Privacy policy

Non-binding translation. This version is provided for information only. The German version is the legally binding one.

PlusPlus is an ongoing research/pilot project of Regionale KRAFT e.V. This policy describes the actual, current state of data processing as accurately as possible, but does not replace a case-by-case legal review — in particular regarding the disclosure of third-party contact details via the “Submit a tip” form.

1. Controller

Regionale KRAFT (RK) e.V., association register number (ZVR) 1294501408, Laubweg 7, 9400 Wolfsberg, Austria.
Email: willkommen@regionale-kraft.at
Phone: +43 680 20 86 851

2. What data we process

• Tipster registration: first and last name, email, optionally phone and postcode, hashed password, referral code
• Business registration/enquiries: company details, contact person, contact details and, where applicable, payment/booking data for booked plans
• Contact details of recommended persons (via the “Submit a tip” form) — only with the tipster’s prior confirmation that the recommended person has agreed to their data being passed on (mandatory checkbox in the form)
• Application data for applications to job and apprenticeship listings
• Payout data (IBAN or PayPal account details) for paying out bonuses/commissions to tipsters
• Technical data: session/login cookies (see section 6), server logs

3. Purposes of processing

Handling tipster referrals (recording tips, review, bonus calculation and payout), managing business partner profiles and booked plans, establishing contact between businesses and referred persons, follow-up enquiries to customers about the status of a recommendation, and managing job and apprenticeship applications.

4. Legal bases (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b)): registration, use of the tipster/business dashboards, bonus/commission payouts, plan bookings
• Consent (Art. 6(1)(a)): disclosure of contact details of recommended third parties in the tip form — can be withdrawn at any time
• Legitimate interest (Art. 6(1)(f)): prevention of abuse and fraud, data security/backups, technical operation

5. Recipients / processors

Data is shared exclusively with the following service providers for technical provision of the service:

• Vercel Inc. (USA) — hosting/operation of the platform. Data transfers to the USA are based on EU standard contractual clauses.
• Neon Inc. — database hosting (PostgreSQL) of user and referral data.
• ALL-INKL.COM — Neue Medien Münnich (kasserver.com) — daily, independent backup of the database to our own hosting account, separate from the database provider.
• Email delivery: we send automated notifications (e.g. registration confirmation, password reset, customer follow-up) via our own mailbox at ALL-INKL.COM — Neue Medien Münnich (kasserver.com), the same provider we use for our database backup.
• Payment processing: for online bookings of business plans we use the payment service provider Mollie B.V. (Netherlands). Payment data (e.g. card details) is processed exclusively by Mollie; we do not hold complete payment data.
• Vercel Web Analytics: anonymous, cookie-free page view statistics (number of visitors, pages viewed) to improve our service — no cookies are set and no personal profiles are created.

Data is not passed on to any other third parties or used for advertising purposes.

6. Cookies

We only use technically necessary cookies (login/session cookies for tipsters, businesses and the admin area). These are required to provide the dashboard features and do not require consent (Art. 6(1)(b) GDPR). No tracking, analytics or marketing cookies are used. The page view statistics we use (Vercel Web Analytics, see section 5) work without cookies and without recognising individual visitors.

7. Retention period

Data is stored for as long as an account exists or a statutory retention obligation applies (e.g. for booking/payment records). Contact details of recommended third parties are deleted as soon as the underlying tip has been fully processed and no retention obligation prevents deletion. On request, we delete data earlier, provided there is no legal obligation to retain it further.

8. Your rights

Under the GDPR you have the right to:

• access the data stored about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (“right to be forgotten”, Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing (Art. 21)
• withdraw consent at any time with effect for the future (Art. 7(3))

To exercise these rights, an informal email to willkommen@regionale-kraft.at is sufficient. You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

9. Data security

Access to user and referral data is restricted to authenticated accounts and separated by role (tipster, business, admin). In addition to the security measures of our database host, we run an independent, daily, encrypted backup outside the host so that we remain able to act independently in the event of an incident.

10. Changes to this policy

This policy will be updated as soon as the actual data processing changes (e.g. when email delivery or payment processing is activated). The current version published on this page applies.