Privacy policy

Version: 26 October 2026

1. Controller and contact details

Med-STA GmbH
Elisabethinergasse 14, 8020 Graz, Austria
Telephone: +43 (0)316 71 89 11
Email: [email protected]
Website: www.med-sta.at

Managing Directors: Dr. Michael Weldi, MSc MBA, and Christian Schroffenegger, MSc.

This notice applies to our corporate website, www.med-sta.at. Separate services, such as our learning platform, are subject to supplementary privacy notices.

2. Purposes and legal bases

We process personal data to provide and secure this website, respond to your enquiries, and arrange and deliver our services. The applicable rules include the General Data Protection Regulation (GDPR), the Austrian Data Protection Act and the relevant provisions of the Austrian Telecommunications Act.

Depending on the processing activity, the legal bases are your consent (Article 6(1)(a) GDPR), steps taken before entering into a contract or performance of a contract with you (point (b)), legal obligations (point (c)), and our legitimate interests in operating a secure website and conducting business communications (point (f)). The respective purposes are explained below.

3. Hosting and technical access data

We operate this website on a virtual server provided by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hostinger provides a data processing agreement for this purpose: Hostinger Data Processing Addendum.

When you visit the website, technical data are processed, including your IP address, the requested address, the time of the request, response status, volume of data transferred, and browser, device and, where applicable, referrer information supplied by your browser. These data are used to deliver the website, analyse errors and prevent attacks. The legal basis is Article 6(1)(f) GDPR.

The web server’s local access and error logs are overwritten according to their size. Their volume is currently limited to approximately two log files of 5 MB each. This rotation does not constitute a fixed deletion period measured in days. Security data relating to a specific incident may need to be retained separately to investigate that incident and defend legal claims.

4. Cloudflare

We use Cloudflare to deliver and secure the website. Your connection is routed through Cloudflare before reaching our hosting server. Cloudflare processes IP addresses, connection and security information, and the content transmitted as part of each request. When a form is submitted, this may also include its content.

Information about processing by Cloudflare, Inc., USA, and the arrangements for data transfers is available in Cloudflare’s Privacy policy and its Data Processing Addendum. We use the service for our legitimate interest in a secure and available website (Article 6(1)(f) GDPR).

5. Contact, quick enquiries and project enquiries

When you contact us by form, email or telephone, we process your contact details and the information you provide so that we can respond. Our forms collect your name, organisation, email address, telephone number where applicable, selected topic or service, and message. Project enquiries may also include information about your facility, participant numbers, the proposed period and files uploaded voluntarily.

Form enquiries are stored in our WordPress administration system and sent by email to the relevant company mailbox. An acknowledgement is sent to the email address you provide. Access is limited to the extent necessary for the people responsible for handling enquiries and technical administration.

The consent obtained through the form is the legal basis for processing the enquiry as described there (Article 6(1)(a) GDPR). Where we prepare or perform a contract with you at your request, we process the necessary information under Article 6(1)(b) GDPR. For business contacts acting on behalf of an organisation, we have a legitimate interest in handling the business enquiry (point (f)). You may withdraw consent at any time with effect for the future by contacting [email protected].

Providing information is voluntary. However, a form cannot be submitted without the information marked as required. You can also contact us by email or telephone. Please do not use the general enquiry forms to send patient data or other sensitive information that is not necessary for your enquiry.

6. Email and delivery logs

We use Microsoft 365, provided by Microsoft Ireland Operations Ltd., Ireland, for email communications and delivery of form messages. The website sends messages through the Microsoft Graph API. In addition to message content, the sender, recipient and connection data required for delivery and communication are processed. Further information is available in the Microsoft Privacy Statement.

The website uses FluentSMTP to log email delivery for traceability and troubleshooting. These logs may contain the recipient address, subject, message content and delivery status. Delivery logs older than 14 days are deleted by a daily cleanup process. This rule applies to the website’s delivery logs; messages in our Microsoft 365 mailbox and stored form enquiries are managed separately.

7. Cookies and consent management

We use Real Cookie Banner to manage and document your privacy preferences. Your selection and a pseudonymous identifier are stored. This documentation provides evidence of your decision. Article 6(1)(c) GDPR is the legal basis for the consent records that must be retained.

Necessary functions may use cookies, in particular for login and to secure administrative access. Optional services are loaded only after you consent. You can change or withdraw your selection using “Cookies” in the website footer. These settings explain the services currently configured and the lifetimes of their cookies. You can also use your browser to delete cookies already stored by a third party.

This website does not integrate dedicated advertising-tracking or audience-measurement services such as Google Analytics. However, the optional Google services described below do process personal data when activated.

8. Google reCAPTCHA and Google Maps

reCAPTCHA: We use Google reCAPTCHA v3 to protect our forms against automated submissions. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service analyses technical connection, device and interaction information to distinguish human from automated use. This may include IP addresses, browser information and interaction characteristics. Google uses the _GRECAPTCHA cookie, among others, for this purpose.

reCAPTCHA is activated only after you consent. Processing is based on Article 6(1)(a) GDPR; storing or accessing optional information on your device is based on your consent under Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). The protected forms cannot be used without activating the spam protection. You can still contact us by email or telephone. Consent to reCAPTCHA is separate from consent to processing your form enquiry.

Maps: The map on the contact page is also provided by Google Ireland Limited. It is loaded only after you give separate consent. Google then receives, in particular, your IP address and technical usage information. Without consent, the map remains blocked; you can still read our address and contact details.

Both services may involve processing in the USA and other countries. Google explains its bases for international transfers, including Google LLC’s certification under the EU-US Data Privacy Framework and, where applicable, standard contractual clauses, in its Frameworks for data transfers. Further details are available in the Google Privacy Policy.

9. Fonts, security and external links

The Inter font used on this website is served locally from our website server. No font files need to be retrieved from Google for this purpose.

We use Wordfence, provided by Defiant Inc., USA, to detect and prevent attacks and to secure logins. In particular, IP addresses and technical security events may be processed and transmitted to Defiant. The legal basis is our legitimate interest in protecting the website and the data processed through it (Article 6(1)(f) GDPR). Defiant explains its processing and contractual safeguards for data transfers in its Wordfence privacy information.

Links to social networks and other websites lead to independent services. When you visit those services, the respective operator’s privacy notice applies.

10. Retention periods and backups

Copies of form enquiries on the website: Stored form enquiries without file attachments are checked daily to determine whether more than six calendar months have passed since receipt. They are deleted automatically once this period has expired. Enquiries with file attachments are held for individual review after the same period. Before deletion, we check which records the files belong to and whether a purpose for retaining them still exists. Files whose association is unclear are not deleted automatically without review.

Email communications and project documents: Deleting a website copy does not delete a message in Microsoft 365 or a project document stored separately. Retention of those data depends on whether an enquiry is still being handled, a subsequent contract exists, a statutory retention obligation applies, or the data are specifically needed to establish, exercise or defend legal claims. Once the relevant purpose has ended and no other legal basis exists, the data must be deleted. The website’s six-month rule is not a blanket deletion period for all business records.

Logs: Local web server logs are subject to the size-based rotation described in Section 3. Website delivery logs are cleaned up daily once they are more than 14 days old, as described in Section 6. Other security events are assessed according to the time required for troubleshooting and investigating attacks.

Backups: We create access-protected backups of the website and its data so that we can restore them after a failure. Routine backups are replaced according to a rotation schedule. Deleted data may remain in a backup until that backup expires. Separately retained migration and rollback backups must be considered individually. Backups are not used for routine enquiry handling. If data are restored, any previous deletions must be taken into account again.

11. Recipients and international processing

To the extent necessary, recipients include our relevant staff and the service providers named in this notice for hosting, website delivery, security, email and voluntarily activated functions. Engaging a service provider does not necessarily mean that it acts solely as a processor. The provider’s own privacy notice also applies to any processing it undertakes for its own purposes.

Services used internationally may involve processing outside the European Economic Area. The respective providers explain the applicable adequacy decisions and contractual safeguards in the linked privacy and contractual documents. You may request information about the safeguards relevant to our processing by contacting [email protected].

12. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future; this does not affect processing carried out before withdrawal.

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation under Article 21 GDPR. To exercise your rights, please contact [email protected].

13. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria; telephone: +43 1 52 152-0; email: [email protected]; dsb.gv.at.