01Who we are and what this policy covers
This Privacy Policy explains how CSM - Center for Sustainable Media GmbH ("CSM", "we", "us" or "our") collects and uses personal data in connection with the company’s activities. It applies when you visit or use a website we operate, subscribe to or read one of our newsletters, create an account, buy a subscription or other service, make a payment, register for or attend an event, contact us, work with us as a client, supplier or partner, or otherwise communicate with CSM.
CSM is the controller for the processing described here where it decides why and how personal data is used. CSM is an Austrian company. You can contact us about privacy at hello@sustainablemedia.eu. If a particular service or interaction has its own privacy notice, that notice supplements this one.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (Datenschutzgesetz, or DSG), and other applicable Austrian and EU data-protection and communications laws. This policy concerns people who interact with CSM. Where required, staff and job applicants receive separate information about processing in an employment or recruitment context.
02Personal data we may collect
Depending on how you interact with us, we may process:
- Contact and identity details: name, email address, telephone number, organisation, job title, postal or billing address, and information you include in a message or form.
- Newsletter and account details: email address, subscription preferences, account or membership identifiers, sign-up and confirmation records, subscription status, and preferences such as language.
- Subscription and transaction information: products or plans purchased, price, currency, billing and renewal dates, invoices, tax details where needed, payment status, refunds, and limited payment-card details such as the card brand and last four digits. Full card details are generally collected directly by our payment provider, not stored by CSM.
- Website and device information: IP address, browser and device details, approximate location derived from an IP address, pages or content viewed, referring pages, timestamps, cookie or similar identifiers, and interactions with website features. This may be personal data even when it does not directly identify you.
- Analytics and advertising events: information about visits, page views, link clicks, sign-ups, purchases or other events on our websites, and identifiers supplied by cookies, pixels or similar technologies, where these tools are enabled.
- Event and business relationship information: registration, attendance, accessibility or dietary requests you choose to provide, correspondence, meeting notes, service requests, feedback, and records needed to manage a client, supplier, partner or other professional relationship.
- Publicly available professional information: information we use to contact people in a professional capacity, such as business contact details and role information published by their organisation.
We do not ask you to provide special-category personal data. Please avoid including sensitive information in forms or messages unless it is necessary for your request.
03Why we use personal data and our legal bases
We use personal data for the following purposes. The applicable legal basis depends on the context and the particular processing:
| Purpose | Typical data | Legal basis |
|---|---|---|
| Operate and secure our websites, newsletters and user accounts; respond to enquiries | Contact, account, technical and communication data | Taking steps at your request or performing a contract (GDPR Article 6(1)(b)); our legitimate interests in operating secure services and responding to business enquiries (Article 6(1)(f)); and, where required, consent (Article 6(1)(a)) for non-essential storage or access technologies |
| Send newsletters and manage subscriptions | Email address, preferences, sign-up and delivery records | Your consent (Article 6(1)(a)) where required by applicable law. You can unsubscribe at any time. For limited service or account messages, processing may instead be necessary to perform a contract (Article 6(1)(b)) |
| Provide paid subscriptions, products or services and administer billing | Identity, contact, subscription and transaction data | Performance of a contract or pre-contractual steps (Article 6(1)(b)); legal obligations, including accounting and tax duties (Article 6(1)(c)) |
| Process payments, refunds and payment-related support | Transaction, billing and limited payment data | Performance of a contract (Article 6(1)(b)); legal obligations (Article 6(1)(c)); and, where appropriate, our legitimate interests in preventing fraud and resolving payment disputes (Article 6(1)(f)) |
| Measure website and newsletter performance and improve our content and services | Usage, device, analytics and newsletter engagement data | Consent (Article 6(1)(a)) where required for analytics technologies or tracking; otherwise, a documented legitimate interest may apply to limited measurement that does not require consent under applicable law |
| Promote our publications, services and events, and measure advertising | Contact or subscription data and website or advertising events | Consent (Article 6(1)(a)) for non-essential cookies, pixels and similar tracking where required; legitimate interests (Article 6(1)(f)) for appropriate business-to-business outreach, subject to your right to object and any applicable e-marketing rules |
| Organise events and manage attendance | Contact, registration, attendance and requests you choose to provide | Performance of a contract or steps requested before registration (Article 6(1)(b)); legitimate interests in running the event (Article 6(1)(f)); consent where applicable, including for optional publicity or dietary details that reveal sensitive information |
| Manage client, supplier, partner and professional relationships | Contact, correspondence, service and transaction records | Performance of a contract (Article 6(1)(b)); legal obligations (Article 6(1)(c)); and legitimate interests in managing and developing our business relationships (Article 6(1)(f)) |
| Protect our rights, prevent misuse and meet legal obligations | Relevant account, transaction, technical and communication records | Legal obligations (Article 6(1)(c)) and legitimate interests in security, fraud prevention and establishing or defending legal claims (Article 6(1)(f)) |
Where we rely on legitimate interests, we consider the impact on your rights and use the data only where our interests are not overridden by your rights and freedoms. You can ask us for more information about the legitimate interest relevant to your situation.
04Newsletters and communications
If you subscribe to a newsletter, we use your email address and subscription preferences to deliver it and maintain the subscription. We may use a newsletter delivery or publishing platform to manage sign-ups, delivery, unsubscribes and, depending on the publication and your settings, delivery or engagement metrics such as opens and link clicks. Email tracking may rely on pixels or similar technology; where required, we will seek consent or provide controls to disable it.
You can unsubscribe using the link in a newsletter or contact us at hello@sustainablemedia.eu. We may retain a minimal suppression record so that we can respect your unsubscribe request. Unsubscribing from a newsletter does not necessarily cancel a separate paid subscription or service; use the account or billing controls for that service, or contact us for help.
We may also send operational messages, such as subscription confirmations, receipts, security notices or changes to a service. These are not promotional newsletters.
05Payments and subscriptions
We use Stripe to process payments and, where enabled, recurring subscription payments. When you pay, Stripe may receive information such as your name, email address, billing address, payment-card or bank details, transaction amount, currency, IP address and device information. Stripe processes payment details under its own privacy terms and may act as an independent controller for some processing and as a processor for other processing. CSM receives information needed to administer the purchase, such as payment status, transaction identifiers, subscription details, limited card details, and refund or dispute information. CSM does not receive or store your full card number or security code through the standard Stripe checkout flow.
For details about Stripe’s processing, see Stripe’s Privacy Policy. Payment processing may involve transfers outside the EEA; see section 9.
06Cookies, Google Analytics and Meta Pixel
Our websites may use cookies, pixels, local storage and similar technologies. Some are necessary to provide requested features, keep a service secure or remember your privacy choices. Other technologies help us understand how people use our websites or measure advertising. We use these technologies in accordance with applicable Austrian rules, including section 165(3) of the Telecommunications Act 2021 (TKG 2021), and EU data-protection law.
Google Analytics
Where enabled, Google Analytics helps us understand website use and performance. It may collect or generate information such as pages viewed, interactions, approximate location, device and browser details, referral information, online identifiers and IP-related data. Google processes this information on our behalf or in another role described in Google’s terms, depending on the configuration. We use analytics only in accordance with our consent settings and applicable law. See Google’s Privacy Policy and Google Analytics information.
Meta Pixel
Where enabled, the Meta Pixel helps us measure the effectiveness of advertising on Meta services and may support audience measurement or advertising. It can send Meta information about website events, such as a page view, registration or purchase, together with online identifiers, cookie or device information and other technical data. Meta may use the information under its own terms and may combine it with information from other sources. The parties’ roles can depend on the processing; Meta may act as an independent controller for certain uses and the parties may have joint-controller responsibilities for collection and transmission in some contexts. See Meta’s Privacy Policy and its information about Business Tools.
We will not activate non-essential analytics or advertising cookies, pixels or similar technologies before obtaining consent where consent is required. You can change or withdraw your choices at any time through the cookie settings on the relevant website. Blocking these technologies may affect some website features. Your browser may also offer cookie controls, but browser settings do not always communicate a choice to every provider.
The tools and cookies used can differ between CSM websites and may change. The cookie banner or settings panel on each website should provide the current categories and choices for that site.
07How long we keep personal data
We keep personal data only for as long as needed for the purposes described in this policy, including providing a service, maintaining a subscription, handling a request, meeting legal and accounting requirements, resolving disputes and protecting our rights. Retention periods vary by data type and context. For example:
- newsletter records are kept while you remain subscribed; after you unsubscribe, we may keep a limited suppression record and evidence of consent or withdrawal;
- account, subscription, invoice and payment records are retained for the relevant contract and the period required by applicable accounting, tax and limitation rules;
- enquiry, event and professional correspondence is retained for as long as needed to respond, administer the relationship and document relevant decisions;
- website and analytics data is retained according to the settings and retention periods configured for the relevant website and service; and
- cookie and advertising identifiers are retained according to the settings of the relevant technology and your consent choices.
When data is no longer needed, we delete it or irreversibly anonymise it, unless the law requires or permits further retention.
08Your data protection rights
Subject to the conditions and exceptions in applicable law, you may have the right to:
- request access to your personal data and information about how it is used;
- request correction of inaccurate or incomplete data;
- request deletion of your data;
- request restriction of processing;
- receive certain data in a portable format or ask us to transmit it to another controller;
- object to processing based on legitimate interests, including direct marketing; and
- withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out before withdrawal.
To exercise a right, contact hello@sustainablemedia.eu. We may need to verify your identity and will respond within the period required by law. You have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde) (dsb.gv.at). You may also be able to complain to the supervisory authority in your place of residence or work, or where an alleged infringement occurred.
09International data transfers
Some of our service providers may process personal data outside the European Economic Area (EEA), including in countries that may not provide the same level of data protection as the EEA. Where required, we use a lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another safeguard permitted under applicable data protection law. You can contact us for information about the safeguards relevant to a particular transfer.
10Security
We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. Measures are selected according to the nature of the data and the risks of processing. No online service or method of transmission can be guaranteed to be completely secure.
11Children
Our websites, newsletters and services are intended for a general audience and are not directed to children. We do not knowingly collect children’s personal data for marketing. If you believe a child has provided us with personal data, contact us so we can review and, where appropriate, delete it.
12Changes to this policy
We may update this Privacy Policy to reflect changes in our activities, services, providers or legal requirements. We will publish the current version on the relevant website. If a change materially affects how we use personal data, we will provide additional notice where required by law.
13Contact
For questions or requests relating to this Privacy Policy or your personal data, contact:
CSM - Center for Sustainable Media GmbH
Email: hello@sustainablemedia.eu