Privacy Policy

Through our multi-step enquiry form, we process the information you enter:

• type of project
• budget range
• timeframe
• project description
• name
• company
• email address

We also process your user agent, the time of your entries and an internal reference number.

Your entries are stored in our website database while you fill in the form. This happens after each step and when you leave the page, even if you do not submit the form. By clicking "Submit", you confirm that your enquiry is complete.

In addition, your progress is stored in your browser's localStorage for up to 30 days so that you can continue the form later.

Purpose: we process your enquiry and contact you about your project.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(f) GDPR. Our legitimate interest is to receive enquiries in full and to be able to process them.

You may object at any time to processing based on legitimate interests (Art. 21 GDPR). To do so, write to datenschutz@marswalk.media.

We store enquiries for as long as their processing and any resulting business relationship require. Thereafter, statutory retention periods apply (up to 7 years under Section 212 of the Austrian Commercial Code (UGB) and Section 132 of the Austrian Federal Fiscal Code (BAO)).

For online appointment booking we use Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. When you book an appointment, Calendly processes the following data:

• name
• email address
• selected appointment
• the information you provide
• technical connection data (IP address, browser data)

The booking widget is only loaded once you actively open the booking, e.g. by clicking "Book a call". Only then does your browser connect to Calendly. Calendly may set technically necessary cookies required for the booking (Section 165(3) TKG 2021).

Purpose: arranging and organising meetings.

Legal basis: Art. 6(1)(b) GDPR.

Role and third country: Calendly is our processor. Transfers to the USA are based on the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses.

Retention: we delete booking data once it is no longer needed for organising the appointment and any resulting business relationship, at the latest when statutory retention periods expire.

Booked appointments are transferred to our Google Calendar and usually held via Google Meet. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you join a Meet call, Google processes the following data:

• name
• email address
• meeting metadata (time, duration, participants)
• technical connection data
• audio, video and chat content, insofar as you share it during the meeting

We only record meetings after prior notice and with the consent of all participants.

Purpose: holding meetings.

Legal basis: Art. 6(1)(b) GDPR; for any recording, Art. 6(1)(a) GDPR.

Role and third country: Google is our processor (Google Workspace). Processing in the USA is possible. The basis is the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Function: Google Tag Manager manages the loading of tags. It does not create usage profiles itself, but transmits connection data to Google. Google Analytics 4 measures the use of our website:

• pages visited
• time spent
• traffic source
• device and browser data
• approximate location derived from the IP address (GA4 does not store the IP address)

We also measure the following events:

• generate_lead – submitting an enquiry
• contact – getting in touch
• schedule – booking an appointment

Cookies: _ga, _ga_* (stored for up to 2 years).

Retention of analytics data: 14 months. Google Signals is disabled. Data is therefore not linked to Google accounts across devices.

Role and third country: Google acts as our processor for analytics. Processing by Google LLC in the USA is possible. The basis is the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Function: Clarity creates heatmaps and session recordings. The following data is collected:

• mouse movements
• clicks
• scrolling behaviour
• pages visited
• device and browser data

Entries in form fields are masked and not recorded.

Purpose: improving usability and analysing errors.

Cookies: _clck (1 year), _clsk (1 day), CLID (1 year).

Retention: recordings up to 30 days, heatmap data up to 13 months.

Third country: processing by Microsoft Corporation in the USA is possible. The basis is the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses.

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Function: the Meta Pixel records page views (PageView) and the following events:

• Lead – submitting an enquiry
• Contact – getting in touch
• Schedule – booking an appointment

The following data is processed:

• IP address
• browser and device data
• URLs visited
• cookie identifiers

If your browser is logged into a Meta account (Facebook, Instagram), Meta may link the data to that account.

Purpose: measuring the performance of our ads, building audiences and serving personalised advertising on Facebook and Instagram.

Cookies: _fbp (90 days), _fbc (90 days).

Meta Conversions API: in addition to the pixel, we transmit the events Lead, Contact and Schedule directly from our server to Meta. This only happens if you have selected "Accept all". We transmit:

• event name and time
• URL visited
• IP address and user agent
• cookie identifiers (_fbp, _fbc)
• from the form: email address, first and last name, each hashed before transmission (SHA-256)

Meta matches the hashed values against Meta accounts to attribute events and deletes unmatched values after matching. The purpose is more reliable measurement of our ad performance, even if the pixel is blocked in the browser. Legal basis, joint controllership and third-country transfers are as described for the Meta Pixel.

Joint controllership: we and Meta are joint controllers for the collection and transmission of data to Meta (Art. 26 GDPR). The basis is Meta's Controller Addendum. Meta is solely responsible for any further processing and is the primary point of contact for data subject rights relating to that processing. Further information: https://www.facebook.com/privacy/policy.

Third country: processing by Meta Platforms Inc. in the USA is possible. The basis is the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses.

Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

Function: the TikTok Pixel records page views and the following events:

• SubmitForm – submitting a form
• Contact – getting in touch
• CompleteRegistration – completing a booking or registration

The following data is processed:

• IP address
• browser and device data
• URLs visited
• cookie identifiers

Purpose: measuring the performance of our ads, building audiences and serving personalised advertising on TikTok.

Cookies: _ttp (up to 13 months).

Joint controllership: we and TikTok are joint controllers for the collection and transmission of data to TikTok (Art. 26 GDPR). Further information: https://www.tiktok.com/legal/privacy-policy-eea.

Third country: TikTok may transfer data to group companies outside the EEA, including in the USA, Singapore and China. The basis is Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

Function: the LinkedIn Insight Tag collects the following data:

• page views
• the "Lead" conversion (submitting an enquiry)
• IP address
• browser and device data
• referrer
• timestamp

If your browser is logged into a LinkedIn account, LinkedIn may link the data to that account. We only receive aggregated, non-personal reports.

Purpose: measuring the performance of our ads, building audiences (Matched Audiences) and serving personalised advertising on LinkedIn.

Cookies: li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory (up to 1 year).

Joint controllership: we and LinkedIn are joint controllers for the collection and transmission of data to LinkedIn (Art. 26 GDPR). Further information: https://www.linkedin.com/legal/privacy-policy.

Third country: processing by LinkedIn Corporation in the USA is possible. The basis is the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses.

We display open positions via JOIN Solutions AG, Sihlbruggstrasse 105, 6340 Baar, Switzerland. When the job list is loaded, connection data (IP address, browser data) is transmitted to JOIN.

• Legal basis for loading the job list: Art. 6(1)(f) GDPR.
• Applications via JOIN: JOIN is an independent controller for the data collected there.
• Third country: an adequacy decision of the European Commission exists for Switzerland (Art. 45 GDPR).

We process unsolicited applications sent by email to hr@marswalk.media in order to decide on employment.

Legal basis: Art. 6(1)(b) GDPR.

Retention: if no employment results, we delete your documents after six months, unless you have consented to longer retention.

You can apply as a Brandface at Become a Brandface. We process the information you enter:

• first and last name
• gender
• date of birth
• email address
• city
• phone number
• optional social links
• a short description
• a photo and a video

Those details leave your device only after you give explicit consent. We store the photo and video in a private Vercel Blob store. They are not served publicly.

Purpose: selecting Brandfaces.

Legal basis: Art. 6(1)(a) GDPR. Without consent we do not store the application.

Retention: typically six months after receipt, or sooner once selection is complete and no retention duty remains. Draft form fields stay in your browser (sessionStorage) only. Files do not leave the device until you submit.