Privacy Policy

Introduction

This Privacy Policy applies to the website of Lupinum OG. It explains how we process personal data when you visit our website, contact us through website functions, or use our content.

Controller

General processing information

• Data processed: IP address, access date and time, request data, browser and device information, referrer, pages visited, and information you actively submit, for example through a contact form.
• Purposes: Providing and securing the website, responding to inquiries, delivering media, improving our services, and communicating with prospective clients.
• Legal bases: Article 6(1)(b) GDPR for pre-contractual communication and inquiries, Article 6(1)(f) GDPR for operation and security, and Article 6(1)(a) GDPR where we request consent for a specific function.
• Retention: We retain personal data only for as long as required for the relevant purpose or by statutory retention duties. Contact inquiries are deleted once processing is complete and no legal or contractual reason requires continued storage.

Your rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time with future effect.

To exercise your rights, email info@lupinum.com. We respond to privacy requests within the time limits set by law.

Recipients and international transfers

We use external technical and organisational service providers. Personal data may therefore be transferred to recipients outside the European Economic Area, particularly in the United States. According to the respective providers, such transfers rely on appropriate safeguards, especially standard contractual clauses and, where applicable, additional safeguards such as an adequacy decision.

Hosting and technical delivery through Vercel

Our website is delivered through Vercel Inc. When the website is requested, Vercel processes technically necessary connection and request data, including the IP address, browser information, request date and time, and log data, to deliver the website, maintain stability, and defend against attacks.

Processing is based on our legitimate interest under Article 6(1)(f) GDPR in operating a secure and performant website. More information is available in Vercel's Privacy Policy and Data Processing Addendum.

Media delivery through Vercel Blob

We use Vercel Blob for selected images, downloads, videos, and other media. When this content is requested, Vercel processes the connection and access data technically required for delivery. Depending on its configuration, media stored in Vercel Blob may be publicly accessible. We use this service only to deliver website content and not to transfer confidential or sensitive information.

Processing is based on our legitimate interest under Article 6(1)(f) GDPR in efficient, stable, and performant media delivery. More information is available in the Vercel Blob documentation.

Contact forms through Basin

When you submit one of our contact forms, the entered information is transmitted to Basin, operated by Moonshot Ventures, Inc., and processed there so that we can receive and respond to your inquiry. This includes your name, email address, message, and any additional information you provide voluntarily.

Processing takes place to respond to your inquiry and, where your inquiry concerns a potential engagement, to take pre-contractual steps under Article 6(1)(b) GDPR. More information is available in Basin's Privacy Policy.

Project questionnaires through Google Forms

To prepare an individual proposal, we may provide you with a voluntary project questionnaire through Google Forms. It can collect details about your organisation, project scope, objectives, content, technical requirements, and timing. We can provide an alternative submission method on request.

When you open or submit the form, Google Ireland Limited or Google LLC processes the submitted content and technical metadata. Processing takes place for pre-contractual steps under Article 6(1)(b) GDPR. More information is available in Google's Privacy Policy and the Google Workspace Data Processing Terms.

Active and optional website services

The following inventory is generated from the website's current configuration. Disabled optional services are not loaded.

Social media profiles

If you interact with a Lupinum company profile on an external platform, the respective platform operator processes personal data under its own responsibility or, for individual analytics functions, jointly with us. The privacy information of the respective platform applies.

Right to lodge a complaint

If you believe that our processing infringes data protection law, you may lodge a complaint with a supervisory authority. Our competent authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna. More information is available at www.dsb.gv.at.

Changes to this Privacy Policy

We update this Privacy Policy when legal requirements, our website, or the services we use change. The version published on this website is the applicable version.