Privacy Policy
Privacy Policy
1. Controller
1. Controller
The controller responsible for the processing of personal data in connection with this website and the business activities described in this privacy policy is:
The controller responsible for the processing of personal data in connection with this website and the business activities described in this privacy policy is:
Tobias Birsak
Birsak Advisory
Riglergasse 5/10
1180 Vienna
Austria
Email: tobias.birsak@birsak-advisory.com
Tobias Birsak
Birsak Advisory
Riglergasse 5/10
1180 Vienna
Austria
Email: tobias.birsak@birsak-advisory.com
2. General principles
2. General principles
Birsak Advisory processes personal data only to the extent necessary for defined business purposes and in accordance with applicable data-protection law.
Birsak Advisory processes personal data only to the extent necessary for defined business purposes and in accordance with applicable data-protection law.
This privacy policy explains which personal data may be processed, for what purposes, on which legal basis, for how long and with whom data may be shared.
This privacy policy explains which personal data may be processed, for what purposes, on which legal basis, for how long and with whom data may be shared.
Where Birsak Advisory processes personal data solely on behalf of a client, the respective client remains the controller and the processing is governed by the relevant engagement terms and, where required, a data-processing agreement.
Where Birsak Advisory processes personal data solely on behalf of a client, the respective client remains the controller and the processing is governed by the relevant engagement terms and, where required, a data-processing agreement.
3. Visiting this website
3. Visiting this website
When the website is accessed, technical information may be processed insofar as this is necessary to deliver the website securely and reliably. This may include, depending on the technical configuration, information such as the requested page, date and time of access, browser and device information, referral information and network or security data.
When the website is accessed, technical information may be processed insofar as this is necessary to deliver the website securely and reliably. This may include, depending on the technical configuration, information such as the requested page, date and time of access, browser and device information, referral information and network or security data.
Purpose: secure and reliable provision of the website, prevention of misuse and technical troubleshooting.
Purpose: secure and reliable provision of the website, prevention of misuse and technical troubleshooting.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in the secure, stable and efficient operation of the website.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in the secure, stable and efficient operation of the website.
4. Website hosting and Framer
4. Website hosting and Framer
This website is created and hosted using services provided by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands.
This website is created and hosted using services provided by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands.
To the extent Framer processes personal data on behalf of Birsak Advisory, Framer acts as a processor. Framer provides a data processing addendum intended to meet the requirements of Article 28 GDPR.
To the extent Framer processes personal data on behalf of Birsak Advisory, Framer acts as a processor. Framer provides a data processing addendum intended to meet the requirements of Article 28 GDPR.
Where Framer or its subprocessors transfer personal data outside the European Economic Area, the transfer must be based on an applicable GDPR transfer mechanism, such as an adequacy decision or appropriate safeguards including the European Commission’s Standard Contractual Clauses, as applicable.
Where Framer or its subprocessors transfer personal data outside the European Economic Area, the transfer must be based on an applicable GDPR transfer mechanism, such as an adequacy decision or appropriate safeguards including the European Commission’s Standard Contractual Clauses, as applicable.
Purpose: website hosting, delivery, security and technical operation.
Purpose: website hosting, delivery, security and technical operation.
Legal basis: Article 6(1)(f) GDPR; where processing is necessary to take steps at the request of a data subject prior to entering into a contract, Article 6(1)(b) GDPR may also apply.
Legal basis: Article 6(1)(f) GDPR; where processing is necessary to take steps at the request of a data subject prior to entering into a contract, Article 6(1)(b) GDPR may also apply.
5. Framer Analytics
5. Framer Analytics
The website may use Framer’s built-in analytics to obtain aggregated information about website use. According to Framer, its built-in analytics do not use cookies or persistent identifiers and do not collect information that identifies an individual website visitor.
The website may use Framer’s built-in analytics to obtain aggregated information about website use. According to Framer, its built-in analytics do not use cookies or persistent identifiers and do not collect information that identifies an individual website visitor.
No separate consent is requested for Framer Analytics on this basis.
No separate consent is requested for Framer Analytics on this basis.
If additional analytics or marketing technologies are introduced later, this privacy policy and, where required, the consent mechanism will be updated before those technologies are activated.
If additional analytics or marketing technologies are introduced later, this privacy policy and, where required, the consent mechanism will be updated before those technologies are activated.
6. Contact form
6. Contact form
If you contact Birsak Advisory through the website form, the information you provide is processed in order to receive, assess and respond to your enquiry.
If you contact Birsak Advisory through the website form, the information you provide is processed in order to receive, assess and respond to your enquiry.
The current form is intended to collect only:
The current form is intended to collect only:
• name;
• name;
• company;
• company;
• email address;
• email address;
• optional message;
• optional message;
• technical submission information generated by the form platform where necessary for delivery, security or spam protection.
• technical submission information generated by the form platform where necessary for delivery, security or spam protection.
Purpose: handling enquiries, initiating business discussions and, where relevant, taking steps prior to entering into a contract.
Purpose: handling enquiries, initiating business discussions and, where relevant, taking steps prior to entering into a contract.
Legal basis: Article 6(1)(b) GDPR where the enquiry relates to a possible engagement; otherwise Article 6(1)(f) GDPR based on the legitimate interest in responding to business enquiries and maintaining professional communications.
Legal basis: Article 6(1)(b) GDPR where the enquiry relates to a possible engagement; otherwise Article 6(1)(f) GDPR based on the legitimate interest in responding to business enquiries and maintaining professional communications.
Form data may be processed by Framer and by the technically configured destination of the form, such as the email or IT service used by Birsak Advisory.
Form data may be processed by Framer and by the technically configured destination of the form, such as the email or IT service used by Birsak Advisory.
Data are retained for as long as necessary to handle the enquiry and thereafter only where continued retention is necessary for documentation, the establishment, exercise or defence of legal claims, or statutory retention obligations.
Data are retained for as long as necessary to handle the enquiry and thereafter only where continued retention is necessary for documentation, the establishment, exercise or defence of legal claims, or statutory retention obligations.
7. Contact by email or other direct communication
7. Contact by email or other direct communication
If you contact Birsak Advisory by email or another communication channel, the information you provide and the resulting correspondence are processed for the purpose of handling the communication, responding to your request and, where relevant, preparing or performing a business relationship.
If you contact Birsak Advisory by email or another communication channel, the information you provide and the resulting correspondence are processed for the purpose of handling the communication, responding to your request and, where relevant, preparing or performing a business relationship.
• professional contact details;
• professional contact details;
• position and organisation;
• position and organisation;
Legal basis: Article 6(1)(b) GDPR where the communication concerns a potential or existing contract; otherwise Article 6(1)(f) GDPR based on the legitimate interest in professional communication and relationship management.
Legal basis: Article 6(1)(b) GDPR where the communication concerns a potential or existing contract; otherwise Article 6(1)(f) GDPR based on the legitimate interest in professional communication and relationship management.
8. Prospects, clients and business partners
8. Prospects, clients and business partners
In the course of business development, mandate preparation, engagement management and professional relationship management, Birsak Advisory may process business contact and relationship data relating to prospective clients, clients, business partners and their representatives.
In the course of business development, mandate preparation, engagement management and professional relationship management, Birsak Advisory may process business contact and relationship data relating to prospective clients, clients, business partners and their representatives.
This can include:
This can include:
• correspondence and meeting information;
• correspondence and meeting information;
• mandate, proposal and contractual information;
• mandate, proposal and contractual information;
• information necessary for invoicing and business administration.
• information necessary for invoicing and business administration.
Data may be obtained directly from the relevant person, from the organisation they represent, from referrals, or — where appropriate — from publicly accessible professional or company sources.
Data may be obtained directly from the relevant person, from the organisation they represent, from referrals, or — where appropriate — from publicly accessible professional or company sources.
Purposes: business development, responding to requests, preparing and performing engagements, relationship management, invoicing, compliance with legal obligations and establishment, exercise or defence of legal claims.
Purposes: business development, responding to requests, preparing and performing engagements, relationship management, invoicing, compliance with legal obligations and establishment, exercise or defence of legal claims.
Legal bases: Article 6(1)(b), Article 6(1)(c) and/or Article 6(1)(f) GDPR, depending on the particular processing activity.
Legal bases: Article 6(1)(b), Article 6(1)(c) and/or Article 6(1)(f) GDPR, depending on the particular processing activity.
9. Recipients and processors
9. Recipients and processors
Personal data are disclosed only where necessary for the respective purpose, where required by law or where an appropriate legal basis otherwise exists.
Personal data are disclosed only where necessary for the respective purpose, where required by law or where an appropriate legal basis otherwise exists.
Recipients may include:
Recipients may include:
• Framer and its relevant subprocessors for website operation;
• Framer and its relevant subprocessors for website operation;
• IT, hosting, email and communications service providers;
• IT, hosting, email and communications service providers;
• professional advisers or specialist service providers where required for a specific matter and subject to appropriate confidentiality obligations;
• professional advisers or specialist service providers where required for a specific matter and subject to appropriate confidentiality obligations;
• accounting, tax or legal service providers where required;
• accounting, tax or legal service providers where required;
• banks and payment service providers where relevant;
• banks and payment service providers where relevant;
• public authorities, courts or other legally entitled recipients where disclosure is required by law.
• public authorities, courts or other legally entitled recipients where disclosure is required by law.
Processors are used on the basis of appropriate data-processing arrangements where required by Article 28 GDPR.
Processors are used on the basis of appropriate data-processing arrangements where required by Article 28 GDPR.
10. International data transfers
10. International data transfers
Where personal data are transferred to recipients outside the European Economic Area, Birsak Advisory will rely on an applicable lawful transfer mechanism. Depending on the recipient and country, this may include an adequacy decision of the European Commission or appropriate safeguards such as Standard Contractual Clauses.
Where personal data are transferred to recipients outside the European Economic Area, Birsak Advisory will rely on an applicable lawful transfer mechanism. Depending on the recipient and country, this may include an adequacy decision of the European Commission or appropriate safeguards such as Standard Contractual Clauses.
11. Cookies and similar technologies
11. Cookies and similar technologies
The website is operated on a data-minimising basis.
The website is operated on a data-minimising basis.
Technically necessary storage or access may be used where required to provide a service expressly requested by the visitor.
Technically necessary storage or access may be used where required to provide a service expressly requested by the visitor.
Non-essential cookies or comparable technologies must not be activated before the legally required consent has been obtained.
Non-essential cookies or comparable technologies must not be activated before the legally required consent has been obtained.
If non-essential technologies are active, add a compliant consent mechanism and a persistent Cookie Settings link, and update this privacy policy to identify the relevant services and purposes.
If non-essential technologies are active, add a compliant consent mechanism and a persistent Cookie Settings link, and update this privacy policy to identify the relevant services and purposes.
12. Storage periods
12. Storage periods
Personal data are stored only for as long as necessary for the purpose for which they were collected.
Personal data are stored only for as long as necessary for the purpose for which they were collected.
Longer retention may be required where necessary to comply with statutory retention duties or to establish, exercise or defend legal claims. Once the relevant purpose and any applicable retention obligations cease to apply, the data are deleted or anonymised.
Longer retention may be required where necessary to comply with statutory retention duties or to establish, exercise or defend legal claims. Once the relevant purpose and any applicable retention obligations cease to apply, the data are deleted or anonymised.
13. Your rights
13. Your rights
Subject to the requirements of applicable law, you have the right to:
Subject to the requirements of applicable law, you have the right to:
• obtain information about your personal data;
• obtain information about your personal data;
• request correction of inaccurate data;
• request correction of inaccurate data;
• request deletion of data;
• request deletion of data;
• request restriction of processing;
• request restriction of processing;
• receive data in a portable format where the legal requirements are met;
• receive data in a portable format where the legal requirements are met;
• object to processing based on legitimate interests;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
Requests may be sent to:
Requests may be sent to:
14. Right to lodge a complaint
14. Right to lodge a complaint
You also have the right to lodge a complaint with a competent data-protection supervisory authority.
You also have the right to lodge a complaint with a competent data-protection supervisory authority.
In Austria:
In Austria:
Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna Austria
Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna Austria
15. Automated decision-making
15. Automated decision-making
Birsak Advisory does not use the website to make decisions based solely on automated processing that produce legal effects concerning website visitors or similarly significantly affect them.
Birsak Advisory does not use the website to make decisions based solely on automated processing that produce legal effects concerning website visitors or similarly significantly affect them.
16. Changes to this privacy policy
16. Changes to this privacy policy
This privacy policy may be updated where the website, processing activities or legal requirements change. The version published on this website is the current version.
This privacy policy may be updated where the website, processing activities or legal requirements change. The version published on this website is the current version.
Last updated: August 2026
Last updated: August 2026