Data Protection Notice

Introduction

This notice explains how uni software plus GmbH processes personal data when you visit our website www.unrisk.com, use our products and services, contact us, or meet us at events or in the course of a business relationship.

UnRisk is a brand of uni software plus GmbH, Linzer Straße 6, 4320 Perg, Austria. uni software plus GmbH is the controller responsible for the processing of your personal data. You can reach us using the details in the “Contact Information” section.

Purposes and legal bases

We process personal data for the following purposes and on the following legal bases.

Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR)

Providing our products and services, including activation keys for software you install on your own systems
Support, invoicing, billing and collection
Answering your enquiries about our products and services

Legal obligations (Art. 6(1)(c) GDPR)

Complying with statutory retention obligations under tax and commercial law
Responding to lawful requests from courts and public authorities

Legitimate interests (Art. 6(1)(f) GDPR)

Communicating with business contacts and existing customers
Informing existing customers about changes to products and services they use
Protecting our IT infrastructure and intellectual property, and preventing fraud
Establishing, exercising or defending legal claims
Improving our products and services

Consent (Art. 6(1)(a) GDPR)

Sending our newsletter and other marketing emails
Lead generation and follow-up after you have submitted a contact form, including forms in LinkedIn campaigns
Web analytics, marketing cookies and the services described under “External Tools”, where they require consent

You can withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Categories and sources of personal data

Depending on how you interact with us, we process the following categories of personal data:

Identification and contact data: name, email address, telephone number, postal address, job title, company name
Contract and billing data: products and services ordered, licence and activation keys, invoicing and payment information
Communication data: content of emails, messages, support requests and form submissions
Technical and usage data: IP address, device and browser information, operating system, internet service provider, date and time of access, pages visited and interactions on our website

We collect personal data:

directly from you, for example when you fill in a form on our website, contact us by email or phone, register for a training or event, or enter into a contract with us
automatically when you visit our website (see “Server log files” and “External Tools”)
from social networks when you interact with us there (see “Social Media Channels”)
from business partners who support us in providing our products and services to you

Is providing your data required?

Providing personal data is generally voluntary. However, we need certain data to conclude and perform a contract with you or to answer your enquiry. Without this data, we may not be able to provide the requested products, services or information.

Recipients, transfers and data security

Recipients of personal data

We only disclose personal data where this is necessary for the purposes described in this notice. Recipients may include:

Service providers (processors) who support us on our behalf, for example in IT and hosting, email and newsletter delivery, billing and collection. They are bound by data processing agreements under Art. 28 GDPR and may only use the data according to our instructions.
Your employer or the administrator of your account, where you use our products and services on behalf of your organisation.
Public authorities, courts and legal advisers, where we are legally obliged to do so or where this is necessary to establish, exercise or defend legal claims.
A buyer or successor in the event of a merger, sale or other transfer of all or part of uni software plus GmbH, subject to applicable data protection law.

The specific providers of the tools we use on our website are listed under “External Tools” and “Social Media Channels”.

Transfers to countries outside the EU/EEA

Some of our service providers process data outside the European Union or the European Economic Area, in particular in the United States. We only transfer personal data to such countries if one of the following safeguards is in place:

an adequacy decision of the European Commission (Art. 45 GDPR), for example for US companies certified under the EU-U.S. Data Privacy Framework
EU Standard Contractual Clauses (Art. 46(2)(c) GDPR)

Which safeguard applies to each provider is stated in the respective section. You can request a copy of the relevant safeguards using the details in “Contact Information”.

Data security

We take appropriate technical and organisational measures in accordance with Art. 32 GDPR to protect your personal data against accidental loss, destruction and unauthorised access, use, alteration or disclosure.

Your rights

Under the GDPR, you have the following rights regarding your personal data:

Access (Art. 15 GDPR): You can request confirmation of whether we process your personal data and receive a copy of it.
Rectification (Art. 16 GDPR): You can request that inaccurate or incomplete data be corrected.
Erasure (Art. 17 GDPR): You can request that your data be deleted, unless we are required to retain it by law or need it to establish, exercise or defend legal claims.
Restriction of processing (Art. 18 GDPR): You can request that we restrict the processing of your data in certain cases.
Data portability (Art. 20 GDPR): You can request to receive data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
Withdrawal of consent (Art. 7(3) GDPR): You can withdraw any consent you have given at any time with effect for the future.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where we process your data for direct marketing purposes, you can object at any time without giving reasons. We will then no longer process your data for these purposes.

To exercise your rights, please contact us using the details in “Contact Information”.

Right to lodge a complaint

If you believe that the processing of your personal data violates data protection law, you can lodge a complaint with a supervisory authority. In Austria, this is:

Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at

Website operation

Hosting

Our website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. Mittwald processes personal data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. The servers are located in Germany.

Server log files

When you visit our website, your browser automatically transmits information that is stored in server log files. This includes your IP address, the date and time of the request, the page or file requested, the referrer URL, your browser type and version, and your operating system.

This data is required to deliver the website, ensure its stability and security, and detect and defend against attacks. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR in the secure and error-free operation of our website.

Cookie consent management (Borlabs Cookie)

We use the WordPress plugin Borlabs Cookie to obtain and manage your consent to cookies and similar technologies. The plugin runs on our own web server; no data is transmitted to the plugin’s developer (Borlabs GmbH, Hamburg, Germany).

When you make a selection in the cookie banner, Borlabs Cookie stores a cookie named “borlabs-cookie” in your browser. It contains your consent choices, a randomly generated identifier and the date of your consent. In addition, we store a record of your consent (identifier, choices, date and time, and cookie version) in our website database, so we can demonstrate that consent was given.

The legal basis for storing the cookie is § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), as it is strictly necessary to remember your choices. The legal basis for processing the consent record is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent). The cookie is stored for 60 days and is then deleted. You can change or withdraw your consent at any time via the borlabs-button on the left side in the footer of our website.

External Tools

Google services via Site Kit

We use the WordPress plugin Site Kit by Google to connect our website with Google services. The plugin itself does not process any additional data of website visitors. The services described below are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Tag Manager

We use Google Tag Manager to manage the integration of other services on our website. Tag Manager does not set cookies itself, but when it is loaded, your IP address and technical browser information are transmitted to Google. Tag Manager is only loaded after you have given your consent via our cookie banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021.

Google Analytics 4

We use Google Analytics 4 to analyse how visitors use our website, so we can improve its content and structure. Google Analytics uses cookies and processes in particular pages visited and interactions on the website, device type, operating system and browser, approximate location (country, region), and the date and time of the visit.

According to Google, Google Analytics 4 does not store IP addresses. The IP address is only used briefly to determine the approximate location and is then discarded.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021, which you give via our cookie banner. You can withdraw your consent at any time via the cookie settings.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is therefore based on an adequacy decision of the European Commission pursuant to Art. 45 GDPR.

Analytics data is stored for 14 months and then deleted automatically.

Google Search Console and PageSpeed Insights

We use Google Search Console and Google PageSpeed Insights to monitor how our website performs in Google Search and how fast it loads. These tools do not process personal data of our website visitors.

Further information on data processing by Google: https://policies.google.com/privacy

Brevo

We use Brevo to provide the forms on our website and to send our newsletter and other emails, including automated messages. The provider is Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France. Brevo processes personal data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. The data is stored on servers within the European Union.

Forms on our website. When you submit a form on our website, the data you enter (e.g. name, email address, company, message) and the date and time of submission are transmitted to Brevo and stored there. We use this data to process your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual steps, and otherwise our legitimate interest in answering your enquiry pursuant to Art. 6(1)(f) GDPR. The forms are protected by Google reCAPTCHA (see “Google reCAPTCHA”).

Newsletter. If you subscribe to our newsletter, we process your email address and, if provided, your first and last name. After you sign up, you will receive an email asking you to confirm your subscription (double opt-in). We store the time of sign-up and confirmation as well as your IP address, so we can demonstrate your consent.

Our newsletters contain a tracking pixel and tracked links. This allows us to see whether and when an email was opened and which links were clicked. We use this information to improve our newsletter and tailor it to our readers’ interests.

The legal basis for sending the newsletter and for this analysis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time using the unsubscribe link in every email or by contacting us. Withdrawal also ends the analysis of opens and clicks.

We store your data for as long as you are subscribed. After you unsubscribe, we keep your email address in a blocklist, so we can make sure you do not receive any further emails. The legal basis for this is our legitimate interest pursuant to Art. 6(1)(f) GDPR in complying with legal requirements.

Further information: https://www.brevo.com/legal/privacypolicy/

Google reCAPTCHA

To protect our contact and registration forms (provided via Brevo) against spam and automated submissions, we use Google reCAPTCHA v3. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

reCAPTCHA checks whether entries on our website are made by a human or by an automated program. To do this, reCAPTCHA analyses various information in the background. This includes in particular your IP address, browser and device information (e.g. browser type, language settings, screen resolution), the date and time of access, your behaviour on the page (e.g. time spent, mouse movements) and any existing Google cookies. This data is transmitted to Google.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021. reCAPTCHA is only loaded once you have consented to the “Marketing” category in our cookie banner. Without this consent, the forms will not be displayed. In that case, you can reach us at any time using the contact details provided on our website. You can withdraw your consent at any time with effect for the future by changing your selection in the cookie settings.

Personal data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. The transfer is therefore covered by an adequacy decision of the European Commission pursuant to Art. 45 GDPR.

We have no influence on the type and duration of data storage by Google. Further information can be found in Google’s Privacy Policy at https://policies.google.com/privacy and in its Terms of Service at https://policies.google.com/terms.

Appointment booking (Microsoft Bookings)

You can book appointments with us via Microsoft Bookings. When you click the booking link, you are redirected to a booking page hosted by Microsoft. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). Microsoft processes the data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR.

When you book an appointment, we process the data you enter, in particular your name, email address, telephone number, the selected date and time and any notes you provide. You will receive a confirmation email. We use this data to schedule, carry out and manage the appointment. The legal basis is Art. 6(1)(b) GDPR, as the booking serves to answer your enquiry or to take steps prior to entering into a contract.

We delete appointment data when it is no longer needed for the appointment and any follow-up, unless statutory retention obligations apply.

Data may also be processed by Microsoft Corporation in the USA. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; the transfer is based on an adequacy decision of the European Commission pursuant to Art. 45 GDPR. In addition, Microsoft uses EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

Further information: https://privacy.microsoft.com/privacystatement

Social Media Channels

We maintain company profiles on LinkedIn, X and YouTube to inform customers, prospects and other interested parties about UnRisk, our products and services, events and webinars, and industry topics.

If you contact us via these networks, for example by sending a message or commenting on a post, we process your user name and the information you provide in order to respond. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, and otherwise our legitimate interest pursuant to Art. 6(1)(f) GDPR in communicating with customers and prospects.

The networks also process your data for their own purposes, in particular for advertising and analytics. We have no influence on this processing or on how long the networks store your data. Further information is available in the privacy policies of the respective networks linked below.

Our LinkedIn company page is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). For the statistics LinkedIn provides about visitors to our page (Page Insights), we and LinkedIn are joint controllers pursuant to Art. 26 GDPR. LinkedIn has assumed primary responsibility for this processing and for fulfilling data subject rights: https://legal.linkedin.com/pages-joint-controller-addendum

Contact LinkedIn’s data protection officer: https://www.linkedin.com/help/linkedin/ask/ppq

LinkedIn Insight Tag

Our website uses the LinkedIn Insight Tag to measure the success of our LinkedIn campaigns, analyse visits to our website and display targeted advertising on LinkedIn. The Insight Tag processes in particular the URL, referrer URL, IP address, device and browser information and timestamps. According to LinkedIn, this data is pseudonymised within seven days and deleted within 90 days.

The Insight Tag is only loaded after you have given your consent via our cookie banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021. You can withdraw your consent at any time via the cookie settings. LinkedIn members can also control the use of their data for advertising in their account settings. Non-members can opt out here: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Data may be transferred to LinkedIn Corporation in the USA. The transfer is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

X

Our X profile is operated by Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland. Privacy policy: https://x.com/en/privacy. Privacy enquiries: https://help.x.com/en/forms/privacy

YouTube

We publish videos on our YouTube channel and embed some of them on our website. YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Embedded videos are only loaded after you have given your consent via our cookie banner. Once loaded, a connection to Google’s servers is established, and Google processes data such as your IP address, device and browser information and the pages you visit. Google may also set cookies and, if you are logged in to a Google account, link your viewing behaviour to your account. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021. You can withdraw your consent at any time via the cookie settings.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is based on an adequacy decision of the European Commission pursuant to Art. 45 GDPR.

Retention periods

We store personal data only for as long as necessary for the purposes for which it was collected. Specific retention periods for individual services are stated in the respective sections. In addition:

Data relating to a business relationship is stored for its duration.
After that, we retain data where statutory retention obligations apply, in particular under Austrian tax and commercial law (generally seven years, e.g. § 132 BAO, § 212 UGB).
We may also retain data for as long as necessary to establish, exercise or defend legal claims.
Data in backups is deleted in accordance with our regular backup cycles.

Data that has been anonymised so that you can no longer be identified is not subject to these limits.

Contact Information

If you have any questions about this notice or wish to exercise your rights, please contact us:

uni software plus GmbH
Linzer Straße 6
4320 Perg
Austria
Phone: +43 7262 52834
Email: office(at)unisoftwareplus.com

Contact person for data protection: Michael Aichinger, office(at)unisoftwareplus.com

Changes to this notice

We update this notice when our processing activities or the legal requirements change. The current version is always available on our website.

Last updated: 10/2026