by CPM Tech GmbH
EN|DE
Legal

Privacy Policy

CPM Tech GmbH places great importance on the protection of personal data. All processing of personal data is carried out exclusively in accordance with applicable data protection law, in particular the General Data Protection Regulation ("GDPR"), the Austrian Data Protection Act ("DSG") and the Telecommunications Act 2021 ("TKG 2021").

This Privacy Policy explains what personal data is processed in connection with the CPM One website and the services offered through it, for what purposes, on what legal basis, and what rights you have.

1. Controller

The controller within the meaning of the GDPR is:

CPM Tech GmbH
Franz-Josefs-Kai 49/11
1010 Vienna
Austria
Phone: +43 650 5000 510
Email: office@cpm-group.at

No data protection officer has been appointed. Data protection enquiries may be directed to the email address above.

2. Scope

This Privacy Policy applies to the CPM One website (www.cpm-group.at/cpm-one.html and its sub-pages, including the module pages, pricing and appointment booking) and to the contact options, request forms and appointment booking offered through it. Other websites operated by CPM Tech GmbH are covered by their own privacy policies.

3. Hosting, Content Delivery and Security Services via Cloudflare

CPM Tech GmbH uses services provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA to host, secure and deliver the website. The specific technical scope may include hosting via Cloudflare Pages, content delivery, DNS and security services.

The following data may be processed in particular:

  • IP address
  • Date and time of access
  • Pages and files accessed
  • Referrer URL
  • Browser type and version
  • Operating system
  • Device and connection information
  • HTTP status codes
  • Data for detecting and preventing misuse

Processing serves to provide the website technically, optimise loading times, detect attacks and misuse, and ensure stability and security.

The legal basis is the legitimate interest of CPM Tech GmbH in a secure, stable and high-performance web presence pursuant to Art. 6(1)(f) GDPR.

Where personal data is processed outside the European Economic Area, this takes place in compliance with Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision, appropriate standard contractual clauses or other permitted safeguards.

Server and security logs are stored only for as long as necessary for the relevant technical or security purpose. Longer retention may occur where specific security incidents are being investigated or legal claims need to be asserted or defended.

4. Server Log Files

When the website is accessed, technically necessary information is automatically processed and stored in server log files. This may include in particular:

  • IP address
  • Date and time of access
  • Page or file requested
  • Amount of data transferred
  • Access status
  • Referrer URL
  • Browser and operating system
  • Device and language settings
  • Error messages and technical diagnostic data

Processing serves to provide the website technically, analyse errors, ensure system security and prevent unauthorised access. The legal basis is Art. 6(1)(f) GDPR.

Data is generally stored only for as long as technically necessary and then deleted or anonymised, unless longer retention is required to investigate a security incident or for legal defence.

5. Contact

Contact may be made via contact forms, email or telephone. Depending on the form and the content of the enquiry, the following data may be processed in particular:

  • First and last name
  • Email address
  • Phone number
  • Company
  • Position or role
  • Service or event of interest
  • Content of the message
  • Date and time of the enquiry
  • Further information provided voluntarily

Processing serves to handle and respond to your enquiry and to prepare or conduct a potential business relationship.

Where your enquiry relates to the conclusion or performance of a contract, the legal basis is Art. 6(1)(b) GDPR. In other cases, processing is based on the legitimate interest of CPM Tech GmbH in the efficient handling of business enquiries pursuant to Art. 6(1)(f) GDPR.

Mandatory fields are marked accordingly. Without this information, it may not be possible to process your enquiry.

General contact and prospect enquiries are generally stored for twelve months after the relevant enquiry is concluded or after the last relevant contact. Longer storage applies where a business relationship arises, statutory retention obligations exist, or the data is required to assert, exercise or defend legal claims.

6. Technical Transmission of Forms via FormSubmit

CPM Tech GmbH uses FormSubmit (formsubmit.co) for the technical transmission of contact forms, including those on pulse.cpm-group.at.

When you submit a relevant form, the data entered is transmitted via FormSubmit to the email inbox set up by CPM Tech GmbH. This may include form content, contact details, IP address, date and time of submission, browser and device information, and technical security and log data.

Processing serves to technically transmit and handle your enquiry. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries, and Art. 6(1)(f) GDPR for other enquiries.

7. Processing in Microsoft 365 and Outlook

Enquiries received via contact forms and email are processed in the Microsoft 365 / Outlook system of CPM Tech GmbH. The provider for users in the European Economic Area is generally Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Communication content, contact details, attachments and technical information are processed to the extent necessary to receive, handle, document and respond to enquiries.

The legal basis depends on the content of the communication and is Art. 6(1)(b) or Art. 6(1)(f) GDPR.

Where Microsoft processes personal data outside the European Economic Area, transmission takes place in compliance with Art. 44 et seq. GDPR and the safeguards used by the provider.

8. Appointment Booking via Microsoft Bookings

CPM Tech GmbH may use Microsoft Bookings for scheduling individual consultations. When you access an external booking link, data is only transmitted to Microsoft when you select the link. Where Microsoft Bookings is embedded directly in a page, the embed is loaded only after you have consented to functional services.

When booking an appointment, the following data may be processed in particular: first and last name, email address, phone number, company, desired appointment, voluntary information, IP address, browser and device information, and technical log data.

Processing serves to organise, prepare and conduct the requested appointment. The legal basis is Art. 6(1)(b) GDPR. For loading an optional embed, the legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.

9. Cookies and Similar Technologies

The CPM One website uses cookies and similar technologies, in particular Local Storage. Cookies are small files or units of information that can be stored on or read from your device. Local Storage allows information to be stored directly in the browser.

The following categories are distinguished:

  • technically necessary technologies
  • functional technologies
  • statistical technologies
  • marketing technologies

Technically necessary technologies

Necessary technologies are used to provide the website, security functions and your privacy settings. The legal basis is Art. 6(1)(f) GDPR. Storage or access to the device takes place within the exception for technically essential operations pursuant to § 165(3) TKG 2021.

Functional, statistical and marketing technologies

These technologies are activated exclusively when you have previously consented via the cookie banner of CPM Tech GmbH. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.

Your selection is stored so that it can be taken into account on further page visits. You may change or withdraw your consent at any time via the "Cookie settings" link in the footer. Withdrawal takes effect for the future.

The core functions of the website can generally also be used without optional technologies. Embedded maps, audio content, booking systems or other external functions may however not be available without consent.

10. Display Settings and Dark Mode

When you switch between a light and dark display, your selection is stored under the name cpm-theme in your browser's Local Storage. This allows the website to be displayed automatically in your chosen mode on your next visit.

The information remains stored until it is deleted via browser settings or replaced by a new selection. Processing serves solely to provide the display mode you have chosen and is carried out pursuant to Art. 6(1)(f) GDPR or § 165(3) TKG 2021.

11. Self-Developed Consent Management

CPM Tech GmbH uses a self-developed consent system to manage your cookie and privacy settings. This stores in particular:

  • whether a selection has been made
  • which categories have been permitted
  • the time or version of the selection
  • where applicable, the version of the consent text displayed

Google Analytics, Google Tag Manager, Google Ads, LinkedIn Insight Tag, Meta Pixel, Microsoft Clarity and external embeds are activated only after you have consented to the relevant category.

Storing the consent selection is technically necessary so that your decision can be taken into account on further page visits and can be evidenced.

12. Google Tag Manager

After your consent, Google Tag Manager is used. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used to manage website tags and scripts centrally. The service may process technical data such as IP address, browser information and device information. Statistical and marketing services integrated via Google Tag Manager are activated only after you have consented to the relevant cookie category.

The legal basis is Art. 6(1)(a) GDPR.

13. Google Analytics 4

After your consent, Google Analytics 4 is used to analyse the use of the website. The following data may be processed in particular:

  • Pages visited
  • Time and duration of visit
  • Interactions with the website
  • Approximate geographic region
  • Browser and operating system
  • Device type
  • Referrer URL
  • Campaign and origin information
  • Processed IP address
  • Online and device identifiers

The data is used to understand the use of the website and to improve content, navigation and campaigns. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

Where Google processes data outside the European Economic Area, this takes place in compliance with Art. 44 et seq. GDPR and the safeguards used by the provider.

14. LinkedIn Insight Tag

After your consent, the LinkedIn Insight Tag is used. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

The LinkedIn Insight Tag enables in particular:

  • Measurement of website visits and conversions
  • Analysis of the effectiveness of LinkedIn campaigns
  • Creation of audiences for retargeting
  • Statistical analysis of website visitors
  • Attribution of interactions to LinkedIn campaigns

IP address, device and browser information, pages accessed, timestamps, referrer URL and cookie or device identifiers may be processed in particular. The legal basis is Art. 6(1)(a) GDPR.

15. Meta Pixel

After your consent, the Meta Pixel is used for advertising and conversion measurement on Facebook and Instagram. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel enables in particular:

  • Measurement of the effectiveness of advertisements
  • Attribution of website actions to campaigns
  • Creation of retargeting audiences
  • Delivery of interest-based advertising
  • Statistical analysis of user behaviour

IP address, browser and device data, pages visited, interactions, timestamps, referrer data and cookie and advertising identifiers may be processed in particular. The legal basis is Art. 6(1)(a) GDPR.

16. Google Ads and Conversion Tracking

After your consent, Google Ads is used in particular to measure conversions and the effectiveness of CPM Tech GmbH's advertising campaigns. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Integration is via Google Tag Manager (see section 19).

Google Ads enables in particular:

  • Measuring whether an advertisement has led to a desired action on the website (conversion tracking)
  • Statistical analysis of the success of advertising campaigns
  • Optimisation of ad delivery based on aggregated campaign data

Where remarketing or retargeting via Google Ads is also used to show interest-based advertising to visitors of the website on other websites, audiences are created on the basis of cookie or device identifiers. The use of remarketing and its specific scope are to be confirmed before this Privacy Policy is published.

IP address, device and browser information, pages accessed, interactions with advertisements, timestamps and cookie or advertising identifiers may be processed in particular. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

Where Google processes personal data outside the European Economic Area, this takes place in compliance with Art. 44 et seq. GDPR and the safeguards used by the provider.

17. Microsoft Clarity

After your consent, Microsoft Clarity is used to better understand how visitors use the website. The provider is Microsoft Ireland Operations Limited.

Clarity may process the following information in particular:

  • Mouse movements and clicks
  • Scrolling behaviour
  • Pages visited
  • Duration and path of a session
  • Browser and device information
  • IP address
  • Technical errors
  • Pseudonymous session identifiers

Inputs in sensitive or appropriately configured form fields are masked or not recorded in readable form. Processing serves to analyse and improve usability, navigation and technical functionality. The legal basis is Art. 6(1)(a) GDPR.

18. Local Fonts

The fonts Inter and Space Grotesk are used among others for the display of the website. The associated font files are provided locally via CPM Tech GmbH's own website or its hosting provider. No connection to Google Fonts servers is therefore established when the fonts are loaded.

19. External Links and Social Networks

The CPM One website contains links to external websites and social networks, in particular LinkedIn, Instagram and Facebook. These links are generally simple hyperlinks. As long as you do not select the respective link, no active social media function is loaded via the link itself.

After selecting a link, the privacy policy of the respective external provider applies. That provider may in particular process your IP address, device information, the time of access and the previously visited page. If you are logged in to the respective service, the visit may potentially be associated with your user account.

20. Recipients of Personal Data

Within CPM Tech GmbH, personal data is accessed only by those persons who need it for the relevant purposes. In addition, the following categories of recipients may receive data in particular:

  • Hosting and security service providers
  • Email and communication providers
  • Form and appointment booking providers
  • Analytics and advertising providers following your consent
  • IT, maintenance and support service providers
  • Tax advisors, legal advisors and other professional advisors
  • Authorities and courts in the event of a legal obligation

Where service providers process personal data on behalf of CPM Tech GmbH, they are contractually bound in accordance with Art. 28 GDPR.

21. Data Transfers to Third Countries

Some of the service providers used operate internationally or have affiliated companies outside the European Economic Area. Personal data is transferred to a third country only where the requirements of Art. 44 et seq. GDPR are met.

The basis may in particular be:

  • Adequacy decisions of the European Commission
  • The EU–US Data Privacy Framework
  • Standard contractual clauses of the European Commission
  • Supplementary technical and organisational protective measures
  • Statutory derogations pursuant to Art. 49 GDPR

Despite these safeguards, it cannot be entirely ruled out that authorities may access data in certain third countries under local statutory provisions.

22. Retention Periods

Personal data is generally stored only for as long as necessary for the respective purpose. The following principles apply in particular:

  • General enquiries: twelve months after conclusion or last relevant contact
  • Customer and contract data: for the duration of the business relationship and statutory retention periods
  • Tax and accounting documents: generally seven years
  • Consent records: for as long as the processing based on them continues, and thereafter only for as long as required to fulfil statutory evidential obligations or for legal defence

After the relevant periods expire, data is deleted or anonymised, unless a statutory obligation or an overriding legitimate reason for further storage exists.

23. Data Security

CPM Tech GmbH implements appropriate technical and organisational measures to protect personal data against loss, destruction, manipulation, unauthorised access and other misuse. These include in particular, depending on the processing:

  • Encrypted transmission via HTTPS / TLS
  • Access and authorisation controls
  • Regular software updates
  • Data backups
  • Restriction of access to authorised persons
  • Measures to detect and prevent attacks

Security measures are reviewed and updated in line with technological developments.

24. Your Rights

Subject to the statutory requirements, you have in particular the following rights:

  • Right of access pursuant to Art. 15 GDPR
  • Right to rectification pursuant to Art. 16 GDPR
  • Right to erasure pursuant to Art. 17 GDPR
  • Right to restriction of processing pursuant to Art. 18 GDPR
  • Right to data portability pursuant to Art. 20 GDPR
  • Right to object pursuant to Art. 21 GDPR
  • Right to withdraw consent pursuant to Art. 7(3) GDPR
  • Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

You may withdraw consent given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal is not affected.

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object at any time without giving reasons to the processing of your data for direct marketing purposes.

To exercise your rights, please contact office@cpm-group.at. Where there is reasonable doubt as to your identity, CPM Tech GmbH may request additional information for identity verification.

25. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. In Austria this is:

Austrian Data Protection Authority (Datenschutzbehörde)

Barichgasse 40–42

1030 Vienna

Austria

Phone: +43 1 52 152-0

Email: dsb@dsb.gv.at

26. Link Tracking

We use personalised links to measure the effectiveness of our marketing campaigns. When you visit our website via such a link, the campaign code contained in the link is processed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the performance of our marketing activities).

27. Changes to This Privacy Policy

This Privacy Policy may be updated where legal requirements, the CPM One website, the services used or the nature of data processing change. The version currently published on the website applies.

Last updated: 2 November 2026