Privacy Policy

Version: 29 September 2026

> Only the German version of this policy is legally binding. This translation is provided for understanding.

Controller

roleALPHA GmbH, Aschergasse 34, 1130 Vienna, Austria, e-mail: office@rolealpha.com

What we process, and what for

Website. When you open it, our server processes technically necessary data (IP address, time, the address requested, browser identification) in order to deliver the page and to fend off attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We delete server logs after 14 days. We use no tracking or marketing cookies and embed no third-party content.

Only these cookies are set, and only when you do something that requires them:

• Session – keeps you signed in; until you sign out, at most 14 days without use
• Guest access – opens a shared workshop without an account; for the duration of the visit
• Language – remembers the language you chose; one year

In addition, the browser of a signed-in person stores the choice between a light and a dark appearance and which folders are collapsed locally. None of this needs consent, because without that storage the service you called up does not exist (§ 165(3) TKG 2021).

Reach measurement. On the public pages of this website we count page views with Umami, open-source software we run on our own server. No cookies are set, no IP addresses are stored and no profiles are built; the request and the browser details become a checksum that changes daily and cannot be traced to a person. The resulting figures do not leave our server. The legal basis is our legitimate interest in statistics without tracking (Art. 6(1)(f) GDPR). No measurement takes place inside the workspace: what customers do with their workshops, we do not count.

Registration and account. Name, e-mail address, company, billing address and VAT identification number of the person concluding the contract for their business, in order to conclude and perform the contract (Art. 6(1)(b) GDPR).

Use of the Service. Workshops, daily agendas, shares, and the names and e-mail addresses of invited people. We process this data on behalf of the customer; the data processing agreement applies.

Billing. Billing model, usage quantities, invoices and payment status, in order to perform the contract and to comply with statutory record-keeping obligations (Art. 6(1)(b) and (c) GDPR).

VAT number check. We check the VAT identification number provided through the European Commission’s VAT Information Exchange System (VIES) and store the result as evidence (Art. 6(1)(c) GDPR).

Correspondence. If you write to us, we process what you tell us in order to answer (Art. 6(1)(b) or (f) GDPR).

Recipients

• netcup GmbH, Germany — hosting (processor)
• Microsoft Ireland Operations Ltd., Ireland — sending e-mail via Microsoft 365 (processor)
• Odoo S.A., Belgium — accounting and invoicing (processor)
• Stripe Payments Europe Ltd., Ireland — payment processing
• European Commission — VAT number check via VIES
• Tax advisors and authorities, where required by law

Transfers to third countries

Stripe and Microsoft may also process data in the USA. The transfer is based on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

Retention

We store account data for the term of the contract. We delete content at the latest 30 days after the contract ends. We keep accounting and tax records for seven years (§ 132 BAO), and longer in the cases provided for by law.

What accrues beyond that we delete automatically: expired sign-in links and invitations after 30 days, expired or revoked sessions after 30 days, log entries about access and changes within the workspace after one year. We delete server logs after 14 days.

Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection. Please contact office@rolealpha.com. You may also lodge a complaint with the Austrian data protection authority.

This version is also provided in other languages. Only the German version is authoritative and legally binding; translations are provided for understanding.