Privacy Notice
Privacy notice of ROARK GmbH under Articles 13 and 14 GDPR, including purposes, legal bases, recipients, and data subject rights.
This privacy notice covers processing for which ROARK GmbH is itself the controller: operating this website, business communications, contract administration and customer administration.
Additional product-specific privacy notices apply to SaaS products. Personal content that business customers process in a SaaS for their own purposes is not covered by this controller notice; for that content, the relevant customer is generally the controller and ROARK is the processor.
Controller
ROARK GmbH
Bossigasse 24/8
1130 Vienna
Austria
Managing Director: Juliamarie Curto
Managing Director: Marcello Curto
Email: datenschutz@roark.at
Phone: +43 660 375 8455
Further company details are available in the Imprint.
Scope and data protection roles
| Processing context | ROARK's role | Applicable information |
|---|---|---|
| Access to and use of this website | Controller under Art. 4(7) GDPR | This privacy notice |
| Enquiries, business contacts, pre-contractual communications, billing and customer administration | Controller under Art. 4(7) GDPR | This privacy notice |
| SaaS account, access, support and security processing for which ROARK determines the purposes and means | Controller under Art. 4(7) GDPR | Privacy notice of the relevant product |
| Customer-determined content and business data within a SaaS | Processor under Art. 28 GDPR | The customer's privacy notice and the executed DPA with its individual service description |
The product-specific notice for the Tender Intelligence Platform is available at tenderintelligenceplatform.com/privacy. For other SaaS services, the relevant product notice applies; this general notice does not replace it.
The public DPA template is not complete by itself and does not automatically become part of a contract. The individual service description forming part of the binding DPA identifies, in particular, the specific product and deployment, processing purposes, data categories, data subjects, subprocessors actually used, processing regions, third-country transfers, deletion periods and backup cycles.
Categories of data subjects and personal data
- Visitors of this website
- Contact persons of prospects, customers and partners
Depending on usage, we may process in particular:
- Master data (for example name, company, business contact details)
- Communication data (for example email content and metadata)
- Usage and log data (for example IP address, timestamp, URL, user agent)
- Contract and billing data
Processing activities, purposes, legal bases and retention
| Processing activity | Purpose | Data categories | Legal basis | Retention |
|---|---|---|---|---|
| Website delivery (server logs) | Stability, security, abuse prevention and troubleshooting | IP address, URL, timestamp, user agent, referrer | Art. 6(1)(f) GDPR | Hosting logs available to us are retained for no more than 30 days depending on the hosting plan. Logs relating to a specific security incident may be preserved until the incident is resolved and, where necessary, until the applicable limitation periods expire. |
Language preference (NEXT_LOCALE) | Delivery and retention of the language expressly selected by the user | Language code, technical cookie data | Section 165(3) Austrian TKG 2021, Art. 6(1)(f) GDPR | For the browser session or until deleted earlier in the browser |
| Email or telephone communication | Handling requests, pre-contractual communication and customer support | Contact data, message content, metadata | Art. 6(1)(b) GDPR where the data subject is the contracting party or requests pre-contractual steps; otherwise Art. 6(1)(f) GDPR | Until the request has been handled, then only for as long as the communication is needed for a business relationship, a legal obligation or the establishment, exercise or defense of legal claims |
| Business contact and contract administration | Pre-contractual communication, administration of customer and partner relationships, service delivery, support and billing | Master, contact, communication, contract and billing data | Art. 6(1)(b) GDPR where the data subject is the contracting party or requests pre-contractual steps; Art. 6(1)(f) GDPR for employees and other business contacts; Art. 6(1)(c) GDPR for legal obligations | For the business relationship, then until outstanding claims have been resolved. Accounting records are generally retained for 7 years from the end of the relevant calendar year. |
| Compliance, legal enforcement and accounting | Compliance with legal duties and the establishment, exercise and defense of legal claims | Contract, billing and communication data | Art. 6(1)(c) and Art. 6(1)(f) GDPR | Generally 7 years from the end of the relevant calendar year for accounting records; for a legal dispute, until its final resolution or expiry of the relevant limitation period |
Customer content in SaaS products
We do not use personal content processed by our customers in a SaaS for their own purposes. We process that content solely on documented instructions as a processor under Art. 28 GDPR. The relevant customer determines the purposes and means and is generally responsible for informing data subjects, establishing a legal basis and handling data subject rights.
Account, access, support and security data for which ROARK determines the purposes and means is kept separate. ROARK is the controller for that data; details are set out in the product-specific privacy notice.
At the end of the processing engagement, we delete or return customer content as set out in the executed DPA and the individual service description. The deletion and backup cycle documented there applies; we do not claim a single product-independent period.
Our legitimate interests
Where processing is based on Art. 6(1)(f) GDPR, we pursue the following legitimate interests:
- secure, stable and abuse-resistant operation of this website and our systems
- detection and correction of technical errors
- retention of a language expressly selected by you during the browser session
- efficient handling of business enquiries and reliable communication with business contacts
- administration of business relationships and delivery of agreed services to business customers, including communications with their employees and other business contacts
- documentation of business activities and the establishment, exercise and defense of legal claims
We take into account the nature, scope and effects of the processing as well as the reasonable expectations of data subjects. You may object to this processing under Art. 21 GDPR on grounds relating to your particular situation.
Sources of personal data
We receive personal data mainly from you, for example when you contact us or act as a business contact.
Where we do not collect data directly from you, we generally receive business contact data from the company or organisation for which you work or from a contractual or project partner involved in the relevant business relationship. Sources of product-specific account and security data are described in the relevant product notice.
Requirement to provide personal data
- Request and log data generated when the website is accessed is technically necessary. Without processing it, the website cannot be delivered or protected.
- Selecting a language and storing the associated preference is voluntary. Without the cookie, the selection is not retained beyond the browser session. The website remains available through the relevant language URL.
- Information provided in an enquiry is voluntary. Without the contact details and content needed for a response, however, we cannot handle the enquiry.
- Contract and billing data is required where necessary to enter into or perform a contract or comply with legal duties. Without this data, we may be unable to enter into the contract, provide the service or bill for it.
Cookies
We do not use tracking, marketing or profiling cookies. Only the technically required cookie NEXT_LOCALE may be set to store your language preference.
Recipients and processors
For the website and communications processing covered by this notice, we use the following providers. This table is expressly not a cross-product SaaS subprocessor list. SaaS subprocessors actually used and processing regions are disclosed for each product. Where required, we have concluded data processing agreements under Art. 28 GDPR.
| Provider | Purpose | Data categories | Role | Processing location | Third-country transfer / safeguard | Retention | DPA status |
|---|---|---|---|---|---|---|---|
| Vercel | Web hosting and delivery services | Request and log data | Processor | EU and additional regions depending on delivery setup | SCC and additional safeguards under Vercel DPA | Based on provider/project settings | In place |
| bunny.net | DNS and edge delivery services | DNS requests and technical metadata | Processor | EU and global edge locations depending on routing | SCC and contractual safeguards under provider terms | Based on provider/project settings | In place |
| Migadu | Email services | Email content and metadata, contact data | Processor | France (mail data centres); provider domiciled in Switzerland | Mail data is stored in the EU; where access or a transfer to Switzerland occurs, the European Commission's adequacy decision applies | Based on mailbox settings; after contract termination, Migadu generally deletes personal data within 30 days unless a legal obligation or specific reason requires longer retention | In place |
ROARK also has direct contractual relationships with Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) for cloud services. In our contractual chain, these providers are therefore not merely subprocessors of Vercel. Whether and to what extent any of them processes personal data in a specific SaaS deployment is determined exclusively by the relevant product notice and the individual service description forming part of the DPA. A direct contractual relationship alone does not mean that the provider is used for every product.
Where ROARK uses Convex for a SaaS deployment, that deployment is located in Convex's EU West region. US East is not used for this processing. The relevant product notice and individual service description identify whether Convex is used for the specific product.
Infrastructure data flow
- Vercel receives technically necessary request and log data when this website is accessed.
- bunny.net provides authoritative DNS services for the domain; DNS queries may be routed through global edge locations.
- Migadu processes email content and metadata in mail data centres in France when you contact us by email. Migadu's corporate domicile in Switzerland is separate from the mail-processing location.
- AWS, Azure and GCP may be used directly by ROARK in SaaS deployments; the specific data flow and regions are documented for the relevant product and deployment.
- Where Convex is used for a product, it is operated in the EU West region.
Subprocessors
The current subprocessors of the providers listed above are identified on their official subprocessor and privacy pages. Changes to a SaaS subprocessor list are notified through the mechanism in the relevant DPA; a change to this general website-provider list does not replace that contractual notice.
Where a third-country transfer relies on Standard Contractual Clauses or other appropriate safeguards, you may contact datenschutz@roark.at to request information about the applicable transfer mechanism and a copy of the relevant safeguards. Content not required for transparency may be redacted to protect trade secrets and security information.
Disclosure to additional recipients
Beyond the above, data is disclosed only
- where legally permitted,
- where required to perform a contract,
- where we are legally obliged, or
- where you have provided consent.
Retention and deletion
We retain personal data until the period stated in the processing table expires or the deletion criterion described there is met. Where more than one period applies to a data record, we delete or anonymize it when the last applicable period has expired unless a statutory retention obligation or preservation required for a specific legal dispute applies.
In Austria, relevant retention obligations may arise in particular under BAO and UGB (typically 7 years for accounting-related records).
Security
We implement appropriate technical and organizational measures under Art. 32 GDPR to protect personal data against loss, unauthorized access and manipulation.
Your rights
Under the GDPR, you have in particular the right to
- access (Art. 15 GDPR)
- rectification (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
- withdraw consent for future processing (Art. 7(3) GDPR)
To exercise your rights, please contact us at datenschutz@roark.at.
Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority. In Austria, the competent authority is:
Austrian Data Protection Authority (Datenschutzbehoerde)
Barichgasse 40-42
1030 Vienna
Website: https://www.dsb.gv.at/
Email: dsb@dsb.gv.at
Updates to this privacy notice
We update this privacy notice where processing activities, legal requirements or service providers materially change.