Skip to Content

Legal

Privacy Policy

How we process personal data under the GDPR. Version: July 2026.

1. Controller

Vorster Consulting GmbH, Sebastianstraße 13, 7063 Oggau am Neusiedler See, Austria · datenschutz@pickudu.com

2. What data we process

  • Purchase & account data: name, billing address, email, order history, payment status (no full payment data — those go directly to the payment provider). Legal basis: performance of contract, Art. 6(1)(b) GDPR; tax-law retention under § 132 of the Austrian Federal Fiscal Code (BAO, 7 years).
  • Uploaded media: photos and videos that you or your guests upload as part of an event. They are stored for the duration of the booked package and deleted afterwards. Legal basis: Art. 6(1)(b) GDPR.
  • Contact requests: the data in your message, stored as long as needed to handle it. Legal basis: Art. 6(1)(b) and (f) GDPR.
  • Server logs: IP address, timestamp, requested URL, user agent — kept briefly for security and error analysis. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

3. Hosting and storage location

Our application and the uploaded media are hosted on servers within the European Union. Photos are stored in an EU bucket at Google Cloud Storage (region within the EU). Data processing agreements pursuant to Art. 28 GDPR are in place with our processors. Transfers to third countries only take place if the legal requirements are met.

4. Cookies and local storage

Without your consent we only set technically necessary cookies: session_id (session, shopping cart, security), frontend_lang (language preference), tz (timezone for correct time display) and pickudu_consent/website_cookies_bar (store your cookie choice). Optional marketing cookies (odoo_utm_campaign/-source/-medium, stored max. 31 days) remember which campaign link brought you to us — they are set exclusively after your consent. External media (e.g. embedded videos) is only loaded after your consent. There is no tracking and no third-party analytics; our reach measurement (self-hosted Plausible Analytics) works without cookies and without personal profiles. Legal basis for technically necessary storage: § 165(3) of the Austrian Telecommunications Act (TKG 2021); otherwise your consent under Art. 6(1)(a) GDPR, revocable at any time via "Cookie settings" in the footer.

5. Recipients

Order data is shared with service providers where necessary for the performance of the contract: the payment provider Stripe Payments Europe, Ltd. (Ireland; you enter your payment details directly with Stripe) and our hosting provider (EU data centre). We do not sell personal data.

6. Retention period

We store personal data only as long as necessary for the stated purposes or as long as statutory retention periods apply. Uploaded media is deleted after the event package expires.

7. Photo and video uploads by guests (event participation)

When you join a Pickudu event as a guest via QR code, we process the following data: the display name you enter, the photos and videos you upload, technical access data (IP address, timestamp, device type) and your votes if the host has enabled the voting feature. Photo metadata (e.g. GPS location, camera/EXIF data) is removed automatically by default upon upload; the host can choose to keep it for their event. For videos, metadata is always removed during processing.

The party responsible for the photo collection within an event is generally the host who set up the event and decides on its purpose and audience. We process the content on the host's behalf as a technical service provider (for commercial hosts, as a processor pursuant to Art. 28 GDPR). For the technical operation of the platform itself (server logs, security, abuse prevention) we act as controller; the legal basis is our legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR).

Your photos and videos are visible only to the participants of the respective event and are deleted when the booked package expires. The host can moderate and remove uploads. If you want your own uploads deleted, or photos showing you removed, contact the host or us (datenschutz@pickudu.com) — we also act on justified deletion requests directly.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent with effect for the future. To do so, contact datenschutz@pickudu.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority (www.dsb.gv.at).