Last updated: 9 October 2026
1. Controller and scope
MAD Tech GmbH, Volksfeststraße 16, 4910 Ried im Innkreis, Austria, is responsible for the processing of personal data described here. For privacy questions or to exercise your rights, contact us at office@mad-tech.at. Further company details are available in the Legal Notice.
This policy covers the blankmile marketing website, contact enquiries and meeting bookings. It does not cover processing within the blankmile products or on behalf of our customers. The relevant contractual documents and supplementary privacy information govern that processing.
Relevant provisions include the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and, for storing information on or accessing information from your device, section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
2. Website delivery and Hetzner web hosting
Our website uses hosting provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner provides the technical infrastructure and processes the resulting visitor data as a hosting provider.
When you access the website, technically necessary connection data is processed. This includes your IP address, request time, requested address or file, HTTP status, data volume transferred, and browser-supplied information about your browser, operating system and, where applicable, the previously visited page (referrer). This data is used to deliver the website, analyse errors and prevent misuse and attacks.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in providing a secure and reliable website. Transmission of the technically necessary connection data is required to access the page; without it, the website cannot be delivered.
According to Hetzner’s documentation, the default retention period for web hosting access and error logs is seven days. This can be changed in konsoleH; the period configured there is decisive. Hetzner also describes default anonymisation of IP addresses in web server logs. The full IP address is required for the technical connection to the website. Where individual log records are needed to investigate a specific security incident or assert or defend resulting claims, further retention is determined by that purpose.
Hetzner provides further details in its privacy information and its information on log file storage.
3. Privacy settings, cookies and local storage
HubSpot for contact forms and meeting bookings, Google Analytics for usage analysis, and Google Ads for advertising measurement are optional services with separate checkboxes. These are initially switched off. ‘Save selection’ applies your choices; ‘Allow all’ activates all offered services. ‘Necessary only’ rejects them. Analytics and Ads currently use a shared Google tag. We therefore load both only when you select both separately; if you select only one, both remain blocked. HubSpot operates independently. The respective scripts and content are not loaded before consent. Closing the banner or continuing to use the website does not constitute consent.
We store your choices, the time and the version of the consent information under the key ‘blankmile.privacy.v3’ in your browser’s local storage. Your choice is respected for no more than 180 days; after expiry, it is removed on the next access and you are asked again. This entry contains no visitor identifier assigned by us and is not sent to a server by our consent management. If you clear browser storage or use another browser, you need to choose again. If local storage is blocked, your choice applies only to the page currently open.
Storing your privacy choices allows us to implement your decision. The exception for strictly necessary storage under section 165(3) TKG 2021 applies. Where personal data is involved, processing is based on Article 6(1)(f) GDPR; our legitimate interest is in reliably respecting your choice.
Optional embedding of HubSpot, Google Analytics and Google Ads, and related storage and access that are not strictly necessary, are based on your consent under Article 6(1)(a) GDPR and section 165(3) TKG 2021. Details follow below.
You can change your decision at any time through ‘Privacy settings’ in the footer. Untick the respective service and select ‘Save selection’, or withdraw all optional consents with ‘Necessary only’. If services have already loaded, the page reloads to stop them running. Withdrawal does not affect the lawfulness of processing before it. When you withdraw a Google choice, we stop the shared tag and delete the Analytics and Ads cookies accessible to this integration on our domain. Data already transmitted is not automatically deleted. We cannot technically remove cookies or stored data on HubSpot or Google domains from your browser; you can delete them through your browser settings.
4. HubSpot: contact forms and meeting bookings
We use HubSpot to provide contact forms, book meetings and process resulting enquiries. The provider includes HubSpot Ireland Limited in Ireland and its affiliate HubSpot, Inc. in the USA. HubSpot processes submitted contact data as a service provider for handling our enquiries. Further information about HubSpot’s processing and its affiliates is available in the provider information linked below.
After you give permission, the forms or calendar are loaded directly from HubSpot. At least technically necessary connection data, such as your IP address, browser information, time and the addresses requested for the integration, is transmitted to HubSpot. HubSpot may use cookies and similar technologies to provide and secure the integration, recognise a browser and analyse form or calendar use. Your permission covers these optional embedded HubSpot functions. Our consent management does not include a separate general marketing or analytics script.
Cookies documented by HubSpot include ‘__cf_bm’ to protect against automated abuse (30 minutes) and ‘__cfuvid’ to limit abusive requests (until the session ends). Depending on configuration, ‘hubspotutk’ and ‘__hstc’ may also be used for recognition and usage analysis (six months each), ‘__hssc’ for session tracking (30 minutes) and ‘__hssrc’ to detect a new browser session (until the session ends). Which storage is possible also depends on your browser settings. HubSpot uses additional infrastructure and CDN providers to deliver and secure its services; the providers involved are described in the subprocessor list linked below.
When you submit a form or book a meeting, HubSpot also receives the details you enter, such as your name, business email address, company, telephone number where applicable, message and preferred appointment. Required fields are marked in the respective form. The data is used to answer your enquiry, arrange the meeting and communicate about it. Please do not submit special categories of personal data, such as health information, through these forms.
Loading the optional integration is covered by your consent under section 3. Subsequent processing of a specific enquiry is based on Article 6(1)(b) GDPR where necessary for a contract or pre-contractual steps with you. For other enquiries, particularly from business contacts, Article 6(1)(f) GDPR is the legal basis; our legitimate interest is in answering business enquiries and organising customer communication. Consent to the integration does not constitute consent to newsletters or other promotional emails.
Providing your contact details is voluntary. However, we cannot process the enquiry or booking without the information marked as required. Alternatively, you can contact us by email without enabling HubSpot. Deliberately clicking a link to the calendar on HubSpot’s website takes you to an external service governed by its privacy information.
Enquiry and appointment data is needed for as long as required to handle your enquiry, conduct and follow up the meeting, or maintain a resulting business relationship. Further storage then depends on statutory retention obligations and the need to establish, exercise or defend legal claims. The duration of cookies and similar provider storage depends on their purpose and HubSpot configuration; details appear in HubSpot’s cookie documentation linked below. You may withdraw consent at any time with effect for the future.
The integrations use HubSpot’s EU1 region. This does not guarantee that all processing takes place exclusively in the EU. In particular, HubSpot, Inc. and other providers outside the European Economic Area may be involved. Under HubSpot’s published contractual terms, transfers to HubSpot, Inc., where applicable, rely on the EU–US Data Privacy Framework (Article 45 GDPR). Where that mechanism does not cover a transfer, the terms provide in particular for EU standard contractual clauses under Article 46 GDPR. Information on safeguards and subprocessors is available through the following links and may also be requested from us.
Provider information: HubSpot Privacy Policy, Data Processing Agreement and transfer safeguards, Subprocessors and Cookie documentation.
5. Google Analytics 4 (optional usage analysis)
If Google Analytics is offered in the banner and you consent, we use Google Analytics 4 to understand website use and improve content. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your separate consents for Analytics and Ads, we do not load the shared Google tag or send cookieless measurement signals to Google through this integration. Enabling HubSpot alone does not activate Google Analytics. The legal bases are Article 6(1)(a) GDPR and section 165(3) TKG 2021.
Processing includes page views, times, session and cookie identifiers, technical browser and device data, and referral sources. When you use our buttons, we also record their visible label, position on the page and, where applicable, destination address without query parameters or URL fragments. Form entries and ROI calculator values are not read for this purpose. Google technically receives your IP address when a connection is established. Google states that it does not log or store IP addresses of EU users; these may be used to determine an approximate location before being discarded. This does not guarantee fully anonymous data. Our page-view configuration removes query parameters and URL fragments from page and referral URLs. We do not send form entries, names, email addresses or our own user identifiers to Google Analytics.
Our integration disables Google Signals and advertising personalisation. Google Ads is used for the advertising measurement described below. Storage and use of data for this measurement are enabled only after both Google consents. Consent to personalised advertising is not given. We use Google Tag Manager from Google Ireland Limited to technically manage and trigger these measurements. Tag Manager is also loaded only after both Google consents; in particular, your IP address and browser data are technically transmitted to Google. It controls the permitted Google tags and the described measurement of button clicks. HubSpot loads independently on this website and only with its own consent.
Google Analytics uses, in particular, the first-party cookies ‘_ga’ to distinguish browsers and ‘_ga_<identifier>’ for session status. Our tag configuration limits their duration to 180 days and disables renewal on each page view. You may delete these cookies at any time through your browser settings. Your consent is also valid for no more than 180 days.
Cookie duration differs from retention of analytics events already sent to Google. Retention of user and event data is configured in the Analytics property. The integration is prepared in the website draft; before publication, the actual retention period and other account settings must be defined and this information completed. Aggregated reports may be subject to different retention rules.
Processing by Google LLC and other providers outside the EEA, particularly in the USA, is possible. Google identifies the EU–US Data Privacy Framework for covered transfers to appropriately certified US recipients and otherwise the applicable contractual safeguards, particularly EU standard contractual clauses. Exclusively European processing is not guaranteed. Information on Google’s processing, data processing terms and transfer safeguards is available here:
Google Privacy Policy · Data processing terms · International data transfers
You may withdraw consent at any time through the privacy settings. This ends future measurement through our integration and deletes its website cookies. Contact us to request access to or deletion of personal data already processed; withdrawing cookie consent alone does not trigger retroactive deletion at Google.
6. Google Ads (optional advertising measurement)
With your separate consent, we use Google Ads from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure the effectiveness of our advertising and attribute website visits to ad interactions. The Google tag shared with Analytics processes page views and times, cookie, click and browser identifiers, referral sources and technical device and browser data. Your IP address is also transmitted to Google when the connection is established. The shared tag loads only with consent to both Analytics and Ads; HubSpot consent alone is insufficient. The legal bases are Article 6(1)(a) GDPR and section 165(3) TKG 2021.
Permission covers advertising measurement, not personalised advertising. We set advertising personalisation permission to ‘denied’ and disable corresponding signals in our integration. We do not add enhanced conversions using names, email addresses or phone numbers from contact forms. Specific conversion actions and reporting depend on the Google account configuration; our website does not report a page visit alone as a submitted enquiry or booked meeting.
Google may use cookies with the ‘_gcl_’ prefix to associate ad clicks with subsequent website activity. Google states a duration of 90 days for these cookies. Depending on browser and Google settings, cookies on Google domains may also be used; Google states 13 months for ‘IDE’ and ‘id’ in the EEA, Switzerland and the UK. These details do not mean all cookies are set on every visit. Actual storage depends particularly on your consent and your browser’s cookie rules.
Cookie durations differ from retention of advertising measurement data already transmitted. Retention and analysis are governed by the actual Ads and Analytics account settings and applicable Google terms. These settings and the specific retention period must be confirmed before publication of the website draft and completed here; no particular account setting is presented as already verified.
Recipients may include Google LLC and other Google providers in addition to Google Ireland Limited. Processing in the USA and other countries outside the EEA is possible. For relevant transfers, Google identifies the EU–US Data Privacy Framework for covered certified recipients and the applicable EU standard contractual clauses. The information on Google, processing terms and transfers linked in the Analytics section also applies. Further information on advertising cookies is available here:
Google’s information on cookies
You can withdraw Ads consent at any time through the privacy settings. This also stops the currently shared Analytics and Ads tag. Accessible first-party Google measurement cookies are deleted; cookies stored on Google domains can be removed through your browser. Withdrawal takes effect for the future and does not automatically delete data already transmitted. Contact us to exercise your data protection rights.
7. Contact by email
If you contact us by email, we process your email address, message, any additional contact details you provide and technical transmission data. The purpose is to handle and answer your enquiry. IT providers used for email delivery and storage are also involved.
The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries with you; otherwise, Article 6(1)(f) GDPR applies with the legitimate interest in handling business communication. Providing information is voluntary; without a reply address or sufficient information, processing may not be possible. The retention criteria described for contact forms apply: completion of the enquiry, any subsequent business relationship, statutory retention duties and necessary legal enforcement.
8. Content, fonts and ROI calculator
The website is built with Astro; editorial content is managed in Storyblok. Content is retrieved when the website is built. A normal visitor’s browser does not connect to the Storyblok content API for this retrieval. The editorial preview for CMS users is separate from the public website.
Fonts used on the website are served through our own website. No Google Fonts request is required. The ROI calculator performs its calculations in the browser; the calculator itself does not transmit or store entered values on a server. The separate optional HubSpot integration follows your privacy choices.
9. Your rights
Subject to the applicable statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future (Article 7(3) GDPR).
Where we process data under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. Where data is processed for direct marketing, you may object at any time without stating such grounds; this also applies to related profiling.
To exercise your rights, write to office@mad-tech.at. To withdraw permission for the HubSpot integration, you can use the privacy settings in the footer directly.
Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, workplace or the alleged infringement. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at, website: dsb.gv.at.