Privacy Policy

Last updated: November 2026

This is a convenience translation of the German original (sentrivo.at/datenschutz). In case of discrepancies, the German version prevails.

Protecting your personal data is important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, Austrian Data Protection Act (DSG), Austrian Telecommunications Act (TKG 2021)). This policy informs you about the nature, scope and purpose of processing on the website and platform sentrivo.org / sentrivo.at.

1. Controller

Gerhard Kienbauer
Riedauerstraße 4, 4753 Taiskirchen im Innkreis, Austria
Email: team@sentrivo.at

2. Roles for business customers

Sentrivo is a platform for businesses. When a company registers its employees on the platform, the company is the controller within the meaning of Art. 4(7) GDPR for the data of its employees. Sentrivo processes this data as a processor (Art. 28 GDPR) on the basis of a data processing agreement that forms part of the terms of use. For visits to the public website and the registration of the company administrator, Sentrivo itself is the controller.

3. What data we process

3.1 Visiting the website (server logs)

When you access the website, our hosting provider automatically processes: IP address, date and time, page accessed, browser type and operating system, referrer URL. This data serves the technical provision, stability and security of the website (legal basis: Art. 6(1)(f) GDPR – legitimate interest). Retention period: server log files are deleted after 30 days.

3.2 Registration and user account

During registration we process: name, email address, password (exclusively as a cryptographic hash), company name, role (administrator/employee), preferred language and assignment to the company. Purpose: provision of the user account and performance of the contract of use (Art. 6(1)(b) GDPR).

3.3 Training data

When you use the platform we process: completed modules, quiz results, points earned (XP), level, badges and timestamps of completions. Purpose: evidence of training, progress display and evaluations for the company administrator (Art. 6(1)(b) GDPR or, for employees: legitimate interest of the employer in demonstrable security awareness pursuant to Art. 6(1)(f) GDPR in conjunction with statutory duties of care, e.g. NIS2 legislation).

Note for employees: Your employer (company administrator) can view your training progress and quiz results. Sentrivo does not evaluate this data for purposes other than documenting training.

3.4 Invitations

When an administrator invites employees, we store the invited email address and an invitation token until the invitation is accepted or for a maximum of 30 days.

3.5 Contact

If you contact us by email or via the contact form on our website, your details (name, email address, optionally company and phone number, subject and message) are stored to process the enquiry and for follow-up questions (Art. 6(1)(b) or (f) GDPR). Enquiries via the contact form are stored in our database (Supabase, see section 5) and forwarded to us by email. To protect against misuse (spam), we store a non-reversible hash of your IP address for 30 days. We delete the enquiry itself no later than 12 months after it has been dealt with, unless statutory retention obligations or a contractual relationship prevent this.

3.6 Link and email check

In the customer area, signed-in users can have links they do not trust checked for typical signs of phishing and fraud. The submitted link is not opened; only the address itself is examined. For the assessment, we query the registration date of the domain from the registry responsible for the domain using the standardised RDAP protocol. Only the domain name is transmitted, no information about you.

Email check: Users can also have a suspicious email checked as a file. The file is not uploaded but analysed directly in the user's browser. Only the following is transmitted to our server for the assessment: the sender's name and address, a different reply-to address, the check results of the receiving mail server (SPF, DKIM, DMARC), the links contained in the email, the names, types and sizes of attachments, and indications of typical fraud characteristics in the text as yes/no values (e.g. "request for a bank transfer"). The email text itself, the subject and the attachments do not leave the browser. To detect senders pretending to be colleagues, we compare the sender name with the names of your company's users on the platform. Links and attachments are not opened. This information is only processed for the duration of the check and is not stored, with the exception of the sender domain as described in the following paragraph.

For each check, we store the checked domain or, for the email check, the sender domain (not the full link and no email content), the result, the time and the assignment to your user account and company. Purpose: limiting the number of checks to prevent misuse and an anonymous evaluation for the company administrator. The administrator only sees totals and flagged domains, not who checked which link. The data is deleted automatically after 90 days. Legal basis: Art. 6(1)(b) GDPR (provision of the contractually agreed service) and Art. 6(1)(f) GDPR (legitimate interest in the secure and abuse-free operation of the platform and in protecting the company against fraud attempts).

3.7 Contacting businesses (direct marketing)

We occasionally introduce our service by email to businesses for whose professional activity it may be relevant – exclusively in countries where this is permitted towards businesses without prior consent. For this purpose we process data from publicly available sources (the company's website, business directories, company registers): company name, address, general business email address and phone number, website and, where applicable, the name and role of a contact person listed there. The legal basis is our legitimate interest in presenting our service (Art. 6(1)(f) GDPR).

You can object to this processing at any time (Art. 21(2) GDPR) – with a short reply to our email or to team@sentrivo.at. We will then no longer contact you and only keep a suppression note (company name and email address) to make sure this remains the case. If we receive no reply, we delete the data no later than 12 months after our last contact. Emails are sent from our mailbox hosted by IONOS (see section 5).

4. Cookies, local storage and Google Ads

For sign-in, a session token is stored in your browser's local storage (localStorage). It is technically necessary to keep you signed in and is deleted when you sign out. Your language preference and your choice in the cookie banner (for 12 months) are also stored locally. No consent is required for this pursuant to § 165(3) TKG 2021. We do not use analytics tools.

Google Ads conversion tracking (only with your consent): If you click “Accept” in the cookie banner, we load the Google tag (gtag.js) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on the public pages of our website (not inside the platform after sign-in). This lets us measure whether visitors reached the website through one of our Google ads and then, for example, signed up. Cookies are set (e.g. “_gcl_au”) and data such as IP address, device and browser information, pages visited, time and the ad click ID are transmitted to Google. Google partly processes this data as an independent controller; the Google Ads Controller-Controller Data Protection Terms apply. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Without consent, the Google tag is not loaded and no data is sent to Google. Depending on their type, the cookies are deleted after 90 days up to a maximum of 13 months. You can withdraw your consent at any time with effect for the future: open cookie settings (also via the “Cookie settings” link in the website footer). More on privacy at Google: policies.google.com/privacy

5. Recipients and processors

Data is not passed on to other third parties, except to Google as described in section 4 (only with your consent) or where we are legally obliged to do so.

6. Retention period

Account data and training data are stored for the duration of the contract of use and deleted within 30 days after its end or upon instruction of the business customer, unless statutory retention obligations prevent this. At the company's request, training records can be retained longer for documentation towards authorities or auditors. Link and email check logs (section 3.6) are deleted automatically after 90 days. Data from contacting businesses (section 3.7) is deleted no later than 12 months after the last contact; suppression notes following an objection are kept for as long as we contact businesses by email.

7. Data security

Transmission is exclusively encrypted (TLS). Passwords are stored only as hashes. Access to data is restricted by role-based access rules (row level security) so that each company can only see its own data.

8. Your rights

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Please contact team@sentrivo.at. Employees of a business customer should primarily contact their employer as controller; we support the employer in responding.

If you believe that the processing of your data violates data protection law, you may lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna. You may also contact the supervisory authority of your own EU member state.

9. Changes

We reserve the right to amend this privacy policy if the legal situation or our processing changes. The current version is available at sentrivo.org/privacy (German: sentrivo.at/datenschutz).

← Back to homepage Imprint Deutsche Fassung