Privacy policy

We process your personal data solely in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This policy applies to the website Schlauerarbeiten.com, the customer portal portal.schlauerarbeiten.com and the website www.motiondesignapp.com (Motion Design by Schlauerarbeiten).

The controller for the data processing is:

Schlauerarbeiten FlexCo, Pegiusgasse 10A, 5020 Salzburg, Austria, FN 689526i (Landesgericht Salzburg), represented by its managing director Robert Mair. Email: kontakt@schlauerarbeiten.com.

No data protection officer has been appointed, as there is no legal obligation to do so.

For any data protection matters you can reach us at: datenschutz@schlauerarbeiten.com. We usually reply within a few working days, at the latest within one month.

The website and customer portal are operated at Scaleway SAS (France, EU; Paris data centre). When you access them, we process technically necessary server log data (IP address, time, page accessed including any parameters passed, browser identifier) to ensure operation, detect faults and defend against attacks.

Legal basis: our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR). A data processing agreement is in place with Scaleway; the database is stored encrypted and only reachable via a private network. Retention of logs: 90 days.

We use exclusively technically necessary cookies: for your language selection, for signing in (protecting the sign-in form, returning you after sign-in and keeping you signed in) and, in the customer portal, two markers so that a notice you have already seen or closed does not appear again: the welcome notice (12 months) and the notice after a purchase (14 days; it contains the identifier of your order). In addition, your browser keeps some display states of the customer portal in its local storage; this information stays on your device. These require no consent under § 165(3) TKG 2021, so no cookie banner is needed. There is no tracking and no analytics or advertising technology. Fonts and other resources are served from our own servers, not from third-party networks.

Should we introduce any (even cookie-free) reach measurement in future, we will inform you here in advance and obtain any required consent.

To access protected areas you can sign in with:

Microsoft account (Microsoft Ireland Operations Ltd.): we receive your name and email address to check your access authorisation. No further account data or contacts are retrieved.

Sign-in via email link: for the customer portal you receive a sign-in link valid for 30 minutes. Two links that we send you on our own initiative are valid for longer: the link in your purchase confirmation (24 hours) and the link in the email with your free guide (seven days). We process your email address, sign-in token and timestamps.

Legal basis: performance of the usage relationship or pre-contractual measures (Art. 6(1)(b) GDPR).

When signing in via Microsoft, processing outside the EU may occur; Microsoft relies on an adequacy decision (EU-US Data Privacy Framework) and EU standard contractual clauses. Details in Microsoft’s privacy information.

When you complete our contact form, we process the data you provide (the subject of your enquiry, your name, email address and message and, if you provide it, your company) to answer your enquiry.

When you join the waiting list for a package, we process your email address, the packages you signed up for, your language and the wording you agreed to. We send you an email containing a confirmation link; your click is what makes the entry valid. The purpose is to notify you once, as soon as the package can be bought, and to provide your early-bird advantage. This does not create a user account.

You can opt out at any time via the unsubscribe link in any of these emails or at portal.schlauerarbeiten.com/warteliste/abmelden. After that we will not write to you again; your entry is deleted together with the list, unless you have already redeemed the early-bird advantage (see section 12). We record the times of your sign-up, your confirmation, any opt-out and any redemption so that we can demonstrate that and when you consented or opted out.

Whether you also wish to receive further informational emails is something we ask separately and record separately (see section 7).

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, or pre-contractual measures (Art. 6(1)(b) GDPR). We process the times referred to in the preceding paragraph in order to meet our obligation of proof (Art. 7(1) GDPR, Art. 6(1)(c) GDPR).

When you request our free guide, we process your email address and the result derived from your answers (your level, the tool you selected and the guide recommended on that basis) in order to send you the guide and provide time-limited portal access (14 days). Your individual answers are not transmitted to us and are not stored.

Legal basis: performance of this service (Art. 6(1)(b) GDPR). We send further informational emails only with your consent (Art. 6(1)(a) GDPR), which you can withdraw with one click in every email.

If you came to us via a link or QR code from one of our letters — including where that link was passed on to you by someone else — it contains an identifier for that particular letter. If you request the guide, we store this identifier together with your enquiry in order to see which mailings led to a response. The identifier does not imply that the letter was addressed to you. We use it solely for this analysis, not for advertising. The legal basis is our legitimate interest in measuring the success of our own mailings (Art. 6(1)(f) GDPR); you may object to this processing at any time. We delete the identifier no later than 12 months after receiving your request.

In the customer portal we process, to provide the products you have booked:

Account data: name, email address, assigned company, activated products. When you buy, we take your name from the order (section 19).

Learning data: learning progress and display schedule. The results of the knowledge checks are not part of this: they are shown only in your browser and are neither transmitted to us nor stored by us.

Certificates of participation: once you have completed a package of the AI Strategy Compass, we record the package, period, date and a reference number and let you know by email that your certificate of participation is ready. When you first download it, you confirm your name and, if you wish, your company; we store both with the certificate. It serves as a record of your participation: the package, date and reference number stay unchanged, even if you later untick an item. You can correct your name and company; we record each correction with its time. We create the image for sharing on our servers; it contains only the details of the certificate. With the “Add to LinkedIn” button, your browser opens LinkedIn with the details of the certificate (title, month, reference number, link to the package page); we ourselves do not transmit anything to LinkedIn. What LinkedIn then processes is governed by LinkedIn.

Diagnostic data (AI Strategy Sonar): your answers and the result calculated from them (maturity level, recommendation). The package recommendation is rule-based; no automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place.

Notifications: information emails when new content is shown to you or a certificate of participation is ready for you (part of the service, not marketing).

Team access: if your company has bought a team package and invited you, we received your email address from your company, not from you. We use it to send you the invitation and to provide your access; we do not use it for advertising unless you sign up for it yourself. Your company and we are separate controllers in this respect. The person who manages team access at your company sees your email address, the status of your access, when you were invited and when you last signed in; if at least five people in the team are active, also combined figures for the whole team, without names. This person does not see your learning progress, your Sonar result or the content of your Workbench entries. Entries that you yourself share with your team are visible to your team together with your email address. Your company sees certificates of participation only if you share them with your team yourself; the person who manages team access then sees your name and the package, date and reference number of the certificate and can include it in a combined certificate containing the same details. You can stop sharing at any time. We record your agreement to the terms of use with the time, version, language version and a checksum of the text you confirmed; we delete this information together with your account. Legal basis: for the invitation and setting up your access, our legitimate interest and that of your company in providing the team access purchased (Art. 6(1)(f) GDPR); from your agreement to the terms of use at your first sign-in, the performance of this usage relationship (Art. 6(1)(b) GDPR).

Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Usage events and the internal statistics derived from them are based on our legitimate interest in improving the offering (Art. 6(1)(f) GDPR); you may object to this processing.

As part of the AI Strategy Compass, the AI Workbench is available to you in the customer portal. There you save your own entries — such as prompt templates, helper profiles and procedures — to find, copy and develop them later.

We process solely the content you enter yourself (title, text fields per entry type, optional source reference of the guide) as well as timestamps (creation, change) and the assignment to your user account.

Use of your own entries: for each entry we record two additional values: how often you have copied the entry yourself and when you last did so. Only your own copying is counted; if a member of your team copies a template you have shared, this does not affect your values. Several copies of the same entry in quick succession count as one action.

What is not stored: no log of individual clicks and no list of timestamps is created — only the most recent timestamp is stored, replacing the previous one. We do not analyse which text you copied, and the values are not combined with other data. Exports and merely viewing an entry are not recorded.

Purpose: providing and operating your personal workspace in the portal (saving, viewing, editing, copying and exporting your entries). The two usage values serve solely your own orientation in the portal: you see at a glance which of your templates you actually use and which lie dormant.

Legal basis: performance of the contract under Art. 6(1)(b) GDPR — the AI Workbench is part of the Compass service you have obtained. This also applies to the two usage values: they are part of the workspace you obtain with the Compass and serve solely its operation.

Retention: your entries remain stored as long as your account exists and you do not delete them yourself. If you delete your account, the associated Workbench entries are automatically deleted with it. If your access to a package of the AI Strategy Compass ends, the entries are retained as long as your customer account exists. When we delete an account and how we remind you beforehand is set out in section 12. The two usage values belong to the respective entry: they share its fate and disappear with it — when you delete the individual entry as well as when you delete your account. No retention beyond this takes place.

Your control: you can delete each entry individually and export all your entries as a file at any time (data portability, Art. 20 GDPR). If you delete an entry, the two usage values for it are deleted as well.

No further processing: the content of your entries is not analysed and not processed by AI. Administrative views show only the number, kind and timestamps of entries, not their content; no inspection of content takes place. Administrative views do not show the two usage values either; they are visible to you alone.

Usage note: the AI Workbench is intended for templates without personal data of third parties. Please enter placeholders instead of real names or cases.

All emails from the customer portal – such as sign-in links, purchase and access confirmations, information emails about newly shown content and reminders – and the forwarding of your contact enquiry to us are sent via Scaleway Transactional Email (Scaleway SAS, France, EU) as processor. The legal basis depends on the occasion of the email and is stated in the respective section.

Send log: for every email sent by the customer portal we record the recipient address, the type of email and the time. This prevents the same email from being sent more than once and limits the number of emails per day. We delete these entries after 90 days.

Delivery events: for every email sent, Scaleway reports back to us what happened to it (accepted, delivered, undeliverable, reported as unwanted). We store this report as we receive it; it contains the recipient address, timestamps and technical details of the email. We use it to detect delivery problems and to stop writing to addresses that cannot be reached. We delete these reports after 90 days.

Block list: if an address is undeliverable, if one of our emails was reported as unwanted, or if you have withdrawn a consent, we enter the address in a block list together with the reason and the time. It prevents us from writing to this address again in our email series. Emails needed to handle your account or purchase (such as sign-in links and purchase confirmations) are not affected. We delete such an entry after 24 months. Blocks that we set by hand in individual cases remain until we lift them.

Proof of delivery for the purchase confirmation: when Scaleway reports that your purchase confirmation was delivered, we also store this report with your order – as proof that and when the confirmation was delivered. The proof is kept for as long as the order (section 12). If we delete your account and the order remains because of the invoice, we replace your email address in the order and in this proof with a placeholder.

Legal basis for the send log, delivery events and block list: our legitimate interest in functioning, low-complaint email delivery (Art. 6(1)(f) GDPR); you may object to this processing (section 14).

The legal basis for the proof that your purchase confirmation was delivered is the same as for the other contract documentation (see section 19).

Our systems run in the EU (France). A transfer to third countries can occur in three cases: in the context of optional sign-in via Microsoft (see section 5); for Motion Design orders, where data we send to Google and Anthropic for their AI services may be transferred to the USA (see section 13); and in the research for our letters to businesses, where Anthropic also processes the content of public web pages in the USA (see section 21). Microsoft relies on adequacy decisions and EU standard contractual clauses; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); for Anthropic, the EU standard contractual clauses apply (Art. 46 GDPR).

Server logs: 90 days.

Email send log and delivery events: 90 days.

Block list: 24 months; blocks set by hand until lifted.

Proof of delivery for the purchase confirmation: as long as the order it belongs to.

VAT ID check (result, time, reference number, reported name and address): like the invoicing data, 7 years.

Sign-in links: valid for 30 minutes, the link in the purchase confirmation for 24 hours, the link in the free-guide email for seven days. We delete sign-in tokens after use or expiry.

Prospect enquiries: until resolved or withdrawn, at the latest 24 months after the last contact.

Waiting list: if you have not redeemed the early-bird advantage, we delete your sign-up once it has expired, at the latest 12 months after you signed up. If you have redeemed it, your sign-up remains with the records relating to your invoice as proof of the one-off advantage granted (7 years, section 132 BAO).

Letters to businesses (section 21): 12 months if our offer is not a good fit or you decline; 24 months after a letter without a response; after that only a matching key, for no more than 5 years. After an objection, a suppression record is kept permanently.

Usage events in the customer portal (such as opening a guide or a download): 12 months linked to your account, then anonymised and kept only for internal statistics.

Account including learning data, certificates of participation and AI Workbench: we delete your account after 24 months without a sign-in (free accounts: after 12 months); every sign-in restarts the period. We remind you by email beforehand – 30 and 7 days before, for free accounts 14 days before. As long as an AI Strategy Sonar result is available to you (24 months from the date it was provided), the account remains. On request we delete earlier.

When you order a video from Motion Design, we process:

– your contact details (company, name, email address and, if you wish, telephone number and notes),

– your brief (your answers in the ordering process),

– your brand details (colours, typefaces, logo),

– the files you upload,

– the history of your order (status, your revision requests, our messages, invoice details).

We process this data to review and carry out your order. The legal basis is Art. 6(1)(b) GDPR (contract), and for invoice details Art. 6(1)(c) GDPR (statutory retention obligations).

Your files are stored separately, with Scaleway SAS in Paris, France (Paris data centre). For images, music and voice we use AI services from Google (contracting party: Google Cloud EMEA Limited, Dublin, Ireland). Data processed by Google may also be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). We pass on to them only what is needed for generation, such as a voice-over script or an image you want altered. We do not pass on your contact details to them.

The animation of your video is written as code by the AI service Claude from Anthropic Ireland, Limited (Ireland), which acts as our processor for this (Art. 28 GDPR). Anthropic receives your brief and the content your video requires, retains inputs and outputs for up to 30 days for security purposes and does not use them to train its models. For processing by Anthropic in the USA, the safeguards described in section 11 apply.

So that you can continue an order you have started, the ordering process saves your entries in your browser’s storage on your device until you close the window. If you tick “Save my entries and continue later”, they are kept for up to 7 days instead; the legal basis is then your consent (Section 165(3) of the Austrian Telecommunications Act 2021, TKG 2021), which you can withdraw at any time. Nothing you enter is sent to us until you submit your order. Your entries are deleted when the period ends, when you choose “Start again” or when you submit your order. If you switch saving off, the 7-day copy is deleted immediately and your entries remain only until you close the window. You can also delete them at any time in your browser settings.

Retention:

– A draft that is never submitted: 30 days.

– An order that we cancel: 90 days, in each case including files.

– Orders, files and brand details remain for as long as your customer account exists. If it is deleted, they are removed.

– Of a paid order, the details we must keep for seven years for accounting and tax purposes (§ 132 BAO) remain, in anonymised form.

– If we show your video as an example with your permission, we do so until you withdraw it (Art. 6(1)(a) GDPR).

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). You may withdraw consent given at any time with effect for the future. Please contact datenschutz@schlauerarbeiten.com.

All connections are TLS-encrypted. The database is stored encrypted (encryption at rest) and only reachable via a private network. Access is limited to the necessary minimum; upload limits, rate limiting and further technical safeguards are in place.

Our learning content is created with the support of AI tools and is editorially reviewed and taken responsibility for before publication. On the platform you currently do not interact with an AI system; your inputs (e.g. AI Workbench, Sonar answers) are not processed by AI and not used to train AI models. Motion Design orders are an exception: there Anthropic’s AI service Claude writes the animation as code, and we create music, voice and images with Google’s AI services; we pass both of them the content this requires, such as your brief, a voice-over script or an image you want us to edit (see section 13). We do not use this content to train AI models, and the terms of Anthropic and Google state that they do not do so for the paid service either. We also use AI to help prepare our letters to businesses; a person checks each detail against its source (see section 21). No automated decision-making within the meaning of Art. 22 GDPR takes place.

We adapt this policy when our services or the legal situation change. The version published on this page at the time applies.

You have the right to lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

When you buy our products, we process your order and contract data: the product bought and the options chosen (learning pace, number of seats), the price, your first and last name, your email address and your postal address, for purchases on behalf of a company also the company name and VAT ID, and the times of the purchase. As proof, we also record with a timestamp which version of the contract documents you accepted and which declarations you made, word for word, when ordering.

We also use your name and email address for your user account in the customer portal and for the confirmation of your purchase; your name and postal address appear on your invoice.

Legal bases: performance and documentation of the contract (Art. 6(1)(b) GDPR); for invoice and accounting data our legal obligations (Art. 6(1)(c) GDPR in conjunction with section 132 BAO); for preserving evidence of the declarations made, our legitimate interest in being able to prove them (Art. 6(1)(f) GDPR).

Payment: payment is handled by Mollie B.V. (Netherlands, EU). We pass Mollie the amount, the description of the purchase and an identifier of your order. You enter your payment details with Mollie or the provider of your chosen payment method, who process them as independent controllers under their own privacy information. We do not receive any payment instrument details, only a payment identifier and the status of the payment.

Checking your VAT ID: if you buy for a business in another EU country and enter a VAT ID, we check it via the VAT Information Exchange System (VIES) of the European Commission. In doing so, we transmit the VAT ID, our own VAT ID and – if you have entered them – the company name and address from your order. VIES asks the tax authority of the country that issued the VAT ID and tells us whether the number is valid, with the time and a reference number of the check; depending on the country, it also returns the name and address registered there. We store this result, with all the details mentioned, with your order. We invoice without VAT (reverse charge) only if the number is valid. Legal basis: our legal obligations when invoicing and with regard to VAT (Art. 6(1)(c) GDPR). Retention: like the invoicing data, 7 years (Section 132 of the Austrian Federal Fiscal Code, BAO).

Retention: invoice and accounting data 7 years (section 132 BAO). If we delete your account before then, the order remains together with the invoice; we replace your email address in it with a placeholder. Orders that are not paid are deleted after 30 days; if a payment was started but not completed, after 35 days.

The following processing does not currently take place. We describe it in advance so that you know what to expect once we offer the product. Until then you cannot book it, and no data is processed for it.

AI Strategy Compass Premium (form and audio recording): for the Premium product we process your input from the intake form and an audio recording you create to produce your individual AI roadmap.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Please do not include in the form or recording any personal data of third parties or information you are not permitted to disclose.

Retention: the raw audio file is deleted four weeks after your roadmap is provided.

We write a personal letter to businesses for which our offers could be a good fit (direct marketing by post). If you have received such a letter, this section tells you where we obtained your data and what we do with it. We make first contact only by post, never by email or telephone.

For this we process: the company name, address and website, and the size and industry of your company, as publicly stated; for the person we write to, their name, title and role as stated on the company’s website; the reason for the letter, as a verbatim quotation from a public page (such as a job advertisement); and our assessment of whether our offer is a good fit. We do not collect private contact details or telephone numbers.

The data comes from publicly accessible sources: the company’s website (such as its legal notice, team and careers pages), job advertisements and company profiles on job portals, and business directories. The footnote of your letter states which source we used for it.

The legal basis is our legitimate interest in direct marketing (Art. 6(1)(f) GDPR, Recital 47).

We prepare the research with the help of the AI service Claude from Anthropic Ireland, Limited (Ireland), as our processor (Art. 28 GDPR), and check each detail against its source before a letter is written. Anthropic receives only the content of public pages for this, retains inputs and outputs for up to 30 days for security purposes and does not use them to train its models. A member of our staff decides in each case whether a letter is sent.

Printing and posting are handled by Pingen GmbH, Switzerland, as our processor (Art. 28 GDPR); delivery is by postal service providers in the country of each recipient. For Switzerland there is an adequacy decision of the European Commission (Art. 45 GDPR). For processing by Anthropic in the USA, the safeguards described in section 11 apply.

Each letter carries a code, for example in its QR code. If you use the link from the letter, we can assign your request to that letter (see section 7).

If our offer is not a good fit or you decline, we delete your data after 12 months; if we have written to you and you do not respond, after 24 months. We delete everything except a matching key (name, domain and a checksum of the address), so that you do not receive a second letter; we keep it for no more than 5 years.

You can object to this processing at any time and without any formalities, for example by writing to the address in the footnote of the letter or to datenschutz@schlauerarbeiten.com (Art. 21(2) GDPR). We will then not write to you again and keep a permanent suppression record so that this is respected; for this we store only what we need to recognise you. Your other rights are set out in section 14.

As at 1 November 2026