Privacy policy

1. General information

For loomobox FlexCo (“we” or “us”) as the controller for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR), the protection of your personal data has the highest priority. When processing personal data, we therefore comply with all requirements of the EU General Data Protection Regulation (GDPR), the Data Protection Act (DSG) and other national and European legislation and endeavour to ensure the best possible transparency. With regard to data security, we take the appropriate technical and organisational measures to ensure that your personal data is safe with us. We process personal data in accordance with the principles of lawfulness, good faith, transparency, accuracy, purpose limitation, data minimisation, storage duration limitation, integrity and confidentiality. Please read this privacy policy carefully. If you have any questions or require further information, you can contact us at any time. You can find our contact details under point 2. We would also like to draw your attention to the fact that various data transmissions, such as the sending of unencrypted e-mails, do not offer comprehensive protection against access by third parties.

2. Responsible person

loomobox FlexCo Schießstattgasse 33 mail@loomobox.com https://loomobox.com

3. Receiver

Depending on the respective processing, it may be necessary to forward your personal data to standard industry service providers such as postal service providers, lawyers, tax consultants, auditors, payment service providers or other third parties. In view of the fact that some of these industry service providers are commissioned on a project-related basis, it is currently not possible to name the exact service providers. Depending on the purpose of the processing, we pass on your personal data to processors commissioned by us if this is necessary to fulfil the respective task. When selecting our processors, we ensure compliance with data protection regulations. In addition, agreements have been made with the processors to ensure that the personal data is processed confidentially and carefully. We forward your personal data to the following recipients (AV: processor; V: controller; GV: joint controller):

4. Processing of your personal data

Below we describe how we process your personal data.

1. 4.1. Categories of personal data

   Depending on the purpose, the following categories of personal data may be subject to processing:

   1. a) Personal details: name/company/other business name, address, telephone number, e-mail address, date of birth, etc.
   2. b) Log files: IP address, operating system, referrer URL, entry and exit page, browser type, browser version, country, date and time of server request, mail data (IP address of sender/recipient, date and time of mail, mail server, etc.), etc.
   3. c) Payment data: Bank and credit card details, bank transfer information, etc.
   4. d) Appointment data: Date and time of the (desired) appointment, location, title of the appointment, etc.
   5. e) Online identifiers and usage data: cookie identifiers, device and browser information, pages visited, clicks and scrolling behaviour, origin of the visit (e.g. referring website, campaign parameters), etc.
   6. f) Content data: images you upload, text input/prompts, project and configuration data, etc.

2. 4.2. Guests of our website

   When you visit our website, we will process your personal data.

   1. a) Processing of personal data: Log files
   2. b) Purpose of data processing: We process your personal data to ensure stable website use, to identify, analyse and rectify problems and to prevent attacks on our website. This enables us to operate our website properly, stably and securely and to improve and further develop our web presence.
   3. c) Legal basis for data processing: Data processing is based on our legitimate interest. We have a legitimate interest in ensuring that our website can be operated properly and securely. On the one hand, we want to protect our website visitors and, on the other hand, we want to transport our website content to our website visitors accordingly. This data is not merged with other data sources. We use external service providers to realise these goals.
   4. d) Recipient: Your data will be transmitted to recipients No. 1, 2, 3 and 14. Please do not visit our website if you do not want us to process your data.

3. 4.3. Web analytics

   With your consent, we use Google Analytics 4 and Microsoft Clarity to understand how our website is used.

   1. a) Processing of personal data: Online identifiers and usage data (e.g. pages visited, time spent, clicks, mouse and scroll movements), device and browser information and log files. Microsoft Clarity also creates heatmaps and session recordings.
   2. b) Purpose of data processing: We process this data to statistically evaluate visitor numbers and the use of our website, to identify usability problems and to improve our website.
   3. c) Legal basis for data processing: The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR and Section 165 (3) TKG 2021), which you give in the Consent Manager under "Analytics & Performance". You can withdraw your consent at any time with effect for the future in the Consent Manager.
   4. d) Recipient: Your data will be transmitted to recipients No. 6 and 8.

4. 4.4. Website visitor identification

   With your consent, we use Apollo.io to identify the company from whose network you visit our website. Individual persons are not identified.

   1. a) Processing of personal data: IP address, pages visited, date and time of the visit, referrer URL, browser information and cookie identifiers
   2. b) Purpose of data processing: We use this data to recognise which companies are interested in our offer and to prioritise our B2B sales activities accordingly.
   3. c) Legal basis for data processing: The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR and Section 165 (3) TKG 2021), which you give in the Consent Manager under "Marketing". You can withdraw your consent at any time with effect for the future in the Consent Manager.
   4. d) Recipient: Your data will be transmitted to recipient No. 15. Apollo.io is certified under the Data Privacy Framework (see point 7.2.).

5. 4.5. Newsletter

   You have the option of subscribing to our newsletter. We require your consent for this. If you do not give us your consent to send you the newsletter, we will not be able to send you any information as part of the newsletter. We process the personal data of our newsletter subscribers as follows:

   1. a) Processing of personal data: E-mail address, names and log files
   2. b) Purpose of data processing: We process your personal data in order to be able to send you our newsletter and to inform you about news, products or services, events and our company as part of our newsletter. We use external service providers to realise these goals.
   3. c) Legal basis for data processing: Data processing is based on your consent. You can withdraw your consent at any time without giving reasons, for example by clicking on the unsubscribe link in every newsletter or by contacting us using the contact details provided above. The withdrawal of your consent does not affect the lawfulness of data processing based on your consent before its withdrawal.
   4. d) Recipient: Your data will be transmitted to recipient No. 13.

   There is no obligation to give your consent to receive the newsletter. However, if you do not give or withdraw your consent, we will no longer be able to keep you informed about the latest news.

6. 4.6. Making contact, communication

   If you contact or communicate with us by e-mail, contact form, messenger or in any other way, we process your personal data as follows:

   1. a) Processing of personal data: personal details, log files, other personal data provided to us and the origin of your visit (e.g. referring website, campaign parameters)
   2. b) Purpose of data processing: If you contact us or communicate with us, the personal data you provide us with will be processed by us for the purpose of processing your enquiry and in the event of follow-up questions.
   3. c) Legal basis for data processing: The lawfulness of the data processing is based on Art. 6 para. 1 lit. b GDPR; this means that the processing of personal data based on your enquiry is necessary to carry out pre-contractual measures or to fulfil a contract. In other cases, we process your personal data in accordance with Art. 6 para. 1 lit. f GDPR; this means that the processing of personal data is based on our legitimate interest in processing your enquiry. It is important to us to process requests submitted to us and to ensure fast and secure communication. To protect our forms against abuse by automated requests, we use Cloudflare Turnstile; this is also based on our legitimate interest (Art. 6 para. 1 lit. f GDPR).
   4. d) Recipient: Your data will be transmitted to recipients No. 1, 2 and 11. If you do not want us to process your personal data, we will not be able to process your enquiry.

7. 4.7. Business partners and customers

   If you are our (future) business partner or customer, we process your personal data as follows:

   1. a) Processing of personal data: Personal data, log files, payment data or data relating to (i) the delivery of goods, (ii) the provision of services and/or (iii) other contracts.
   2. b) Purpose of data processing: The personal data is processed in order to (i) process or fulfil the respective contract with you, in particular to process the payment or to assert our claims arising from or in connection with the respective contract, (ii) to conclude new contracts and/or (iii) to maintain existing contracts. In addition, we may use your personal data for direct marketing, i.e. to send you information about our products, services, our company and promotions. We also process your personal data as part of the management of the company (e.g. accounting, controlling).
   3. c) Legal basis for data processing: The lawfulness of personal data processing is based on Art. 6 para. 1 lit. b GDPR; this means that the processing of personal data is carried out for the fulfilment of the contract, initiation of the contract and/or maintenance of the contract. Furthermore, we are also legally obliged to process your personal data (e.g. reporting suspected money laundering). In addition, we have a legitimate interest in data processing in order to conduct proper and efficient business management and to carry out various process and business management optimisations as well as to offer you our products and services. We also have a legitimate interest in processing your personal data for direct marketing purposes in order to be able to make you appropriate offers and inform you about new products and services and about our company. In some cases, we will send you direct advertising based on the consent you have given us. As part of our business relationship, you are only obliged to provide personal data that is required for the establishment, execution and termination of a business relationship or that we are legally obliged to collect. Without this personal data, we will generally have to refuse to conclude a contract or will no longer be able to fulfil an existing contract or may have to terminate the contract.

   In support cases, authorised loomobox employees may access job-related records (logs/error messages/metadata) for this specific purpose. Content is processed only to the extent necessary and pseudonymised where possible.

8. 4.8. Customer management

   We process the personal data of our customers and prospects in our CRM software Pipedrive and in the management software monday.com:

   1. a) Processing of personal data: Personal details, log files and payment data
   2. b) Purpose of data processing: The processing takes place in order to manage your user account, to provide you with our service and to analyse your user behaviour. Based on the analysis, we can improve our service and provide you with appropriate offers and information as well as optimisation suggestions.
   3. c) Legal basis for data processing: The lawfulness of the data processing is based on Art. 6 para. 1 lit. b GDPR; this means that the processing of personal data is carried out for the fulfilment of the contract, initiation of the contract and/or maintenance of the contract. Furthermore, we are also legally obliged to process your personal data (e.g. reporting suspected money laundering). Furthermore, we have a legitimate interest in data processing in order to be able to offer you a comprehensive service, to improve our service and to provide you with relevant information on offers (direct advertising), etc.
   4. d) Recipient: Your data will be transmitted to recipients No. 11 and 12. If you do not want us to process your personal data, we will generally no longer be able to fulfil an existing contract.

9. 4.9. Fan page in general

   We operate a so-called “fan page” on various social media platforms. By clicking on the respective link, you will be redirected to our “fan page” on the respective social media site.

   1. a) Processing of personal data: We process all messages, likes, photos, content and other interactions that you submit, share, otherwise add or set on our social media pages as well as your log files.
   2. b) Purpose of data processing: The purpose of this processing is to increase our web presence on various social media channels and to provide you with information about our company and our products and services. Insofar as the processing of personal data takes place in the context of communication between us and you, it serves to process customer feedback on our products and services and to improve our offerings. In addition, we would like to learn more about the opinions of our customers and their interactions with our products and services in order to better respond to customer needs and provide optimal customer care, as well as to offer you the opportunity to exchange information about our company with other people. In this context, we may process your personal data that you have published on social media in connection with us.
   3. c) Legal basis for data processing: The lawfulness of the data processing is based on our legitimate interest in the data processing (Art 6 para 1 lit f GDPR) in order to increase our web presence, to transport information to potential customers and to achieve the above-mentioned purpose as well as to carry out pre-contractual measures (Art 6 para 1 lit b GDPR). In addition, we process your personal data on the basis of your consent.

   1. 4.9.1. Shared responsibility with Facebook and Instagram

      1. a) Name and contact information: Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
      2. b) Privacy policy: https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect
      3. c) Information on joint responsibility: Meta and we are joint controllers with respect to your personal data processed in connection with the Fanpage. You can find the relevant agreement at https://de-de.facebook.com/legal/terms/page_controller_addendum
      4. d) Recipient: Meta is also a recipient of your personal data

   2. 4.9.2. Shared responsibility with LinkedIn

      1. a) Name and contact information: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
      2. b) Privacy policy: https://de.linkedin.com/legal/privacy-policy
      3. c) Information on joint responsibility: LinkedIn and we are joint controllers with regard to your personal data used in connection with the fan page. You can find the relevant agreement at https://legal.linkedin.com/pages-joint-controller-addendum
      4. d) Recipient: LinkedIn is also a recipient of your personal data

   3. 4.9.3. Shared responsibility with Pinterest

      1. a) Name and contact information: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland
      2. b) Privacy policy: https://policy.pinterest.com/en/privacy-policy
      3. c) Information on joint responsibility: Pinterest and we are joint controllers with regard to your personal data processed in connection with our Pinterest profile (e.g. statistics on profile visits).
      4. d) Recipient: Pinterest is also a recipient of your personal data

10. 4.10. Calendar

    Our website embeds the appointment booking service of Google Calendar, which you can use to book an appointment with us. When the page with the booking calendar is opened, data is transmitted to Google.

    1. a) Processing of personal data: Log files, personal details and appointment data
    2. b) Purpose of data processing: The purpose of processing is to enable users to easily manage and book appointments
    3. c) Legal basis for data processing: The data processing is based on Art. 6 para. 1 lit. b GDPR where you book an appointment (pre-contractual measures), and on our legitimate interest in simple appointment scheduling (Art. 6 para. 1 lit. f GDPR).
    4. d) Recipient: Your data will be transmitted to recipient No. 6.

11. 4.11. IT infrastructure

    We do not operate our own data centres, but obtain server, storage, database and authentication services from AWS, netcup, MongoDB and Okta (Auth0).

    1. a) Processing of personal data: Personal details, log files and payment data
    2. b) Purpose of data processing: The purpose of the processing is to host and process your personal data on a ready-made infrastructure.
    3. c) Legal basis for data processing: The lawfulness of data processing is based on Article 6(1)(b) GDPR; this means that the processing of personal data is carried out for the fulfilment of the contract, initiation of the contract and/or maintenance of the contract. Furthermore, we are also obliged to process your personal data on the basis of the applicable laws (Art. 6 para. 1 lit c GDPR) (e.g. suspicion of money laundering). We have a legitimate interest (Art. 6 (1) (f) GDPR) in ensuring that data processing is efficient and economical. By outsourcing IT infrastructure, we can offer you a high-quality service at competitive prices.
    4. d) Recipient: Your data will be transmitted to recipients No. 2, 3, 4 and 5. If you do not want us to process your personal data, we will generally no longer be able to fulfil an existing contract.

12. 4.12. AI features (image editing)

    Images can be edited with AI on our platform. In doing so, we process your personal data as follows:

    1. a) Categories of data processed: Images provided by you or stored in your account, text input/prompts, masks/selection data, scene/configuration data, file metadata (e.g. file name, file size, format), technical usage data/log files (time, error messages, model/version information).
    2. b) Purposes: (i) providing AI-assisted editing/retouching/extension of images, (ii) quality assurance and stability (error/abuse detection, logging), (iii) abuse and security prevention (e.g. detection of prohibited content), (iv) traceability/audit (e.g. in support cases), (v) improving the user experience (e.g. prompt history per account).
    3. c) Legal bases: Art. 6 para. 1 lit. b GDPR (contract/initiation of a contract) for providing the AI feature; Art. 6 para. 1 lit. f GDPR (legitimate interest) for security, abuse/error analysis and operational stability.
    4. d) Recipients / processors: To provide the AI features, we use Google's Gemini API as a processor (No. 7). Processing may take place in third countries, in particular the USA (see point 7.3.).
    5. e) No use for training: Images, prompts and AI results you upload are not used by Google or loomobox to train AI models. Google stores inputs and results for a limited period solely to detect abuse.
    6. f) Automation & human review: AI results are generated automatically and may contain errors. You must review them before use/publication. No solely automated decision within the meaning of Art. 22 GDPR with legal effect takes place.
    7. g) Storage period: Technical logs (e.g. time, error messages, model/version information) are stored for traceability and error analysis for a maximum of 90 days. Prompts and AI results remain stored in your account as part of the version history until you delete them or the contract ends. Temporary server-side caches are deleted regularly and automatically.
    8. h) Prohibited content: You may not provide content that infringes the rights of third parties or violates laws (e.g. special categories of personal data, biometric data, sensitive health data, pornographic/violent content, advertising for prohibited products). We reserve the right to carry out automated/semi-automated checks to detect abuse.
    9. i) Labelling: Where legally required or customary in the industry, you indicate on publication that content was created/edited with AI.

5. Processing of special categories of data

We do not intend to process special categories of personal data (Art. 9 GDPR). Users are obliged not to upload such content or disclose it in prompts. Any accidental transmissions are minimised by technical and organisational measures and, where possible, deleted or pseudonymised without delay.

6. Cookies

1. 6.1. General information

   When using our website loomobox.com, so-called cookies and similar technologies (e.g. pixel tags) are used. A cookie is a small text file that is downloaded and stored on your device's hard drive via your browser. Cookies are used to enable the correct functioning of our website, to expand the functionality of the website, to optimise its functions and to make our website more user-friendly. Cookies can also be used to collect statistical data and for marketing purposes. Cookies, with the exception of essential and certain functional cookies (see also point 6.2.), can be activated and deactivated via the Consent Manager on our website. If cookies are deactivated, the functionality of our website may be restricted. Further information is available in the Consent Manager.

2. 6.2. Types of cookies

   The least privacy-invasive type of cookies are essential cookies (also known as necessary cookies). Essential cookies are technically absolutely necessary for the operation or visit of our website. We use these cookies without the user's consent in accordance with Section 165 (3) TKG 2021. Essential cookies cannot be deactivated. There are also functional cookies (sometimes called convenience cookies). These cookies allow a website to “remember” the choices a user has made (including saved user IDs, consents given or languages selected) and other personalisation options you have selected while browsing. Functional cookies, which are necessary for the services you have requested, are set without your consent in accordance with Section 165 (3) TKG 2021. Necessary functional cookies cannot be deactivated. These are mainly cookies in connection with a digital shopping basket. There are also analytics and performance cookies that are used to monitor and improve the functions and services of a website. These can detect problems with the use of a website, facilitate online surveys, record visitor numbers and provide analysis metrics. Marketing cookies and similar technologies are used, for example, to recognise which company a visit comes from (see point 4.4.). So-called session cookies are only stored for the duration of the respective session. Permanent cookies remain stored permanently or for the respective storage period. First-party cookies are set by us, while third-party cookies are set by third-party providers. Detailed information can be found in the Consent Manager on our website.

3. 6.3. Legal basis

   Cookies, with the exception of essential cookies and necessary functional cookies (see also point 6.2.), are set on the basis of the user's consent. Consent can be withdrawn at any time without giving reasons. The withdrawal of your consent does not affect the lawfulness of data processing based on your consent before its withdrawal. You can revoke your consent to the processing of your personal data in the context of the storage of cookies in particular by deleting the cookies, which can be done in the settings of your browser, or by revoking your consent in our Consent Manager.

7. Data transfer to a third country

1. 7.1. General information

   Data transfers to a third country are permitted under the GDPR if the third country in question has an adequate level of data protection (safe third country). The EU Commission has issued an adequacy decision for some third countries, which certifies an adequate level of data protection. You can find a corresponding overview at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

2. 7.2. Data transfer to the USA

   An agreement (“Data Privacy Framework”) was concluded between the USA and the EU for the transfer of data to the USA. On the basis of this agreement, the Commission issued an adequacy decision (see point 7.1.). However, the transfer of data to the USA on the basis of the aforementioned adequacy decision is only permitted if the recipient has signed up to the Data Privacy Framework. The list of companies that have signed up to the Data Privacy Framework is available at https://www.dataprivacyframework.gov/list. If a recipient is not certified under the Data Privacy Framework, we base the transfer on the European Commission's standard contractual clauses (Art. 46 para. 2 lit. c GDPR).

3. 7.3. AI features

   For the AI features, we use Google's Gemini API. Processing may take place in the USA. Google is certified under the EU-US Data Privacy Framework (see point 7.2.); in addition, we base the transfer on standard contractual clauses (Art. 46 GDPR).

8. Data storage

Unless you are informed of a different storage period, we process, in particular store, your personal data for as long as this is necessary to achieve the respective purpose (e.g. fulfilment of the contract, processing of your enquiry, etc.). However, we will not delete your personal data even if we are legally obliged to retain this data, for example within the framework of company or tax law provisions. In addition, we will continue to store your personal data for as long as you can assert claims against us. In this respect, we will continue to store the personal data that is necessary for the defence against claims. The statutory limitation periods are generally between three and thirty years in accordance with the Austrian Civil Code.

9. Confidentiality

All of our employees are bound to secrecy with regard to the information entrusted or disclosed to them in the course of their work, even after the employment relationship has ended.

10. Data security

Data security is very important to us. We have taken all necessary technical and organisational measures in accordance with Art. 32 GDPR to ensure the security of data processing and to process personal data in such a way that it is protected against loss, destruction, access, modification or dissemination by unauthorised persons. Our IT infrastructure complies with current security requirements and is regularly reviewed. Our website uses the industry standard SSL (Secure Sockets Layer) for encryption. This ensures the confidentiality of your personal data over the Internet. You can recognise whether encrypted transmission is taking place by the closed key/lock symbol in your browser display. Databases or records containing personal data may be breached accidentally or by unlawful intrusion. As soon as we become aware of a data breach, we will notify all affected individuals whose personal data may have been compromised. The notification will be accompanied by a description of the measures taken to remedy any damage resulting from the data breach. The notification will be made as soon as possible after the breach is discovered. For AI processing, we use role-based access, encrypted transmission and storage, logging, data minimisation (only the image/prompt data required) and separation of data between organisations. Technical logs are deleted automatically after 90 days. Processors are selected according to security and compliance criteria.

11. Information for children

Our website and services are not directed at children under the age of 16. If we learn that we have collected personal information from a child under the age of 16, we will take reasonable steps to delete that information from our files as soon as possible, unless we are required by law to retain it. Please contact us if you believe we might have any information from or about a child under the age of 16.

12. Safeguarding the rights of data subjects / contact

You are entitled to the following rights:

• Information in accordance with Art 15 GDPR
• Rectification pursuant to Art 16 GDPR
• Erasure in accordance with Art 17 GDPR
• Restriction pursuant to Art 18 GDPR
• Data portability pursuant to Art 20 GDPR
• Objection pursuant to Art 21 GDPR

If your personal data is processed on the basis of your consent, you have the right to withdraw this consent at any time with immediate effect. The lawfulness of the processing of your personal data until the revocation is not affected by the revocation. For processing in connection with AI features (e.g. prompts, job logs, AI results), you can exercise your rights (access, erasure, restriction, objection) in the same way. Where possible, please state the job time/project so that we can clearly identify the records concerned. You can revoke your consent to the processing of your personal data in the context of the storage of cookies in particular by deleting the cookies, which can be done in the settings of your browser, or by revoking your consent on our website. If you have any questions about the processing of your personal data, wish to object to the processing of your personal data or revoke your consent, feel that your rights under data protection law have been violated or wish to exercise any other right to which you are entitled, please contact us. You also have the right to lodge a complaint with the supervisory authority: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Wien, Mail: dsb@dsb.gv.at. Valid since 03.11.2026