Privacy
1. Controller and contact
The controller for the Institute’s processing described here is IAI Institute for AI GmbH, Auf der Heide 1, 3730 Eggenburg, Austria; Managing Director: Florentina Zach.
For privacy enquiries, contact office@institute-for-ai.academy. Further company information appears in the legal notice.
This notice covers the website and the contact, learning, customer-management and accounting activities below. Access is limited to the responsible personnel and the service providers identified for the relevant activity, to the extent needed.
2. Website operation and security — Vercel
We operate the Next.js/React website using Vercel Pro, provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, California 91723, USA. Technical connection and request data, particularly the IP address and requested resource, are processed to deliver content and address errors and security incidents.
The legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure and reliable website operation. Technical data is needed only for as long as required for delivery, troubleshooting or resolving a security incident, subject to statutory retention obligations.
Vercel processing may take place outside the EEA, particularly in the USA. Vercel’s published DPA provides EU Standard Contractual Clauses for third-country transfers within their scope. Information and safeguards: Vercel DPA, Schedule 3; further information: Vercel Privacy Notice.
3. Email contact — Google Workspace
We use Google Workspace Business Standard for email and collaboration. We process your sender/contact details, messages and supplied attachments to respond to your enquiry and continue the conversation.
Article 6(1)(b) GDPR applies to contractual enquiries or steps taken at your request before a contract; other correspondence is based on Article 6(1)(f) GDPR and our legitimate interest in responding appropriately. The contact details and information needed to answer are necessary for that purpose. Correspondence is retained until the enquiry has been finally handled, and afterwards only to meet statutory retention obligations or where necessary to establish, exercise or defend legal claims.
Google may process data outside the EEA. Its published data processing addendum addresses third-country transfers through applicable alternative transfer solutions or Standard Contractual Clauses; it does not describe exclusively EU processing. Details and clauses: Google Cloud Data Processing Addendum, Appendix 3, which also covers Google Workspace; Google Privacy Policy.
4. Academy — Funnelmate PRO
Our Academy uses Funnelmate PRO, provided by Patrick Mentler Online-Marketing / Patrick Mentler, Siemensstr. 42, 59199 Bönen, Germany. Account, contact and usage data needed for learning access support sign-in, provision and use of the booked learning environment.
The legal basis is Article 6(1)(b) GDPR. The information needed for the account and access is required to perform the contract. Retention depends on the agreed learning-access period or contractual relationship and subsequent statutory retention obligations; records required for legal claims are retained only for that purpose.
5. Payments — Stripe
Booking links lead to external Stripe Checkout. Stripe processes payment, contact and transaction data entered there for the relevant payment; the Institute processes information needed for the booking and payment allocation.
Article 6(1)(b) GDPR applies to booking and payment processing, and Article 6(1)(c) GDPR to legally required records. Without the necessary payment information, the payment cannot be processed. We retain transaction records for contractual administration and subsequently to meet statutory retention obligations and resolve payment issues or legal claims where necessary.
Stripe acts as a controller or processor depending on the activity and processes data internationally. Stripe describes adequacy decisions and EU Standard Contractual Clauses among its transfer mechanisms and provides information about the applicable clauses; the relevant mechanism depends on the recipient and transfer. Details of roles, processing and transfers: Stripe Privacy Policy.
6. Customer and prospect management — Institute CRM
We use our own Next.js/React CRM at https://crm.institute-for-ai.com. It processes contact, organization and case information to manage enquiries and business relationships. Hosting: Vercel; database: Neon / PostgreSQL, Frankfurt, AWS eu-central-1. This region refers to the database, rather than all support or other processing activities.
Article 6(1)(b) GDPR applies to individual pre-contractual and contractual matters; necessary administration of business contacts relies on Article 6(1)(f) GDPR and our interest in orderly business communication. Legally required records are processed under Article 6(1)(c) GDPR. Data is retained to handle the matter or business relationship and afterwards only for applicable statutory obligations or necessary legal claims.
Google OAuth / OpenID provides sign-in for authorized CRM users. Identity and sign-in data required for this purpose support access control under our legitimate interest in secure internal administration, Article 6(1)(f) GDPR; use depends on the relevant access authorization.
The transfer information in section 2 applies to Vercel, and section 3 to Google. Neon’s published DPA contains provisions and Standard Contractual Clauses concerning third-country transfers; the database region alone does not exclude such transfers. Details: Neon DPA and Neon privacy information.
7. Online meetings — Google Meet
We use Google Meet within Google Workspace for online meetings. Depending on participation, names or account information, technical connection data and the audio, video and chat content you share are processed to conduct the conversation.
Article 6(1)(b) GDPR applies to contractual conversations or steps taken at your request before a contract; other business discussions rely on Article 6(1)(f) GDPR and our interest in direct communication. You choose the conversation content you share; connection data is required for technical participation. Processing is tied to conducting the meeting; necessary meeting records are retained until its purpose has been addressed and, where applicable, for statutory obligations or legal claims. The Google provider and transfer information in section 3 applies.
8. Whitepaper and AI updates — Brevo
We use Brevo for the German-language whitepaper/newsletter process. The form requires an email address; a first name is optional. The unchecked consent option combines the whitepaper with regular AI updates. Consent-dependent processing relies on Article 6(1)(a) GDPR; subscribing is voluntary and is not required to use the rest of the website.
Before you enable “Optional marketing / Brevo form”, only a local activation area is displayed; the Brevo form and its external resources do not load. After permission, the local form document loads resources from sibforms.com; submitting sends the details to the configured Brevo endpoint. Permission to load the embedding does not replace the separate consent in the form.
You can withdraw permission for the embedding through “Cookie settings” or “Necessary only”. This removes the embedding and prevents further loading, but does not recall data already transmitted. AI update emails provide an unsubscribe option; you may also contact us at the address above.
Processing for AI updates continues until consent is withdrawn. Where necessary to honor an unsubscribe request or provide evidence, minimal suppression or consent records may be retained for that specific purpose; they are not used for further marketing. The approved whitepaper “EU AI Act in der Praxis” is prepared for delivery after confirmed sign-up; the website currently provides no enabled public download.
Provider information: Brevo Privacy Policy.
9. External links and social networks
The Institute maintains presences on LinkedIn and Instagram. The website links to these profiles and other external media. If you follow a link, the destination provider’s privacy information applies to its page.
If you message us or interact with us publicly there, we use the profile, contact and content data you share to handle the exchange. Article 6(1)(b) GDPR applies to contractual matters; other exchanges rely on Article 6(1)(f) GDPR and our legitimate interest in public communication and responding to messages. Our correspondence follows the retention criteria in section 3; publicly visible contributions are also subject to your and the network’s deletion controls.
10. Local consent preferences
Google Analytics 4 is loaded only after explicit permission for “Statistics / Analytics (Google Analytics 4)”. It measures page views and offer interactions. Without permission, this integration loads no Google resources and sets no analytics cookies. Google advertising signals and advertising personalisation remain disabled; URL query strings, fragments and form contents are not transmitted by this integration. Withdrawing permission in Cookie settings removes the analytics execution context and deletes the _ga cookies accessible to this website. This cannot recall data already transmitted. Provider information: Google Analytics privacy and security.
You can manage your choices through “Cookie settings” in the footer. Optional analytics and marketing choices are initially disabled. Your browser stores the choice, version and timestamp in LocalStorage under institute-consent-v1 so that your decision can be respected. Processing the preference relies on Article 6(1)(f) GDPR and our interest in reliably implementing your permission or refusal.
After more than 180 days, the stored choice is no longer treated as valid; it is not automatically deleted. You can save a new decision or remove local website data in your browser. There is no central server-side consent record.
11. Experience Lab / Arcade
The games run in your browser without registration or an external games API. Only local numeric high scores are stored under institute-arcade-v2-maze, institute-arcade-v2-line, institute-arcade-v2-blocks and institute-arcade-v2-trail, to make each best score available in the same browser. No automatic expiry is configured; you can remove the values by deleting local website data. The feature does not send these values to a central user profile.
12. Accounting and tax administration
For invoicing and tax obligations, we process the necessary master, invoice, service and payment data internally and with our tax adviser. BMD is used in the accounting/tax-adviser context. Recipients are the appointed tax adviser and competent authorities where legally required.
Article 6(1)(c) GDPR applies to statutory bookkeeping, evidence and tax obligations; contractual billing additionally relies on Article 6(1)(b) GDPR. Records are retained for as long as applicable statutory retention obligations or the necessary handling of ongoing tax or legal proceedings require.
13. Your rights
Subject to the legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time. You may withdraw consent at any time for the future without affecting the lawfulness of processing before withdrawal.
Send requests to office@institute-for-ai.academy. Where data is necessary for a contract or statutory obligations, not providing it may prevent the relevant service or transaction. The public website’s guidance tools do not make solely automated decisions producing legal or similarly significant effects.
You may complain to a data protection supervisory authority, particularly the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna; dsb@dsb.gv.at. Further information: data subject rights.