Privacy Policy

Protecting your personal data matters to us. This privacy policy explains which personal data we process when you visit www.innovateandgrow.com and in the course of our business relationship, for what purposes, on which legal basis, and what rights you have. It is based on the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

1. Controller

innovate+grow consulting gmbh
c/o Mag. Peter Sicher
Lienfeldergasse 60D/Top 12–13
1160 Vienna, Austria
Company register no.: FN 390284y, Commercial Court of Vienna
Phone: +43 676 84 676 1200
Email: peter.sicher@innovateandgrow.com

You can contact us at any time using the details above with any questions about data protection or to exercise your rights.

2. Overview: legal bases

We only process personal data where one of the following legal bases applies:

Consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021) – e.g. for analytics and tracking cookies;
Contract and pre-contractual measures (Art. 6(1)(b) GDPR) – e.g. enquiries, meeting bookings and the delivery of our training and consulting services;
Legal obligation (Art. 6(1)(c) GDPR) – e.g. statutory retention obligations under commercial and tax law;
Legitimate interest (Art. 6(1)(f) GDPR) – e.g. secure and stable operation of the website, maintaining business contacts.

3. Hosting and server log files (HubSpot CMS)

Our website runs on HubSpot's content management system. For customers in Europe, the provider is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland; its parent company is HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

When you visit the website, technically necessary data is processed automatically, in particular your IP address, date and time of access, the page requested, the referrer URL, and browser and operating system information. This data is required to deliver the website and to ensure its security and stability (Art. 6(1)(f) GDPR). It is not combined with other data sources and is stored only for as long as necessary for these purposes.

We have concluded a data processing agreement with HubSpot (Art. 28 GDPR). Where data is transferred to the USA, this is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which HubSpot, Inc. is certified, and additionally on EU Standard Contractual Clauses.

4. Cookies and consent management

Our website uses cookies – small text files stored on your device. We use technically necessary cookies on the basis of § 165(3) TKG 2021 and Art. 6(1)(f) GDPR. All other cookies (analytics, tracking, marketing) are only set with your consent, which you give via our cookie banner.

You can withdraw or change your consent at any time with effect for the future by reopening the cookie settings or by deleting cookies in your browser. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. HubSpot analytics and tracking

With your consent, we use the HubSpot tracking code to analyse how our website is used (e.g. pages viewed, time spent, traffic sources) and to improve our offering. If you submit your data to us via a form, your previous website visits may be associated with your contact record in our CRM.

Cookies set include __hstc, hubspotutk (recognition, up to 6 months), __hssc (session, 30 minutes) and __hssrc (session end). The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). For transfers to the USA see section 3. More information: HubSpot privacy policy.

6. Google Analytics and Google Tag Manager

With your consent, we use Google Analytics 4 and Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; its parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics creates pseudonymous usage statistics (e.g. pages viewed, time spent, device, approximate location). Google Analytics 4 does not store IP addresses. Cookies set include _ga and _ga_<ID> with a lifetime of up to 2 years; event-level analytics data is automatically deleted after 2 months and user-level data (e.g. user identifiers) after 14 months. Google Tag Manager itself does not set cookies; it is used to manage the tags we use.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Google LLC is certified under the EU-U.S. Data Privacy Framework. We have concluded a data processing agreement with Google. More information: Google privacy policy.

7. Contact forms and enquiries

If you contact us via a form, by email or by phone, we process the data you provide (e.g. name, company, email address, phone number, message) in order to handle your enquiry. Forms are provided via HubSpot, and the data is stored in our HubSpot CRM.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). We delete the data once your enquiry has been fully handled, unless statutory retention obligations apply.

8. Online meeting booking (HubSpot Meetings)

You can book a meeting with us via "Book a meeting". We process your name, email address, the time slot you choose and any optional information about the purpose of the meeting. Bookings are handled via HubSpot Meetings and synchronised with our calendar. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures).

9. Live chat (HubSpot Conversations)

When you use our live chat, we process the chat content and, where applicable, your name and email address in order to answer your enquiry. The messagesUtk cookie is used to recognise your chat history. The legal basis is Art. 6(1)(b) or (f) GDPR, and your consent for non-essential cookies.

10. Email marketing and newsletter

If you sign up for our newsletter or for information about events, we use your email address and any other information you provide voluntarily to send you this information. Emails are sent via HubSpot. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). We analyse whether emails are opened and which links are clicked in order to improve our content. You can unsubscribe at any time using the link in every email.

11. Customer and business contacts (CRM)

To manage relationships with our customers, prospects and business partners, we store contact details and information about the business relationship in our CRM system (HubSpot). The legal basis is Art. 6(1)(b) GDPR or our legitimate interest in maintaining business relationships (Art. 6(1)(f) GDPR).

12. Links to social networks

Our website links to our profiles on LinkedIn, X (Twitter) and Facebook. These are plain links, not embedded plugins. Data is only transmitted to the respective provider when you click a link and visit the network's site, where the provider's privacy policy applies.

13. Recipients of your data

Within our company, only those people who need the data for the purposes described have access to it. We also use carefully selected processors (in particular HubSpot and Google) who act solely on our instructions. Data is only disclosed to other third parties where we are legally obliged to do so or you have given your consent.

14. Retention period

We store personal data only for as long as necessary for the respective purpose. Data from business relationships is retained in accordance with statutory retention obligations (generally seven years under § 132 BAO and § 212 UGB). Data processed on the basis of consent is deleted once you withdraw your consent.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to withdraw any consent given at any time (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, simply contact us using the details in section 1.

Right to lodge a complaint: If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

16. Data security

Our website is served exclusively via encrypted HTTPS (TLS). We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

17. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

18. Changes to this privacy policy

We will update this privacy policy if our website, our services or the legal situation change. The version published here applies.

Last updated: September 2026