Privacy policy

1. What do we do?

Secret Mission Eventline DKS OG (Sapphogasse 20/3, 1100 Wien, Austria) produces bespoke, interactive experiences under the brand SECRET MISSION GLOBAL throughout Europe and, on request, worldwide. For this purpose it operates the website secretmission.global, through which you can enquire about such experiences and subscribe to our newsletter (hereinafter “we”).

The protection of your personal data is very important to us. In this privacy policy we inform you transparently and in plain language about which data we collect and how we handle it.

2. What do we inform you about?

• who is responsible for the data processing;
• which data are collected;
• for what purpose these data are collected;
• on what legal basis we collect these data;
• to whom we disclose these data and whether they are transferred to a third country;
• how long we retain the data;
• how you can object to data processing;
• which rights you have and how you can exercise them.

3. Definitions

What are personal data?

Personal data are any information relating to an identified or identifiable natural person. This includes, for example, name, address, date of birth, e-mail address or telephone number, as well as the IP address. Data about personal preferences such as leisure activities or memberships are also personal data.

What are special categories of personal data?

Special categories of personal data (Art. 9 GDPR) are:

• data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
• genetic data and biometric data for the purpose of uniquely identifying a person;
• data concerning health and data concerning a person’s sex life or sexual orientation.

Where necessary and where you disclose such data to us yourself – for example health-related limitations before an event – we may process such data. In this case, their processing is subject to stricter confidentiality and takes place exclusively on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR.

What is the processing of personal data?

Processing means any handling of personal data, irrespective of the means and procedures used, in particular the collection, storage, retention, use, alteration, disclosure, archiving, erasure or destruction of personal data.

What is the disclosure of personal data?

This is the transmission of personal data or making them accessible, for example by publication or by disclosure to a third party.

4. Controller and contact

The controller within the meaning of Art. 4(7) GDPR is:

Secret Mission Eventline DKS OG
Sapphogasse 20/3, 1100 Wien, Austria
Commercial register: FN 67176 3m, Handelsgericht Wien (Commercial Court of Vienna) · VAT ID: ATU83282127
Authorised representatives: Alexander Datzer, Clemens Kaufmann, Michael Schabereiter
Telephone: +43 670 1984 234
General e-mail: office@secretmission.at
Data protection e-mail: datenschutz@secretmission.at

Data protection officer

We are not obliged to appoint a data protection officer pursuant to Art. 37 GDPR and have not appointed one. The contact person for all data protection matters is Michael Schabereiter, who can be reached at datenschutz@secretmission.at or at the postal address stated above.

5. Data security

We store your data securely and take all appropriate technical and organisational measures to protect your data against loss, unauthorised access, misuse or alteration.

Our contractual partners and staff who have access to your data are obliged to comply with the provisions of data protection law. In some cases, within the scope of processing on our behalf, it is necessary for us to forward your enquiries to companies affiliated with us. In these cases, too, your data are treated confidentially.

Transmission between your browser and our servers is encrypted throughout via TLS (HTTPS) at the highest encryption level supported by your browser. Access to our administration systems is restricted to a defined group of persons and secured by multi-factor authentication and a role and permissions concept.

6. Your rights

Right of access (Art. 15 GDPR)

You may at any time request information about the data we have stored about you. We ask you to send your request for access together with credible proof of identity to datenschutz@secretmission.at.

The information is provided in writing or in another form, where appropriate also electronically. If you so request, we may also provide the information orally, provided that you prove your identity in another form. If you submit the request for access electronically, we will provide the information in a commonly used electronic format, unless you specify otherwise.

The information is generally provided free of charge. If further copies are requested, a reasonable fee may be charged. The right to obtain a copy of the processed data must not adversely affect the rights and freedoms of others. In the case of manifestly unfounded or excessive requests, we reserve the right to refuse to provide the information within the statutory limits or to charge a reasonable fee for it.

Your request is processed within the statutory period of one month. We may extend this period by two further months where necessary, taking into account the complexity and number of requests. You will be informed of any such extension within one month of submitting your request for access, together with the reasons for the delay.

Erasure and rectification (Art. 16, 17 GDPR)

You may at any time request the erasure or rectification or completion of your data, provided that no statutory retention obligations or other statutory grounds permitting processing prevent this.

Please note that exercising your rights may, under certain circumstances, conflict with contractual agreements and may have corresponding effects on the performance of the contract (e.g. early termination of the contract or cost consequences).

Restriction of processing (Art. 18 GDPR)

You also have the right to request restriction of processing if you contest the accuracy of the data, the processing is unlawful, the data are no longer needed, or you have objected to the processing.

If the processing of data is restricted, they may only be stored. Any further processing may only take place with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another person or for reasons of important public interest. You will be informed before the restriction is lifted.

Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from us, where the processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means. You also have the right to have the personal data transmitted directly from us to another controller, where technically feasible.

Right to object pursuant to Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on our legitimate interests (Art. 6(1)(f) GDPR). We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your personal data are processed for direct marketing purposes, you have the right to object to such processing at any time and without giving reasons. Following such an objection, we will no longer use your data for direct marketing.

An informal message to datenschutz@secretmission.at is sufficient for your objection.

Withdrawal of consent (Art. 7(3) GDPR)

If you have given consent to the processing of your data, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to lodge a complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The supervisory authority competent for us is:

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40–42, 1030 Wien, Austria
Telephone: +43 1 52 152-0 · E-mail: dsb@dsb.gv.at
Web: www.dsb.gv.at

7. General principles

Which data do we process and where do they come from?

We primarily process personal data that you provide to us or that we collect when operating our website. Under certain circumstances, we may also receive personal data about you from third parties.

These may include the following categories:

• personal master data (name);
• contact data (telephone number, e-mail address);
• enquiry data (requested experience or format, preferred date, place, number of guests, occasion, your message);
• contract data (commissioned experience, date, place, participants);
• financial and payment data (billing address, payment method, payment status);
• health information, only if you give it to us yourself for your safety (see 8.9);
• image and sound recordings at our productions (see 8.10);
• online identifiers (IP address, device and browser data, the random identifier of your answer in the consent banner);
• communication data (e-mails and messages to us).

These data may originate from the following sources:

• your own details in our forms, by e-mail, telephone or WhatsApp;
• information about you provided to us by other people – for example when someone enquires about an experience as a gift for you, a travel advisor on your behalf, or when you take part in a production commissioned by someone else;
• data in connection with the use of the website.

Under what conditions do we process your data?

We process your data in accordance with the applicable data protection laws, in particular the GDPR and the Austrian Data Protection Act (DSG). Processing takes place in each case for the purposes set out in this privacy policy. In doing so, we pay attention to transparency and proportionality.

The processing of your data is lawful where a legal basis under the GDPR applies. Possible legal bases are in particular:

• your consent (Art. 6(1)(a) GDPR);
• the performance of a contract or of pre-contractual measures (Art. 6(1)(b) GDPR);
• compliance with legal obligations to which we are subject (Art. 6(1)(c) GDPR);
• the protection of vital interests of the data subject or of another natural person (Art. 6(1)(d) GDPR);
• our legitimate interests, unless your interests override them (Art. 6(1)(f) GDPR).

For the storage of information on your terminal device and access to it, § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) additionally applies: we only use cookies and comparable technologies that are not technically necessary with your consent.

Under certain circumstances it is necessary for you to provide us with certain personal data so that contractual obligations can be fulfilled. Without such data, we are normally unable to perform a contract. As a rule, the website likewise cannot be used if certain information required to ensure data traffic, such as your IP address, is not disclosed.

In which cases do we disclose your data to third parties?

a) Principle

Under certain circumstances we depend on using the services of third parties or of affiliated companies and commissioning them to process your data (so-called processors). Categories of recipients are in particular:

• accounting, fiduciary and tax advisory services;
• consulting firms (legal advice, tax);
• IT service providers (web hosting, support, cloud services, website design);
• payment service providers;
• insurers (in the event of damage).

We have concluded contracts pursuant to Art. 28 GDPR with all processors. We ensure that these third parties comply with data protection requirements and treat your personal data confidentially. Under certain circumstances we are also obliged to disclose your personal data to authorities.

b) Disclosure to partners on site

To carry out commissioned productions, we work with partners at the respective location – for example venues, hotels and transport and chauffeur services. We transmit to them the details they need for this (see 8.9). Where these partners process the data for their own service – for example a hotel for your stay –, they are independently responsible for it, and the privacy provisions of the respective partner apply. Where they act solely on our behalf, point a) applies.

c) Transfers abroad

In the course of processing on our behalf, your personal data may be transferred to companies outside the European Economic Area (EEA) – in particular to the United States. These companies are bound to data protection to the same extent as we are.

If the level of data protection does not correspond to that of the EEA, we carry out a prior risk assessment and ensure contractually that the same protection as in the EEA is guaranteed – generally by means of the Standard Contractual Clauses of the EU Commission (Implementing Decision (EU) 2021/914) together with supplementary measures. Where a recipient falls under the EU-US Data Privacy Framework, we additionally base the transfer on the EU Commission’s adequacy decision of 10 July 2023. Should our risk assessment be negative, we take additional technical measures to protect your data. You can request a copy of the respective safeguards at datenschutz@secretmission.at.

Our productions take place throughout Europe and, on request, worldwide. If a commissioned experience takes place outside the EEA, we transmit to the partners on site (see b) only the details required to carry it out. The basis is an adequacy decision of the EU Commission where one exists for the country, or Standard Contractual Clauses where we have agreed them with the partner; otherwise the transfer is necessary for the performance of the contract for the commissioned experience (Art. 49(1)(b) GDPR; for participants who did not commission the experience themselves, Art. 49(1)(c) GDPR).

d) How long do we retain your data?

We store personal data only for as long as is necessary to fulfil the respective purposes. We store contract data for longer because we are required to do so by statutory provisions: under § 132 of the Austrian Federal Fiscal Code (BAO) and § 212 of the Austrian Commercial Code (UGB), we must retain business correspondence, concluded contracts and accounting records for seven years, and correspondingly longer in the case of pending proceedings. Insofar as we no longer need such data to provide the services, further processing is restricted and we use them only for accounting and tax purposes. An overview of the specific periods can be found in section 10.

8. Individual processing operations

8.1 Provision of the website and creation of log files

If you merely visit our website, i.e. do not register or otherwise provide information, only the data that your browser automatically transmits to our server are collected. These data are technically necessary for operating the website.

The following are processed in particular: name of the internet service provider, IP address, technical information such as browser, operating system or screen resolution, date and time of access, file retrieved, and the referrer URL. These data are not merged with other data sources.

Purpose — functionality of the website, error analysis and security of our information technology systems, defence against attacks.

Legal basis — legitimate interest (Art. 6(1)(f) GDPR) in secure and stable operation.

Retention period — access logs are automatically deleted after 14 days at the latest, unless they are needed to investigate a specific security incident.

Objection — Storing the log files is strictly necessary for operation; an objection is not possible in this respect.

8.2 Hosting and domain name resolution (DNS)

We operate our website and our administration system on rented servers within the European Union.

For the name resolution (DNS) of the domain secretmission.global we use Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, or Cloudflare Germany GmbH). In doing so, the technical details of the name lookup are processed. The data traffic of the website itself – pages, images, fonts and forms – does not run through Cloudflare but directly between your browser and our server. Questions to our AI advisor are the exception (see 8.11).

Legal basis — legitimate interest in secure, fast and reliable operation (Art. 6(1)(f) GDPR).

Third country — Transfers to the USA may occur; these are safeguarded by Standard Contractual Clauses and – insofar as the provider is certified – by the EU-US Data Privacy Framework.

8.3 Cookies and local storage

Cookies are small text files that are stored on your terminal device by your browser. They do not cause any damage. In addition, we use your browser’s local storage (localStorage and sessionStorage). On this website we use only storage that is technically necessary or triggered by you yourself; we do not use cookies for audience measurement or marketing purposes (see 8.8).

We operate the consent banner ourselves, without an external service provider. We store your answer in the cookie sm_einwilligung; you can change or withdraw it at any time under “Cookie settings” at the very bottom of every page. The banner also asks about the categories “Preferences”, “Statistics” and “Marketing”, so that we could only ever use such services with your consent. At present the website loads no service in any of these categories – not even after you have consented.

So that we can demonstrate consent, your browser additionally sends every new or changed answer to our own management system (“SMOC”, see 8.4). There we record: the random identifier from the cookie, the chosen categories, the banner version, the language, the website, whether it is your first or a changed answer, and the time – no IP address and no details that directly identify you. We delete these entries after three years. The legal basis is our obligation to be able to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

You can configure your browser so that it informs you about cookies being set and you allow this only in individual cases, or so that cookies are generally rejected and deleted when the browser is closed. If cookies are deactivated, the functionality of our website may be limited.

Legal basis — for technically necessary storage, § 165(3) TKG 2021 in conjunction with our legitimate interest (Art. 6(1)(f) GDPR).

8.4 Enquiry forms

Using the enquiry forms on our website, you can enquire about an experience – for yourself or as a travel professional for your clients. When you submit a form, your browser sends your details directly to our customer relationship management at HubSpot (see 8.7); a contact and an enquiry are created there, and our team is notified by e-mail. Our own administration system (“SMOC”, operated on our infrastructure in the EU) takes over the enquiry from HubSpot, and we handle it there.

The data you provide are processed, together with the time of transmission:

• in the general enquiry form: name, e-mail address, where applicable telephone number and preferred way of contact, the requested experience, whom it is for (for a gift, whether it should remain a surprise; for enquiries on behalf of your clients, agency, role and whether you would like to receive our partner terms; for a company, its name), preferred place, time frame, number of guests, duration, occasion, country of residence, the preferred language for your consultation and the content of your message;
• in the enquiry form for our formats: first and last name, e-mail address, telephone number, the chosen format, your preferred date, the content of your message and the currency in which you saw the prices;
• in the enquiry form for travel professionals: your company and its type (for example travel advisory, DMC or concierge), your request, first and last name, e-mail address, telephone number, the requested format, the content of your message and the currency in which you saw the prices.

In each case, HubSpot receives first and last name, e-mail address, telephone number, a language setting and a message summarising all other details – plus the address and language of the page from which you sent the enquiry and the wording of the notice or consent on the form, so that it remains traceable what you read when submitting. Because your browser sends the details directly to HubSpot, HubSpot also receives your IP address in the process – as with any request on the internet.

Purpose — handling and answering your enquiry, documenting the course of the enquiry.

Legal basis — contract or pre-contractual measures (Art. 6(1)(b) GDPR), otherwise legitimate interest in communicating with prospective customers (Art. 6(1)(f) GDPR).

Retention period — until the enquiry has been finally dealt with; thereafter deleted, unless retention obligations under commercial or tax law apply. We delete pure prospect enquiries without conclusion of a contract after 24 months at the latest.

AI support in handling enquiries

Enquiries that are to lead to an offer are kept as a separate case in our system. For such a case, our team can have a language model of Anthropic PBC (548 Market St, San Francisco, CA 94104, USA) create, at the click of a button, a summary of the current status and drafts for reply e-mails. For this we transmit the details of the enquiry – preferred date, number of people, occasion, requested experience, language, budget, location and special requests –, the company name and the texts from our notes and from the e-mail history of your enquiry. Beforehand, we replace names, e-mail addresses and telephone numbers with placeholders, including where they appear in the text of a message.

The AI decides nothing and sends nothing. The summary and drafts are suggestions for our team; every e-mail to you is checked and sent by a human.

Purpose — faster and complete handling of your enquiry.

Legal basis — pre-contractual measures (Art. 6(1)(b) GDPR), otherwise legitimate interest in handling enquiries promptly (Art. 6(1)(f) GDPR).

Third country — USA. The transfer is safeguarded by Standard Contractual Clauses of the EU Commission. The provider is contractually prohibited from using the content to train its models.

Retention period — The summary is kept with your enquiry in our system and is deleted together with it (see above). The provider retains requests for abuse monitoring for a maximum of 30 days.

8.5 Contact by e-mail, telephone and WhatsApp

You can also reach us by e-mail at office@secretmission.at or enquiries@secretmission.at, by telephone or via WhatsApp at +43 670 1984 234. The data you provide are processed – usually name, e-mail address or telephone number and the content of your message – together with the time. E-mails to us arrive in our mailbox at Google Workspace (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland), from which we also reply.

Purpose, legal basis and retention period are the same as for the enquiry forms (8.4).

For communication via WhatsApp, WhatsApp Ireland Ltd. is involved jointly with us. Please note that metadata of your message are transmitted to the operator in the process. Use e-mail or telephone if you wish to avoid this.

Third country — With Google and WhatsApp, transfers to the USA may occur; these are safeguarded by Standard Contractual Clauses and – insofar as the provider is certified – by the EU-US Data Privacy Framework.

8.6 Newsletter

You can subscribe to the SECRET MISSION GLOBAL newsletter via our website. For this we need your e-mail address and your declaration that you agree to receive the newsletter; you may give your first name voluntarily. This newsletter is a separate list, independent of other Secret Mission newsletters. We manage registration, the confirmation e-mail and your subscription in HubSpot (see 8.7); your browser sends your registration directly there.

Registration takes place using the double opt-in procedure: after registering, you receive an e-mail with a confirmation link. Only after your confirmation do we add you to the mailing list. As proof of registration, we log the time of registration and confirmation, the IP address used and the wording of your consent.

You can unsubscribe at any time – via the unsubscribe link at the end of every newsletter e-mail or informally to datenschutz@secretmission.at. Your data in connection with sending the newsletter are deleted immediately if you unsubscribe; we retain the registration logs as proof for up to three years. The lawfulness of processing carried out before the withdrawal remains unaffected.

Legal basis — your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021); for logging, legitimate interest in being able to provide proof (Art. 6(1)(f) GDPR).

Performance measurement — We analyse whether an e-mail was opened and which links were clicked in order to improve our content. You can prevent this by deactivating the loading of external images in your e-mail program.

8.7 Customer relationship management (CRM)

To maintain relationships with customers and prospective customers, we use HubSpot (HubSpot Ireland Ltd., 1 Sir John Rogerson’s Quay, Dublin 2, Ireland) together with our own administration system (“SMOC”). Contact details, enquiry history and communication history are stored there in order to allocate and answer enquiries; SMOC regularly mirrors contacts, companies and enquiries from HubSpot.

We do not use HubSpot’s tracking code on this website: HubSpot receives from the website only what you enter in a form and submit.

Legal basis — pre-contractual measures and performance of a contract (Art. 6(1)(b) GDPR) as well as legitimate interest in orderly customer management (Art. 6(1)(f) GDPR).

Third country — HubSpot stores the data of our account in the EU region; transfers to the USA, for example for support, are safeguarded by Standard Contractual Clauses.

8.8 No third-party services when you visit our pages

We deliver fonts, images, videos and audio from our own server; when you visit our pages, no content is loaded from third parties for this purpose.

We do not use any audience measurement services, advertising or remarketing pixels, or embedded content from social networks, map services or video platforms on this website. Data flow to third parties only in the cases named in this policy – above all when you submit a form yourself (8.4, 8.6), write to us (8.5) or ask the AI advisor a question (8.11).

8.9 Carrying out commissioned productions

If your enquiry leads to a commission, we process the details we need to prepare, carry out and invoice the experience: name, e-mail address and telephone number, billing address, the agreed key details (experience, date, place, number of participants) and payment information – as well as the details about the participants that you or the participants themselves give us for the production.

When you take part in an experience, the following data may additionally arise:

• signatures on liability waivers and declarations of consent;
• health-related information (allergies, health limitations) – exclusively on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR and only insofar as this is necessary for your safety during the experience;
• in exceptional cases, information about an incident on site (accident, property damage) for settlement with our insurer.

To carry out the experience, we pass on the necessary details to the partners involved at the location of the production – for example venues, hotels and transport and chauffeur services (such as names, date, place and schedule). More on this in section 7 b) and c).

Purpose — preparation, performance and invoicing of the commissioned experience, your safety during the experience, settlement of claims.

Legal basis — performance of a contract (Art. 6(1)(b) GDPR); for health information, explicit consent (Art. 9(2)(a) GDPR); for claims settlement, legitimate interest (Art. 6(1)(f) GDPR); for retaining accounting records, legal obligation (Art. 6(1)(c) GDPR).

Third country — for productions outside the EEA, see section 7 c).

Retention period — contract and invoice data seven years from the end of the calendar year in which the service was provided (§ 132 BAO, § 212 UGB). We delete health information no later than 30 days after the experience. We retain liability declarations until the warranty and limitation periods have expired (generally three years).

8.10 Photo and video recordings at our productions

We film and photograph at our productions ourselves; participants are recognisable in the recordings.

a) Recordings during the experience

Image and sound recordings of you are processed in the context of the commissioned experience.

Purpose — documentation of the proceedings, quality assurance of our production, training of our performers, and traceability in the event of an incident.

Legal basis — legitimate interest in documenting and further developing our production (Art. 6(1)(f) GDPR).

Retention period — We delete raw footage without an intended use after 24 months at the latest.

b) Publication for advertising purposes

We also use recordings in which you are recognisable for our online presence and our advertising – in particular on our website, in our profiles on Instagram, Facebook, TikTok, LinkedIn and YouTube, in newsletters and in press and advertising material. Publication takes place exclusively on the basis of your prior, separate consent, which may be withdrawn at any time (Art. 6(1)(a) GDPR in conjunction with § 78 of the Austrian Copyright Act (UrhG), right to one’s own image). We obtain this consent in writing before the start of the experience; it is voluntary and not a condition for your participation.

If you do not give your consent, you participate quite normally – we then do not publish any recordings in which you are recognisable. If you commission an experience for several people, we need the consent of each participant individually; consent given by the person commissioning it is not sufficient for this.

Recipients — the operators of the platforms mentioned as well as commissioned agencies and editorial offices. Once published on a platform, the recordings are accessible worldwide and may also be processed by the platform operator outside the EEA.

Retention period — until you withdraw your consent.

c) Withdrawal

You can withdraw your consent at any time and without giving reasons with effect for the future – informally by e-mail to datenschutz@secretmission.at. The lawfulness of publication carried out up to that point remains unaffected.

Following a withdrawal, we will immediately remove the recordings concerned from all channels that we operate ourselves. Please note: we have no access to material that has already been printed, to copies made by third parties, or to caches of search engines and social networks – we therefore cannot guarantee complete removal from the internet.

8.11 AI advisor “Valentin” (Client Advisor)

A text-based AI advisor (“Valentin”, our Client Advisor) is available on our website and answers questions about our formats, experiences, the process and destinations. It only opens when you click on it; no content is transmitted without your input.

When you send a question, the text of your message, together with the previous conversation history and the language of the page, is transmitted to our service at assistent.secretmission.at. This service runs on the infrastructure of Cloudflare, Inc. and forwards the request to a language model of Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA, for a reply. To limit misuse, we additionally process your IP address.

Please do not enter any sensitive data in the conversation – in particular no health data, payment data, passwords or information about third parties. For personal matters our team is available around the clock by telephone or via WhatsApp at +43 670 1984 234; the route there is shown in every advisor window.

Purpose — automated answering of questions about our offering.

Legal basis — legitimate interest in providing information quickly (Art. 6(1)(f) GDPR); by sending your message you also consent to the transmission of the message text (Art. 6(1)(a) GDPR).

Third country — USA. The transfer is safeguarded by Standard Contractual Clauses of the EU Commission. The provider is contractually prohibited from using the content to train its models.

Retention period — The conversation history is kept in your browser’s storage and is deleted as soon as you start a new conversation or clear your browser storage. The provider retains requests for abuse monitoring for a maximum of 30 days.

Objection — Do not use the advisor; you can obtain all information equally by telephone, by e-mail or on our FAQ page.

9. Recipients at a glance

The following overview summarises the external parties to which data may flow.

10. Retention periods at a glance

11. No automated decision-making

We do not use your personal data for a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). No profiling to evaluate personal aspects takes place. The AI advisor “Valentin” provides information only and does not make decisions about commissions, prices or claims.

12. Video surveillance at locations

We do not operate any video surveillance of our own.

Insofar as video surveillance is used for security reasons at locations we use, it is operated by the respective location operator. The operator is solely responsible for it; signage and data protection information follow the requirements at the respective location (in Austria §§ 12 et seq. DSG). We have no influence on the type, scope and retention period of these recordings and no access to them.

Video surveillance must be distinguished from the photo and video recordings that we make ourselves during our experiences. We inform you about these in section 8.10.

13. Does our privacy policy always stay the same?

We may amend this privacy policy at any time, for example if we use new services or the legal situation changes. The version available at the time of your visit applies. The current version is published at secretmission.global/privacy/; the legally binding German version at secretmission.global/de/privacy/. No separate notification is given; in the case of material changes affecting a consent, we will obtain it anew.