We take the protection of your data seriously. This policy explains which personal data we process when you visit www.organoids.com or place an order in our online shop, why we do so, and what rights you have. It is based on the General Data Protection Regulation (GDPR), the Austrian Data Protection Act and the Austrian Telecommunications Act 2021 (TKG 2021).
CONTROLLER
The controller responsible for the processing described here is:
ORGANOID GmbH
Nesselgarten 422 / Top 5
6500 Fließ, Austria
Commercial register FN 378195w, Regional Court of Innsbruck
VAT ID ATU67253688
Managing Director: Mag. Christoph Egger
Phone +43 5449 200 01
info@organoids.com
We are not required to appoint a data protection officer. For any question about data protection, please write to the address above.
THE LEGAL BASES WE RELY ON
We only process personal data where the law allows it. Four legal bases appear in this policy:
- Consent (Art. 6(1)(a) GDPR, and for cookies also § 165(3) TKG 2021) – for example for audience measurement and advertising. You may withdraw your consent at any time with effect for the future.
- Contract (Art. 6(1)(b) GDPR) – order processing, payment, shipping, and handling your enquiry.
- Legal obligation (Art. 6(1)(c) GDPR) – in particular retention periods under tax and commercial law.
- Legitimate interests (Art. 6(1)(f) GDPR) – operating and securing the website, preventing abuse, and direct marketing towards existing business contacts.
SERVER LOG FILES
When you open our website, the web server automatically records the data your browser transmits: IP address, date and time of the request, the page requested, the page you came from, browser type and operating system. These logs are technically necessary to deliver the site, trace faults and fend off attacks.
The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). The logs are deleted after one month. They are not combined with any other data.
The website is operated by a service provider within the European Union with whom we have concluded a data processing agreement under Art. 28 GDPR.
CLOUDFLARE
Our website is delivered through the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, represented in the EU by Cloudflare Germany GmbH. Cloudflare speeds up delivery and blocks overload attacks and bots. In doing so it processes connection data including your IP address and sets the cookies __cf_bm and _cfuvid.
This is technically necessary to keep the site available and protected (Art. 6(1)(f) GDPR). Further information: cloudflare.com/privacypolicy.
COOKIES AND YOUR CONSENT
Cookies are small text files our website stores in your browser. Some are technically necessary for the site to work at all – for the language selection or the shopping cart, for instance. Everything else is only used once you have given your consent. The same applies to comparable techniques such as local storage and session storage.
On your first visit you are therefore shown a notice with two equally prominent buttons. Until you agree, no analytics or advertising services are loaded; during that time Google services run in what is known as consent mode (Consent Mode v2), without cookies and without identifiers.
We store your decision in the cookie organoid_consent for 180 days, together with the time it was made. This serves as the record required by Art. 7(1) GDPR and stops the notice from reappearing on every visit.
Withdrawal: you can change your decision at any time via privacy settings. Withdrawal takes effect for the future; the lawfulness of processing carried out beforehand is unaffected. If you decline, we delete the previously stored origin data from your browser. Independently of this, you can delete or block cookies in your browser at any time; the site will then remain usable to a limited extent.
COOKIES IN USE
The following overview is generated automatically once a month from a measurement of our own website, so it is always up to date.
CONTACTING US AND THE CONTACT FORM
If you contact us by phone, by e-mail or through a form, we process the details you provide – depending on the form: first and last name, company, e-mail address, telephone number, address and your message – in order to handle your enquiry and any follow-up questions.
The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). If a business relationship arises, the statutory retention periods apply. Otherwise we delete the enquiry once it has been dealt with and no retention obligation stands in the way.
To protect the forms against automated submissions we use Cloudflare Turnstile. Turnstile checks without a puzzle whether the submission comes from a human and processes technical details about your browser and connection for that purpose. This is necessary to prevent abuse (Art. 6(1)(f) GDPR).
Your enquiry is stored in our customer management system (Odoo), which is operated for us by a service provider within the European Union. A data processing agreement under Art. 28 GDPR is in place.
ORDERS IN THE ONLINE SHOP
To process an order we handle your order and invoice data: name, address, e-mail address, telephone number, the goods ordered, prices and, where applicable, a different delivery address and company details. This is necessary to perform the purchase contract (Art. 6(1)(b) GDPR).
We pass data on only as far as the processing requires: to the payment provider you selected, to the transport company engaged and to our tax adviser. Invoice data is retained for seven years under § 132 of the Austrian Federal Fiscal Code (Art. 6(1)(c) GDPR).
For this the shop sets technically necessary cookies that keep your cart and your session together. They are marked “notwendig” (necessary) in the overview above.
PAYMENT PROVIDERS
We work with external payment providers to process payments. During the order process the data required for payment is transmitted to the provider you selected (Art. 6(1)(b) GDPR). We do not store full credit card details.
Mollie – Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands. Transmitted are in particular the cardholder name, invoice amount, transaction and payment data and the IP address. mollie.com/en/privacy
PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. paypal.com/en/webapps/mpp/ua/privacy-full
Both providers embed their own scripts into the payment page for fraud prevention, PayPal also Google reCAPTCHA (Google Ireland Limited). These scripts only load once you enter the payment step and are required for secure payment processing.
AUDIENCE MEASUREMENT – GOOGLE ANALYTICS 4
With your consent we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to understand which content is read and where visitors drop off, in order to improve our website.
What is recorded is pseudonymous usage data: pages viewed, time spent, approximate location based on the truncated IP address, the device used and where the visit came from. Google truncates your IP address and does not combine it with other data. We do not link it to your person.
The measurement data runs through our own server at sgtm.organoids.com (server-side tagging). The data is therefore first received by us and only then forwarded to Google; the identifiers set in the process are first-party cookies (FPID, FPGSID).
The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Without consent no measurement takes place. Further information: policies.google.com/privacy
ADVERTISING AND CONVERSION MEASUREMENT
Also only with your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021) we use advertising services. They measure whether an ad led to a visit or an enquiry and make it possible to show you our ads on other websites. For this we transmit usage and campaign data to the providers; in the case of enquiries and orders also hashed identifiers such as a hash of your e-mail address, so that conversions can be attributed to the right ad.
- Google Ads and Google Marketing Platform – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy
- Meta pixel and Conversions API – Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The Conversions API additionally transmits the events server to server. For the jointly controlled collection involved we have an agreement with Meta under Art. 26 GDPR. Privacy policy
- LinkedIn Insight Tag – LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland. Privacy policy
Which cookies these services set and how long they are stored is shown in the overview above.
ATTRIBUTING ENQUIRIES TO CAMPAIGNS
So that we know how an enquiry came about, the website remembers – with your consent – where your visit originated, for example the search engine or the ad you clicked. For this we use the cookie organoid_attr and the entry organoid_attribution_v1 in your browser’s local storage. These entries contain no names or contact details; they are only linked to your enquiry when you submit a form.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). If you withdraw it, these entries are deleted.
FONTS
We embed typefaces through Adobe Fonts (formerly Typekit), a service of Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. When a page loads, your browser retrieves the font files from Adobe servers, transmitting your IP address in the process. Adobe does not set cookies for this.
The consistent appearance of our pages is our legitimate interest (Art. 6(1)(f) GDPR). Further information: adobe.com/privacy/policy
EMBEDDED VIDEOS
On some pages we embed videos from YouTube (Google Ireland Limited). These videos do not load automatically: at first you only see a preview image. Only when you click it is a connection to YouTube established – via the domain youtube-nocookie.com, which sets no advertising cookies before playback. From that click onwards Google learns which page you visited; if you are signed in to Google, the request can be linked to your account.
By clicking you consent to that connection being established (Art. 6(1)(a) GDPR). Further information: policies.google.com/privacy
OUR SOCIAL MEDIA PROFILES
In the footer of our website we link to our profiles on Instagram, Facebook, LinkedIn, Pinterest and YouTube. These are plain links – no content from those networks is loaded and no data is transmitted to them unless you click the link. Once you follow a link, the privacy policy of the respective network applies.
NEWSLETTER
We send newsletters and comparable promotional messages only with your consent (Art. 6(1)(a) GDPR) or on a statutory basis towards existing customers. Sign-up uses a double opt-in procedure: after registering you receive an e-mail asking you to confirm. Registration and confirmation are logged with time and IP address so that the consent can be evidenced.
The only mandatory detail is your e-mail address. Any further details are voluntary and serve to personalise the message. We evaluate whether and when a newsletter was opened and which links were clicked, in order to improve the content. We use a service provider for distribution, with whom a data processing agreement under Art. 28 GDPR is in place.
You can unsubscribe at any time and thereby withdraw your consent – via the unsubscribe link at the end of every mailing or informally to info@organoids.com.
JOB APPLICATIONS
We use application documents you send us solely to assess your application. The legal basis is § 26 of the Austrian Data Protection Act in conjunction with Art. 6(1)(b) GDPR (steps prior to entering an employment relationship). If no appointment is made, we delete the documents seven months after the procedure ends, unless you have agreed to longer storage.
TRANSFERS TO THIRD COUNTRIES
Some of the services named belong to groups whose parent company is in the United States. Even though we contract with the European entities, transfers to the USA cannot be ruled out. Google, Meta, Cloudflare and Adobe are certified under the EU-US Data Privacy Framework, for which the European Commission established an adequate level of protection by decision of 10 July 2023 (Art. 45 GDPR). Standard contractual clauses under Art. 46(2)(c) GDPR are in place in addition.
We point out that US authorities may access data under certain conditions and that legal remedies there are not available to the same extent as in the EU. We therefore use the services concerned only with your consent, unless they are necessary to operate the website.
RETENTION PERIODS
We store personal data only for as long as it is needed for the respective purpose. After that, retention follows the statutory periods – in particular seven years for accounting records (§ 132 Federal Fiscal Code) and up to 30 years for the limitation of claims. The storage period of each cookie is shown in the overview above.
AUTOMATED DECISION-MAKING
Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.
YOUR RIGHTS
You have the following rights in relation to us:
- Access to whether and which data we process about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure, unless a retention obligation stands in the way (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests, in particular to direct marketing (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
An informal message to info@organoids.com is enough. We reply within one month.
If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority. In Austria this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
HOW TO REACH US
ORGANOID GmbH
Phone +43 5449 200 01
info@organoids.com
Registered office:
Nesselgarten 422 / Top 5
6500 Fließ
Austria
Business address:
Kaiserjägerstraße 4a / Top 19
6020 Innsbruck
Austria
Last updated: September 2026. We amend this policy when our website or the legal situation changes. The cookie overview above updates itself monthly.