Privacy policy

Last updated: November 2026

This English version is provided for your convenience. Only the German version is legally binding.

This page explains which personal data protectly.eu processes, why we do so, how long we keep it and what rights you have. Each section starts with a short summary.

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Smart-Study GmbH
Villefortgasse 11
8010 Graz, Austria
Email: office@protectly.eu
Phone: +43 316 438 017

Protectly is a service of Smart-Study GmbH. For any question about data protection or to exercise your rights, please use the contact details above.

Data protection contact

For any questions about data protection or to exercise your rights, contact us at office@protectly.eu or at the postal address above.

Hosting and server logs

This website and its database are hosted by easyname GmbH, Canettistraße 5/10, 1100 Vienna, Austria. The servers are located in Austria. easyname processes the data on our behalf as a processor (Art. 28 GDPR). A data processing agreement is in place with easyname.

Whenever you open a page, your browser necessarily sends data to our server. The web server typically logs: IP address, date and time, the requested address, the HTTP status code, the amount of data transferred, the previously visited page (referrer) and your browser and operating system (user agent).

We use this data to deliver the website, fend off attacks and fix errors. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We do not combine the logs with other data and do not analyse them for advertising or analytics. The error logs of our application are designed not to contain any form content.

The connection to the website is always encrypted with TLS (HTTPS).

Retention: The hosting provider stores server log files for a limited period for security purposes.

Cookies, local storage and consent

Cookies are small text files stored by your browser. The browser's local storage works in a similar way. Both are governed by section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021): what is strictly necessary for the service you have explicitly requested may be stored without consent. Everything else requires your consent.

protectly.eu uses the following storage:

We use the necessary storage on the basis of section 165(3) TKG 2021. The related processing is based on our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Consent management: On your first visit the website shows a cookie notice. There you can allow the "Analytics" and "External media" categories individually or reject everything. The "Necessary" category is always active. We store your choice only in your browser (entry "protectly_consent"), not on our server. You can change or withdraw your choice at any time via "Change cookie settings" at the bottom of every page or with the button here. If you withdraw "External media", the website immediately removes a scheduler that has already loaded.

"Analytics" category: Only if you allow this category do we measure website usage with Matomo. Without your consent nothing is loaded and nothing is sent. Details are in the section "Web analytics with Matomo". You can withdraw your choice at any time via "Change cookie settings".

We use no advertising cookies, no tracking pixels and no social media plugins.

Change cookie settings

Web analytics with Matomo

We use the open-source software Matomo to evaluate website usage statistically and to improve the site. We run Matomo ourselves on our own server (on-premise). The server is located in Europe and the data is not transferred to third countries.

Matomo is loaded only after you have allowed the category "Analytics" in the cookie notice. Until then your browser makes no connection to the Matomo server.

Processed data: pages viewed, time of the visit, referrer address, browser and device type, screen resolution, approximate region and the IP address.

• No cookies: we run Matomo without cookies.
• Do Not Track: if your browser sends the "Do Not Track" signal, your visit is not recorded.
• We do not pass the statistics data on to third parties.

Legal basis: your consent (Art. 6(1)(a) GDPR and section 165(3) TKG 2021).

Retention: The statistics data is deleted automatically after 14 months.

Withdrawal: you can withdraw your consent at any time with effect for the future by switching off the category "Analytics" in the cookie settings. Processing that took place until then remains lawful.

Change cookie settings

Contact form

When you write to us via the contact form, we process:

• Your details: name, email address, company, the topic of your request and your message. These fields are mandatory. Without them we cannot handle your request. You may add a phone number voluntarily, we use it only for a quick follow-up question.
• Technical details: time of the request, the language version of the website, your browser identifier (user agent, truncated to 255 characters) and a pseudonymised value of your IP address.

About the IP address: We do not store the address itself, only a check value calculated with a secret key (HMAC-SHA256). For IPv6 addresses only the network part (the first 64 bits) is used. This lets us detect an unusual number of requests from the same address within one hour (from the sixth request on we reject them) without knowing the address in plain text.

To stop automated spam, the form also contains a field that is invisible to people. If it is filled in, we discard the request without storing or passing on anything. The session cookie PHPSESSID additionally protects the form against forged requests.

Purpose and legal basis: We process your details to answer your request. If it concerns a possible contract, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We process the technical details based on our legitimate interest in preventing abuse and spam (Art. 6(1)(f) GDPR). The checkbox "I have read the privacy policy." in the form is not consent. It only confirms that you know this information.

Recipients: Your request is stored in our database at our hosting provider and is visible only to authorised staff in our internal admin area. For follow-up we transfer name, email address, company and message to our CRM system Close (see "Customer management with Close"). Support requests from customers go to our ticket system Zammad instead (see "Support requests via our ticket system").

Retention: We delete contact requests automatically 24 months after the last contact. We remove the IP check value and the user agent after 30 days. If the request leads to a contract, we keep the necessary records for the statutory periods.

Demo request and demo access

When you request access via the demo form, we process:

• Your details: name, business email address and company (mandatory fields). You may add a phone number voluntarily, we use it only for a quick follow-up question.
• A flag showing whether the email address belongs to a general free-mail provider (e.g. gmail.com or gmx.at). The flag helps our sales team classify the request. You get the demo either way.
• Technical details as with the contact form: time, language version, user agent and a pseudonymised value of the IP address. We reject more than three requests per hour from the same address.
• The processing status of your request and the result of setting up your trial access.

Confirmation by email (double opt-in): After you submit the form, you receive an email with a confirmation link. The link is valid for 48 hours and can only be used once. We store only a check value of the link. Without confirmation we delete your details after 7 days. We send the email via the Brevo service (see "Recipients and processors"). After your confirmation we contact you personally and set up the demo access.

So that the confirmation page can show your request after you submit it, the technical session (cookie PHPSESSID) remembers the number of your request. As with the contact form, the input is protected against spam and forged requests.

Purpose and legal basis: providing the demo you requested and contacting you about it (Art. 6(1)(b) GDPR, pre-contractual measures at your request). Abuse prevention: Art. 6(1)(f) GDPR. After your confirmation we transfer the request to our CRM system Close (see "Customer management with Close"). As with the contact form, the checkbox "I have read the privacy policy." is not consent.

Retention: We delete demo requests automatically 12 months after the request, and unconfirmed requests after 7 days. We remove the IP check value and the user agent after 30 days.

Booking appointments via Calendly

To book calls, we embed the scheduler of Calendly LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA, on the contact page. Without your consent the website does not connect to Calendly. You only see a notice and a button to give your consent. You can also reach us at any time by email, phone or contact form.

Only after you agree to the "External media" category does your browser load the scheduler directly from calendly.com. Calendly then receives in particular your IP address, browser and device information and the fact that the scheduler is embedded on protectly.eu, and may set its own cookies. If you book an appointment, Calendly also processes the data you enter there (usually name, email address and any notes) and passes the booking on to us.

The legal basis for loading the scheduler is your consent (Art. 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021). We process the booking data to prepare and hold the call you requested (Art. 6(1)(b) GDPR). You can withdraw your consent with effect for the future at any time in the cookie settings. The scheduler then disappears from the page immediately.

Calendly processes the booking data on our behalf as a processor (Art. 28 GDPR). A data processing agreement is in place with Calendly. Calendly also processes data in the USA. According to Calendly, the transfer is based on the EU-US Data Privacy Framework, with the European Commission's standard contractual clauses as a fallback. More information: https://calendly.com/privacy

Retention: We delete booking data 12 months after the appointment unless we need it for an ongoing business relationship.

Customer management with Close

To manage requests and prospects, we use the CRM system Close by Elastic Inc. (Close), Jackson, Wyoming, USA, as a processor (Art. 28 GDPR). A data processing agreement is in place with Close. You can reach the data protection contact of Close at dpo@close.com. We transfer:

• from the contact form, right after you submit it: name, email address, company, optionally your phone number, the topic of your request, your message (up to 5,000 characters), the language version and the source "contact form". Support requests are excluded, they go to our ticket system Zammad. Requests on the topic of careers are not transferred to Close.
• from the demo form, after you have confirmed your email address: name, email address, company, optionally your phone number, the language version, the source "demo form" and the free-mail flag.

If Close already holds exactly one record with your email address, we only add a note about the new request there and do not overwrite existing data. We do not transfer your IP address or user agent to Close. Requests caught by our spam protection are not transferred.

We keep a technical log of every transfer attempt (time, result, error code). Your email address appears in it only as a pseudonymised check value, never in plain text. These log entries are deleted automatically after 90 days.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) or Art. 6(1)(f) GDPR (legitimate interest in handling requests in an orderly way). Where we rely on legitimate interests, you can object at any time (see "Your rights").

Transfer to the USA: Close stores the data in the USA. We safeguard the transfer with the European Commission's standard contractual clauses (Module 2, Art. 46(2)(c) GDPR).

Retention in Close: If no contract is concluded, we delete your data 24 months after the last contact. If a contract is concluded, the statutory retention periods apply.

If you reach our website through a link with campaign parameters (utm) and then use the contact or demo form, we store these parameters and the landing page with your request and transfer them to Close together with your request. This shows us which campaign requests come from. We do not set an additional cookie for this.

Support requests via our ticket system

For support requests from customers we use the ticket system Zammad. We run it ourselves on servers of Hetzner Online GmbH in the EU. If you choose a support topic in the contact form, we transfer the following right after you submit it:

• Your details: name, email address, company, optionally your phone number, the topic of your request and your message.
• The language version of the website and the source "contact form".
• Zammad creates a contact profile with your email address if none exists yet. This lets us reply to you by email.

We do not transfer support requests to our CRM system Close. We do not send your IP address or user agent to Zammad. We keep the same technical log of every transfer attempt as for Close (email address only pseudonymised, deleted after 90 days).

Purpose and legal basis: We process your details to handle and answer your support request. If it concerns an existing or possible contract, the legal basis is Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Retention: We keep the ticket for as long as we need it to handle your request. If the request leads to a contract or concerns an existing contract, the statutory retention periods also apply.

Recipients and processors

Within our company, only the people who need the data for their work have access, in particular sales and customer support. We also use the following service providers:

We send the confirmation email for demo requests via the SMTP service of Brevo (Sendinblue SAS, Paris, France). For this, Brevo receives your email address, your name and the content of the email with the confirmation link. Brevo stores the data in France and Belgium. Brevo's sub-processors in India and the USA may access it. This is based on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. The website sends no other emails containing your data.

Beyond that, we only pass on data where we are legally obliged to, for example to authorities or courts.

Transfers to third countries

We generally process your data in the European Union. Data may be processed outside the EU in three cases: when we transfer requests to the CRM system Close, when you load and use the Calendly scheduler after giving your consent, and when Brevo's sub-processors in India or the USA access data while the confirmation email is sent.

On 10 July 2023 the European Commission adopted an adequacy decision for the USA (EU-US Data Privacy Framework). It covers companies certified under this framework. Calendly bases the transfer on it, with standard contractual clauses as a fallback. We safeguard the transfer to Close with the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). At Brevo, access by sub-processors is based on the Data Privacy Framework and on standard contractual clauses.

Fonts, images and course data

The website fonts (Inter and Space Grotesk) are stored on our server. Your IP address is therefore not sent to Google or any other font provider.

Course descriptions and course images in the course catalogue come from our own course database. We store the images on the web server. Your browser loads them from protectly.eu, not from a third party. The course data contains no personal data about visitors.

This is enforced by a security policy (Content Security Policy) that only allows your browser to load content from protectly.eu. The exceptions are the scheduler from calendly.com and our Matomo server, each only after your consent.

Links to other websites, such as our careers page, are ordinary links. Only when you click one do you leave protectly.eu. The privacy policy of that provider then applies.

Retention at a glance

• Contact requests: 24 months after the last contact.
• Demo requests: 12 months after the request. Unconfirmed demo requests: 7 days.
• Pseudonymised IP address and user agent from the forms: 30 days. Abuse protection only evaluates the last hour.
• Data in the CRM system Close: 24 months after the last contact unless a contract is concluded.
• Log of transfers to Close (email address only pseudonymised): 90 days, deleted automatically.
• Login attempts in the internal admin area (pseudonymised IP address and the email address entered): 2 days, deleted automatically.
• Web server access logs: stored by the hosting provider for a limited period for security purposes.
• Cookies and local storage: see the table in the section "Cookies, local storage and consent".
• Booking data from Calendly: 12 months after the appointment.
• Statistics data from Matomo (only with consent): 14 months, after which it is deleted automatically.
• Support tickets in Zammad: as long as we need them to handle your request, with a contract reference also according to the statutory retention periods.

If a contract is concluded, we keep the necessary records in line with statutory obligations, in particular 7 years under section 132 of the Austrian Federal Fiscal Code (BAO) and section 212 of the Austrian Commercial Code (UGB).

A daily automatic deletion run applies the periods for requests, logs and login attempts on the website.

Your rights

Under the GDPR you have the following rights towards us:

• access to the data stored about you (Art. 15 GDPR);
• rectification of inaccurate or incomplete data (Art. 16 GDPR);
• erasure of your data unless a statutory retention obligation applies (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability: you receive the data you provided to us in a common, machine-readable format (Art. 20 GDPR);
• objection to processing based on our legitimate interest (Art. 21 GDPR);
• withdrawal of any consent you have given, at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing before the withdrawal.

Your right to object: Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing at any time without giving reasons.

How to exercise your rights: write to office@protectly.eu or to the postal address above. We reply within one month (Art. 12(3) GDPR). To protect your data, we may ask you to prove your identity. The easiest way to withdraw your cookie consent is "Change cookie settings" at the bottom of every page.

We do not use automated decision-making, including profiling (Art. 22 GDPR).

Right to lodge a complaint

If you believe that we process your data unlawfully, you can lodge a complaint with a supervisory authority (Art. 77 GDPR). In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, https://www.dsb.gv.at

We appreciate it if you contact us first. That is often the quickest way to resolve a concern.

Changes to this policy

We update this privacy policy when we introduce new features, change service providers or the legal situation changes. The version published here applies. The date of the current version is shown at the top. If a change affects your consent, we ask for it again via the cookie notice.