Privacy Policy

This policy explains what happens to personal data when you use openresearch.com. It covers this website only. Data we process inside client projects is governed by the contract and the data processing agreement with the client concerned.

Controller

OpenResearch GmbH
Mariahilfer Straße 121b Top 5, 1060 Vienna, Austria
Commercial register FN440425i, Commercial Court Austria
Phone: +43 1 2535994
Email: office@openresearch.com

Our data protection officer is reachable at office@openresearch.com. Please send data protection questions, including requests to exercise the rights described below, to that address.

Hosting

The website is static and is delivered from Amazon S3 and Amazon CloudFront, operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The storage bucket is located in the EU (Ireland). CloudFront delivers from edge locations in Europe and North America, so a request from outside Europe may be served from a non-EU edge. We have not enabled access logging on the CDN, so no server-side log of your visit is stored by us.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in providing a working, reasonably fast website.

Analytics with Matomo

We use Matomo to understand how this site is used, so we can improve it. Matomo runs on our own instance at openresearch.matomo.cloud, provided by InnoCraft Ltd, 150 Willis Street, Wellington 6011, New Zealand, and hosted in a data centre in Frankfurt, Germany. New Zealand has an adequacy decision from the European Commission. Your data is not sold, shared with advertising networks, or combined with data from other websites.

Matomo runs in two modes, depending on your choice in the cookie banner:

Without your consent (the default), Matomo runs without cookies. Nothing is stored on your device and nothing is read from it, so no consent under section 165(3) of the Austrian Telecommunications Act 2021 is required. We record the page you visited, the referring page, an anonymised IP address (the last two bytes are removed before storage), an approximate location derived from that shortened address (country, region and city, and therefore imprecise), and your browser and device type. Visits cannot be linked reliably across days. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in basic reach measurement. You can object at any time, see below.

With your consent, Matomo additionally sets cookies so that a returning visit can be recognised and a visit can be followed across several pages. Legal basis: Art. 6(1)(a) GDPR together with section 165(3) TKG 2021. You can withdraw consent at any time through “Manage Cookies” in the footer, with effect for the future.

In both modes we also record which links you click on this site (for example “Make an appointment”, an email address, or a job posting) and what you type into the search fields on the FAQ and career pages. This tells us which services people are looking for. We do not record what you type into any other field, and we do not record video or screen recordings of your session.

If your browser sends a “Do Not Track” signal, Matomo does not track you at all.

Matomo raw data is deleted after 12 months. Aggregated statistics that no longer allow any conclusion about an individual are kept for longer.

Object to analytics

You can object to the cookieless measurement described above with immediate effect. The setting is stored in a cookie on your device, so it applies to this browser.

Cookies used on this site

or_consent and mtm_consent_removed are strictly necessary to honour your own choice, so they are set without consent (Art. 6(1)(c) and 6(1)(f) GDPR).

Contacting us

If you contact us by email or telephone, we process the data you give us in order to answer. Legal basis: Art. 6(1)(b) GDPR where the contact concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries. Our mailboxes run on Microsoft 365 (Microsoft Ireland Operations Limited). Enquiries are deleted when they are no longer needed, at the latest after the statutory retention periods expire.

Booking an appointment

The “Make an appointment” buttons take you to Microsoft Bookings, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you book, the name, email address and any message you enter there are processed so we can hold the appointment. Legal basis: Art. 6(1)(b) GDPR. Microsoft’s own privacy statement applies to the booking page itself.

Job applications

Job postings link to Breezy HR (Breezy HR, Inc., United States), where the application itself takes place. Once you follow that link, Breezy’s privacy policy applies to the data you enter. Transfers to the United States are based on the EU Standard Contractual Clauses. You can also apply by email to jobs@openresearch.com. Application data is processed to decide on your application (section 4(1) Austrian Data Protection Act, Art. 6(1)(b) GDPR) and is deleted no later than seven months after the decision, unless you agree to be kept on file.

Embedded videos

One page embeds a video from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The video is not loaded when the page opens. If you have not allowed the “Marketing” category, you first see a notice and the video is only loaded after you click a second time, which is your consent for that playback (Art. 6(1)(a) GDPR). We use the extended data protection mode (youtube-nocookie.com). Once the video loads, Google receives your IP address and may set cookies; Google’s privacy policy then applies.

Recipients and transfers to third countries

Apart from the providers named above, we do not pass your data to third parties. Where a provider is outside the EEA, the transfer is covered by an adequacy decision (New Zealand for InnoCraft) or by the EU Standard Contractual Clauses. We have concluded data processing agreements under Art. 28 GDPR with the processors we use.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future (Art. 7(3)).

To exercise any of these, write to office@openresearch.com.

You also have the right to complain to a supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Vienna
dsb@dsb.gv.at

Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR on this website.

Last update: August 2026