to use the transmitted data for training AI models.

Legal Basis: Art. 6(1)(b) GDPR (performance of contract, ora is part of the culturOS product).

On our website we offer various forms, e.g. for Early Access, waiting lists or surveys. The data entered there (typically name, email address, company) is stored in our CRM system.

Legal Basis: Depending on the context, Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest).

Within the scope of existing or prospective business relationships, we process personal data of contact persons of our customers, suppliers and business partners (name, contact details, position, contract data).

Retention Period: Business data is retained for the duration of the business relationship and thereafter for 7 years in accordance with Austrian commercial law retention obligations (§ 212 UGB).

Legal Basis: Art. 6(1)(b) GDPR (performance of contract) as well as Art. 6(1)(c) GDPR (legal obligation).

Within the scope of the processing activities described in this privacy policy, personal data is transferred to the following providers in third countries:

All other processing activities take place exclusively within the EU/EEA (server location: Germany).

The provision of personal data is neither legally nor contractually required. Without the provision of certain data, however, we cannot deliver individual services (e.g. demo booking, contact inquiry).

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The AI agent ora supports decision-making processes but does not make legally binding individual decisions.

You have the following rights vis-à-vis us with regard to the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

Insofar as the processing is based on your consent (Art. 6(1)(a) GDPR), you may withdraw it at any time with effect for the future (Art. 7(3) GDPR), without prejudice to the lawfulness of processing carried out up to that point.

To exercise your rights, please contact: [email protected]

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by us. The competent supervisory authority in Austria is:

We reserve the right to adapt this privacy policy to reflect changes in the legal landscape or changes to the service or data processing. The most current version is always available on this page.

As of: April 2026 · Version 2.0