You should know what happens to the information before you send it.

Controller and contact

PREMIUM ORGANIC GmbH, Nußdorfer Straße 68/21, 1090 Vienna, Austria, is responsible for the processing described on this page. Privacy enquiries and rights requests can be sent to datenschutz@premium-organic.com.

Hosting access data

This website is delivered through OpenAI Sites. OpenAI Ireland Ltd. provides services for EEA business customers and may use documented subprocessors, including Cloudflare for content delivery and web hosting. Technical access and security data can include IP address, request time, requested path, referrer, device and browser information, response status and error or security events.

This processing is used to deliver, secure and troubleshoot the website. The legal basis is the legitimate interest in operating a reliable and secure professional website under Article 6(1)(f) GDPR.

OpenAI Data Processing Addendum · OpenAI subprocessor list

Project brief builder

Entries in the contact brief are handled locally in the browser. If present in the current URL, utm_source, utm_medium, utm_campaign, utm_content, utm_term and content_id are read without being written to browser storage and added to the prepared brief as routing context. The website does not submit or store the form entries. Choosing “Prepare email” opens the visitor’s configured email application; no message is sent until the visitor sends it.

Cookies and browser storage

The current public PP+ build does not intentionally set analytics, advertising or preference cookies, does not store campaign parameters in localStorage or sessionStorage and does not embed an external video player or advertising network. Details and the change gate for future optional services are set out in the PP+-specific Cookie Policy.

Direct email and business enquiries

If a visitor sends the prepared email or contacts us directly, PREMIUM ORGANIC GmbH processes the supplied contact, company, role and project information to answer the enquiry, provide requested documents, discuss a sample or take pre-contractual steps. The legal basis is Article 6(1)(b) GDPR where the request concerns a contract or pre-contractual action with the sender, and otherwise Article 6(1)(f) GDPR based on the legitimate interest in relevant B2B communication. Statutory record keeping is based on Article 6(1)(c) GDPR where applicable.

Recipients and international transfers

Access is limited to authorised PREMIUM ORGANIC staff and, where necessary, hosting, email, IT, professional-advisory or other service providers. Data is not sold. If a provider processes data outside the European Economic Area, an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses are used where required. The OpenAI documents linked above describe its current provider and transfer framework.

Retention

Hosting and security records are retained according to the relevant provider configuration, security needs and legal obligations. Enquiry data is kept only as long as needed to handle the request and any resulting business relationship, and thereafter only for applicable statutory retention periods or the establishment, exercise or defence of legal claims. A fixed period cannot be stated independently of the enquiry and resulting transaction.

Rights and complaints

Subject to applicable law, data subjects may request access, rectification, erasure, restriction or portability and may object to processing based on legitimate interests. Consent, if requested for a future optional service, may be withdrawn for the future. Complaints may be lodged with the Austrian Datenschutzbehörde or another competent supervisory authority.

No automated decision

The current PP+ website does not use the project brief for automated decision-making or profiling. Required fields in a visitor-prepared brief are used only to make the intended B2B request understandable before the visitor chooses whether to send it.