Privacy policy

SalesAtelier GmbH (Nativecoach)
Erdbergstraße 216a/2/1, 1030 Vienna, Austria
Email: office@nativecoach.at
Phone: +43 660 920 6000

Further details can be found in our legal notice. For any questions about data protection, please contact us at the email address above.

When you open our website, your browser technically transmits data to the server: IP address, date and time of access, page requested, referrer URL, browser type and operating system. This data is needed to deliver the website, keep it secure and fix errors.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log data is not combined with other data and is deleted automatically after a short time unless it is needed to investigate a security incident.

The website is operated and delivered via the Lovable platform. Lovable processes the data as our processor (Art. 28 GDPR).

When you write to us via the contact form, we process your name, email address, optionally your company and the content of your message. The enquiry is stored in our database and we receive a notification by email; we use Lovable's email service as a processor to send it. To protect against spam, the form contains a field that is invisible to humans and the number of enquiries per period is limited. For this limit we store with each enquiry a check value calculated from your IP address and the current date (hash); the IP address itself is not stored and the check value cannot be linked across several days. No external services are used for this.

We likewise process your details when you contact us by email or phone (e.g. name, company, contact details, content of your enquiry).

We use this data to answer your enquiry and, where applicable, to prepare an offer. The legal basis is taking steps prior to entering into a contract or performing a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete your enquiry once it has been dealt with and no further cooperation follows, at the latest automatically after 12 months; if a contract is concluded, the statutory retention periods apply (see section 6).

For our free English level check we process your name (optional, required if you enter a project number), your email address, your answers, the level determined from them and the written assessment, which our team reviews before it is sent. We also store the time and version of your consent, the language you took the test in and – to protect against abusively many sign-ups – a check value calculated from your IP address and the date (hash); the IP address itself is not stored.

The purpose is to evaluate your test and send you your result by email. If you voluntarily enter the project number of a training project of your company, we assign your result to that project, add your name, email address and level to that client's participant list (see section 5) and use them to plan the training. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by emailing office@nativecoach.at. We use Lovable's email service as a processor to send the emails.

Unfinished tests are deleted automatically after 7 days, completed ones after 12 months at the latest, or earlier if you withdraw your consent. If you withdraw it, we also remove your result from the client's participant list.

Freelance trainers can register in the trainer portal. During registration and use we process:

• Login data: email address and password (stored only in encrypted form)
• Profile data: name, phone number, languages, availability, details of experience and certificates
• Assignment data: assigned trainings with client, date, location, notes and hourly rate
• Time records: date, hours, client and description of the work performed
• Documents you upload yourself (e.g. contracts, certificates, invoices)

The purpose is to initiate and carry out our cooperation: scheduling, settling your services and invoicing our clients. The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures) and, for accounting records, Art. 6(1)(c) GDPR (statutory retention obligations).

New registrations are reviewed and approved by us. Only you and Nativecoach's administrators have access to your data; your uploaded documents are visible only to you.

The portal's database, login and file storage are provided by Supabase, which we use via Lovable Cloud. Supabase processes the data as a processor on our behalf.

We invite contact persons of our business clients to the customer area. For this we process their name and email address and their assignment to the company. In the customer area they see their company's training projects with status, period, dates and the names of the assigned trainers – no hourly rates, internal notes or other profile data. The legal basis is the performance of the contract with the client (Art. 6(1)(b) or (f) GDPR). Trainers assigned to a project see that project and the client's name.

For each business client we also keep a list of the employees taking part in trainings: name, email address, job title and, where applicable, the level-check result. We receive this information from the client or from the level check (see section 4). Only our administrators can see the list; it is used to plan and run the trainings. The legal basis is our and the client's legitimate interest in performing the training contract (Art. 6(1)(f) GDPR) and, for level-check results, your consent. We delete the entries when the cooperation with the client ends, or earlier at your request.

We store personal data only as long as necessary for the respective purpose. We delete the data of your portal account when the cooperation ends or when you request deletion. Exceptions are records we are legally required to keep, in particular accounting and billing records for seven years (§ 132 BAO, § 212 UGB).

In the trainer portal you can optionally sign in with your Google account. If you choose this option, you are redirected to Google; sign-in runs via Lovable's authentication service. We receive your name and email address from Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis is Art. 6(1)(b) GDPR; use is voluntary – you can also register with email and password. Information on data processing by Google can be found at policies.google.com/privacy.

We do not use tracking, analytics or advertising cookies and do not use Google Analytics. For anonymous visitor statistics and load-time measurement we use Matomo. The Matomo instance (matomo.cyberatelier.io) is operated by us or on our behalf; it works without cookies and stores IP addresses only in shortened form. It records, among other things, pages visited, referrer, device type, country and load times; visitors are not recognised across several days. The legal basis is our legitimate interest in a functioning, fast website (Art. 6(1)(f) GDPR). Only what is technically necessary for operation is stored in your browser's local storage and as cookies. Two of the cookies are set not by our website itself but by our hosting (Lovable, with Cloudflare as network service):

This storage is strictly necessary to provide the service you requested and therefore requires no consent (§ 165(3) TKG 2021). You can delete cookies and local storage at any time in your browser settings; you will then have to sign in to the portal again.

The fonts used on this website are hosted locally. No connection to servers of Google or other font providers is established when you open the pages.

Our blog articles contain links to external websites. Data is only transmitted to the respective provider when you click such a link. The respective provider is responsible for the content of the linked websites and for its data processing.

Our service providers may also process data outside the EU/EEA, in particular in the USA. In that case data is transferred only on the basis of an adequacy decision of the European Commission (e.g. the EU-US Data Privacy Framework for certified companies) or the EU standard contractual clauses (Art. 46 GDPR).

You have the right at any time to

• access the data stored about you (Art. 15 GDPR),
• have inaccurate data rectified (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR).

Simply write to us at office@nativecoach.at.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Transmission between your browser and our website is encrypted with TLS. Passwords are stored only in encrypted (hashed) form, and access rules in the database ensure that each trainer can only access their own data.