Privacy Policy | Hormonal Intelligence Initiative

Hormonal Intelligence Initiative
Privacy Policy

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Hormonal Intelligence Initiative FlexCo
Hammerauerstr. 98
5020 Salzburg
Austria
datenschutz@hormonal-intelligence.org

If you have any questions regarding data protection, you may contact us at any time using the contact details provided above.

2. General Information on Data Processing

The protection of your personal data is very important to us. We process personal data exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and other applicable legal requirements.

We process personal data only for specified purposes and only to the extent necessary for the operation and security of our website, the handling of inquiries, the processing and administration of donations, the fulfilment of legal obligations, and the pursuit of our non-profit research purposes.

We do not use personal data collected in connection with an inquiry or donation for unrelated advertising or marketing purposes unless a separate legal basis, such as valid consent, applies.

3. Visiting Our Website

Our website is hosted by:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

When you access our website, your browser automatically transmits information to the servers used to provide the website. This information may be temporarily stored in server log files and may include, in particular:

IP address of the requesting device
Date and time of access
Name and URL of the accessed file or page
Browser type and browser version
Operating system used
Referrer URL, where transmitted by the browser
HTTP status code and amount of data transferred

This processing is necessary to deliver the website, ensure its secure and stable operation, identify technical errors, and prevent misuse or attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interests lie in the secure, reliable, and technically functional operation of our website.

Where IONOS processes personal data on our behalf, the processing is governed by a data processing agreement pursuant to Art. 28 GDPR.

4. Contacting Us

If you contact us by email, we process the personal data you provide in order to respond to your inquiry and, where necessary, communicate further with you regarding that inquiry.

This may include, in particular:

Name, if provided
Email address
Content of your message
Date and time of the communication
Any additional information voluntarily provided

The processing is carried out for the purpose of handling your inquiry and communicating with you.

Legal bases: Art. 6(1)(b) GDPR where the communication concerns the initiation or performance of a contractual or comparable relationship, or Art. 6(1)(f) GDPR based on our legitimate interest in responding to inquiries and communicating with interested persons.

Your data will be stored only for as long as necessary to process your inquiry and any related communication, unless statutory retention obligations or another legal basis require longer storage.

5. Donations

If you financially support our organisation, we process the personal data necessary to initiate, process, document, administer, and account for your donation.

Depending on the donation method and the information you provide, this may include:

Name
Contact details
Address information, where required
Donation amount
Date and purpose of the donation
Selected payment method
Payment and transaction information, insofar as it is made available to us
Information required for donation confirmations
Where applicable, information required for tax deductibility or reporting

We process this data for the following purposes:

Initiating and completing the donation
Allocating the donation to the selected project or funding purpose
Documenting and administering donations
Accounting and financial management
Issuing donation confirmations, where applicable
Fulfilling statutory accounting, tax, and reporting obligations
Responding to administrative questions concerning the donation
Preventing misuse and fraudulent transactions

Legal bases:

Art. 6(1)(b) GDPR, where processing is necessary to initiate and carry out the donation transaction
Art. 6(1)(c) GDPR, where processing is necessary to fulfil legal obligations
Art. 6(1)(f) GDPR, based on our legitimate interests in the secure, efficient, and transparent administration of donations and the prevention of misuse

Communication based on these legal grounds is limited to matters connected with the donation, such as confirmations, administrative questions, payment issues, and legally required information. Promotional emails or newsletters will be sent only where a separate legal basis applies.

6. Online Donations via RaiseNow

For online donations, we use the Tamaro donation form provided by:

RaiseNow AG
Hardturmstrasse 101
8005 Zürich
Switzerland

The RaiseNow donation form is embedded into our website as an optional external service. It is not loaded automatically when you visit the website.

The external RaiseNow script and donation form are loaded only after you have actively enabled the RaiseNow donation service through our privacy settings and access the online-donation option. Until consent has been granted, the embedded donation form remains unavailable and our website does not initiate a connection to RaiseNow through that form.

Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).

You may change or withdraw your consent at any time through the “Privacy settings” link in the website footer.

When the RaiseNow donation form is enabled, your browser establishes a direct connection to RaiseNow so that the form can be displayed and operated. In this context, RaiseNow may process technical information and may use cookies, local storage, session storage, or comparable browser-storage technologies.

Such technologies may be used for purposes including:

Maintaining the donation session
Providing and securing the donation form
Saving form and interface preferences
Analysing the technical use and performance of the form
Restoring form information following a payment redirect
Preventing misuse and fraudulent transactions

Information that you enter into the donation form is transmitted to and processed through RaiseNow. Depending on the donation method and the information you provide, this may include:

Name and contact details
Address or billing information, where required
Donation amount and selected donation purpose
Selected payment method
Transaction and payment-status information
Information required for donation confirmations or tax reporting
Technical information required for security, fraud prevention, and operation of the donation platform
Any communication preferences voluntarily selected in the donation form

Depending on the selected payment method, additional payment service providers, banks, credit-card companies, or other financial service providers may process the information required to complete the transaction.

We do not receive complete credit-card details, online-banking credentials, or comparable payment-authentication information where these are processed directly by RaiseNow or the relevant payment provider.

For the purpose of displaying aggregated funding progress on our website, RaiseNow transmits limited donation information to us through a technical webhook.

The webhook data may include:

Project or funding-purpose reference
Donation amount
Currency
Date and time of the transaction

We use this information to allocate donations to the relevant funding project and calculate aggregated donation totals.

The webhook used for this purpose is configured so that we do not receive or store donor names, postal addresses, email addresses, payment credentials, or complete payment information through it.

Information required for the administration, accounting, confirmation, or statutory reporting of donations may nevertheless be made available to us separately through RaiseNow or another participating service provider where this is necessary for those purposes.

Where RaiseNow or another service provider processes personal data on our behalf and in accordance with our instructions, the processing is governed by the applicable contractual and data-protection arrangements, including a data processing agreement pursuant to Art. 28 GDPR where required.

RaiseNow and participating payment service providers may also process certain information under their own responsibility where they independently determine the purposes and means of processing, for example in order to comply with statutory obligations, ensure payment security, prevent fraud, or operate their services.

RaiseNow is established in Switzerland. Switzerland is recognised by the European Commission as providing an adequate level of protection for personal data. Where recipients in other countries outside the European Economic Area are involved, the requirements described in Section 10 apply.

Withdrawing consent to the embedded donation form prevents the form from being loaded during future use and removes locally accessible RaiseNow or Tamaro browser-storage entries where technically possible.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. It also does not affect processing that remains necessary to complete, document, administer, or comply with legal obligations relating to a donation that has already been submitted.

As an alternative to the embedded RaiseNow donation form, you may access our bank-transfer information without enabling or loading RaiseNow.

Further information about RaiseNow’s processing of personal data and use of cookies or similar technologies is available in:

7. Privacy Preferences and Google Analytics

We use a privacy-settings interface through which you can decide independently whether the optional services Google Analytics and the RaiseNow donation form may be enabled.

Necessary technologies remain active because they are required to operate the website securely, provide essential website functions, and store your privacy preferences.

7.1 Storage of Privacy Preferences

Your privacy selection is stored locally in your browser so that the website can remember your decision.

The stored consent record contains:

Whether Google Analytics has been enabled or rejected
Whether the RaiseNow donation form has been enabled or rejected
The version of the consent information
The date and time of your decision

The privacy preference is stored in your browser for up to 183 days. After that period, or if the version of the consent information changes, you may be asked to make a new selection.

This local storage is necessary to remember and apply the privacy choice you have requested. The legal basis for the associated processing is Art. 6(1)(f) GDPR, based on our legitimate interest in respecting, applying, and documenting your privacy preferences. Where information is stored on or accessed from your device, Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) applies.

You can change or withdraw your selection at any time through the “Privacy settings” link in the website footer.

7.2 Google Analytics

Subject to your prior consent, we use Google Analytics 4, a website-analysis service provided by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics helps us understand how visitors use our website. We use this information to assess the reach and technical use of the website and to improve its content, structure, and functionality.

Google Analytics may provide us with information concerning:

The number of visits and sessions
Pages and website functions accessed
Interactions and events generated on the website
Referring websites and traffic sources
Date, time, and approximate duration of visits
Approximate country-level location
Device category, such as desktop, mobile device, or tablet
Browser and operating-system category

We integrate Google Analytics directly through Google’s gtag.js library. We do not use a Google Tag Manager container.

Google Analytics is not loaded automatically when you visit our website. Before consent is granted, our website only prepares a local command queue in your browser. This local preparation does not itself establish a connection to Google or transmit Analytics data.

The external Google Analytics script is requested and Analytics measurement begins only after you have explicitly enabled Google Analytics through our privacy settings.

If you reject Google Analytics or have not yet made a selection, the external Analytics script remains unloaded and our implementation does not send Analytics measurement signals or cookieless Analytics pings to Google.

Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and, where Analytics identifiers or comparable information are stored on or accessed from your device, Section 165(3) TKG 2021.

When Google Analytics is enabled, Google may process technical and usage information, including:

Pages and functions accessed
Events and interactions generated on the website
Date and time of access
Referrer and campaign information, where available
Browser and operating-system information
Device category and technical device information
Approximate geographic information
Analytics identifiers stored in or read from your browser
The IP address used for the technical transmission of the request

Google states that Google Analytics does not log or store individual IP addresses from users in the European Union, Switzerland, or the United Kingdom. According to Google, such IP addresses are discarded before Analytics data is logged after they have been used to derive approximate geographic information.

Google Analytics may store or access identifiers through cookies or similar browser technologies after consent has been granted. Cookies used by Google Analytics may include cookies whose names begin with _ga.

We have configured Google Analytics in a privacy-conscious manner. In particular:

Google Signals is disabled
Google advertising personalisation signals are disabled
Advertising storage is denied
Advertising user data is denied
Advertising personalisation is denied
Collection of user-provided data is disabled
Granular location and device-data collection is disabled
We do not provide a User-ID to Google Analytics
We do not use Google Ads, remarketing, personalised advertising, or advertising audiences
Google Analytics is not linked to Google Ads, AdSense, BigQuery, Search Console, Display & Video 360, Campaign Manager 360, Search Ads 360, Merchant Center, or other Google products

Google Analytics does not provide us with visitors’ names, email addresses, or other information that directly identifies them by name. However, Analytics identifiers, technical information, usage information, and combinations of such data may constitute personal data within the meaning of the GDPR.

7.3 Retention of Google Analytics Data

We have configured the following Google Analytics retention periods:

Event data: 2 months
User-related data: 14 months

The setting that would restart the user-data retention period whenever new activity occurs is disabled.

These retention settings apply to user-level and event-level information governed by the corresponding Google Analytics retention controls. They do not necessarily determine how long aggregated information remains available in standard Analytics reports.

7.4 Withdrawal of Analytics Consent

You may withdraw your consent to Google Analytics at any time through the “Privacy settings” link in the website footer.

When Analytics consent is withdrawn:

The Google Analytics consent state for analytics_storage is changed to denied
The Google Analytics global opt-out flag for our measurement ID is set to true
Further Google Analytics measurement and transmission of Analytics data through our implementation are disabled
Known Google Analytics cookies accessible from our website, including cookies whose names begin with _ga, are deleted where technically possible

The global opt-out flag is implemented through the Google Analytics property window['ga-disable-MEASUREMENT_ID']. When this property is set to true, the Google tag is prevented from setting Analytics cookies or sending Analytics data through our implementation.

An external Analytics script that has already been downloaded cannot reliably be removed from the browser during the same page session. However, setting the Analytics storage state to denied together with activating the global opt-out flag prevents further Analytics measurement through our implementation.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

You can also delete existing cookies and local website data through your browser settings. Deleting browser data may cause the website to request a new privacy selection the next time you visit.

7.5 Recipients and International Data Transfers

Where Google Analytics is enabled, recipients of the data may include Google Ireland Limited, other companies within the Google group, and service providers engaged by Google to provide and secure the Analytics service.

Google may process information using systems or service providers located outside the European Economic Area, including in the United States. Where personal data is transferred to a third country, the requirements and safeguards described in Section 10 apply.

Further information about Google’s processing of personal data and the privacy controls available for Google Analytics can be found in:

8. Retention Periods

We store personal data only for as long as necessary for the purposes for which it was collected or for as long as applicable statutory retention and documentation obligations require.

Data relating to inquiries is generally retained until the inquiry and any related communication have been completed, unless longer retention is necessary to establish, exercise, or defend legal claims or to comply with statutory obligations.

Donation-related records and accounting or tax-relevant information are retained in accordance with the applicable statutory retention periods.

The retention periods configured for Google Analytics are described in Section 7.3.

The privacy-preference record stored locally in your browser is retained for up to 183 days. It may cease to apply earlier if you delete your browser data or if a change to the consent-information version requires us to request a new selection.

After the relevant purpose no longer applies and all applicable retention periods have expired, personal data will be deleted or anonymised unless another legal basis permits or requires further storage.

9. Recipients of Personal Data

Personal data is disclosed to third parties only where this is necessary for the relevant processing purpose, required by law, or justified by another legal basis.

Depending on the relevant processing activity and the privacy choices you make, recipients may include:

Hosting and technical service providers
Google Ireland Limited, other Google group companies, and service providers involved in providing Google Analytics, where you have consented to Analytics
RaiseNow AG and service providers involved in providing the online donation form, where you have enabled RaiseNow or submitted an online donation
Payment service providers, banks, credit-card companies, and other financial institutions involved in processing a donation
Tax advisors, auditors, accountants, and other professional advisors subject to confidentiality obligations
IT security, support, and maintenance providers
Authorities and public bodies where disclosure is legally required

Where an external service provider processes personal data exclusively on our behalf and in accordance with our instructions, it is engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR where required.

Some recipients, including payment service providers or technology providers, may process certain personal data under their own responsibility where they independently determine the purposes and means of processing, for example to comply with statutory obligations, ensure security, prevent fraud, or operate their services.

10. Transfers to Third Countries

Some service providers or recipients may be established outside the European Economic Area or may process personal data in countries outside the European Economic Area.

Personal data is transferred to such countries only where the requirements of Art. 44 et seq. GDPR are met. Depending on the recipient and destination country, the transfer may be based in particular on:

An adequacy decision adopted by the European Commission
Standard contractual clauses approved by the European Commission
Binding corporate rules
Participation in a recognised data-protection framework, where applicable
Another legally recognised safeguard or derogation

RaiseNow is established in Switzerland. Switzerland is currently recognised by the European Commission as providing an adequate level of data protection.

In connection with Google Analytics, personal data may be processed by Google companies or service providers located outside the European Economic Area, including in the United States.

Depending on the relevant recipient and processing circumstances, transfers involving Google may be based on an applicable adequacy decision, including the EU–US Data Privacy Framework where its requirements are met, or on Standard Contractual Clauses and any supplementary safeguards required under applicable data-protection law.

Where appropriate, additional technical and organisational measures are implemented to protect personal data transferred internationally.

Further information about Google’s international data-transfer mechanisms is available in Google’s information on data-transfer frameworks.

11. Rights of Data Subjects

Subject to the applicable legal requirements and limitations, you have the right to:

Request access to your personal data pursuant to Art. 15 GDPR
Request rectification of inaccurate personal data pursuant to Art. 16 GDPR
Request erasure of personal data pursuant to Art. 17 GDPR
Request restriction of processing pursuant to Art. 18 GDPR
Receive certain personal data in a portable format pursuant to Art. 20 GDPR
Object to processing based on Art. 6(1)(e) or (f) GDPR pursuant to Art. 21 GDPR
Withdraw consent previously given at any time, without affecting the lawfulness of processing carried out before withdrawal

You also have the right not to be subject to a decision based solely on automated processing, including profiling, where the requirements of Art. 22 GDPR apply.

To exercise your rights, please contact us using the contact details provided in Section 1.

We may request appropriate information to verify your identity before responding to a data-subject request.

12. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with a competent supervisory authority.

In Austria, the supervisory authority is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at

13. External Links and Integrated Third-Party Services

Our website may contain ordinary links to websites or services operated by third parties. It also uses optional integrated third-party services, including Google Analytics and the RaiseNow donation form, as described in Sections 6 and 7.

Optional integrated services are loaded only in accordance with the privacy choices described in this Privacy Policy.

When you follow an ordinary external link, you leave our website. The processing of personal data on the destination website is governed by the privacy information and technical configuration of the respective provider. We encourage you to review the applicable privacy information before submitting personal data.

This does not affect our responsibility for processing activities for which we determine the purposes and means, including the administration of donation information made available to us.

14. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful processing.

These measures are reviewed and adapted where appropriate in light of technological developments, the nature and scope of the processing, and the risks to the rights and freedoms of affected individuals.

Nevertheless, data transmission over the internet cannot be guaranteed to be completely secure. Please avoid sending particularly sensitive information by ordinary, unencrypted email unless this has been agreed with us.

15. Changes to This Privacy Policy

We regularly review this Privacy Policy and update it where necessary due to legal, technical, or organisational changes. This may occur, in particular, where:

Applicable data-protection laws or regulatory requirements change
New functions, services, or processing operations are introduced
Existing processing operations change
Service providers or technologies relevant to personal-data processing change

The current version of this Privacy Policy will be published on our website.

Where a change has a material effect on the processing of personal data, we will provide additional information in an appropriate manner, for example through a notice on the website or by email where we have the relevant contact details and such communication is appropriate.

The amended Privacy Policy applies from the date of its publication.

Last updated: 22 July 2026

Version History

Version: 1.2

Date: 22 July 2026

Change: Added specific information about externally hosted online donations via RaiseNow and clarified external-platform cookies and responsibilities.