Privacy Policy

Last updated: 3 September 2026

At a glance

• This website is operated by ReqPOOL GmbH, Linz, Austria. Questions about data protection: office@reqpool.com.
• When you visit the site, our hosting provider Microsoft processes technical access data (including your IP address) to deliver and secure the pages.
• Google Analytics and Google Maps are loaded only after you consent in the cookie banner. Without consent, no data is sent to Google.
• The spam protection of our forms (Cloudflare Turnstile) is loaded only on pages with forms and does not set tracking cookies.
• Form entries are delivered by e-mail to office@reqpool.com and used solely to handle your request.
• You can change your cookie choices at any time via “Cookie settings” in the footer. Newsletter and registrations can be cancelled at any time by e-mail.

1. Controller

ReqPOOL GmbH
Freistädter Straße 313-315, 4040 Linz, Austria
Phone: +43 (0) 800 500122
E-mail: office@reqpool.com

A data protection officer is not required by law and has not been appointed. For all data protection matters, please contact us at the e-mail address above.

2. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To exercise these rights, simply e-mail office@reqpool.com.

If you believe that the processing of your data violates data protection law, you may lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

3. Hosting and delivery of the website

The website is operated as a static web application on Microsoft Azure Static Web Apps, provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The application is deployed in the Azure region “West Europe” (Netherlands); content is delivered through Microsoft's globally distributed edge network so that pages load quickly near you.

On every request, Microsoft processes technical access data on our behalf: IP address, date and time, requested address, transferred data volume, status code, browser type and version, operating system and the previously visited page (referrer). This data is required to deliver the site, fend off attacks and analyse errors. We evaluate it only when there is a specific reason (outages, security incidents) and keep diagnostic logs for a maximum of 30 days.

The legal basis is our legitimate interest in the secure and efficient operation of the website (Art. 6(1)(f) GDPR). A data processing agreement is in place with Microsoft (Microsoft Products and Services Data Protection Addendum). Where data is processed outside the EEA via the edge network, the transfer is based on the EU Standard Contractual Clauses and Microsoft's certification under the EU-U.S. Data Privacy Framework.

4. Cookies and local storage

We use only a few cookies and storage entries. Strictly necessary entries are set without consent; all others only after you agree in the cookie banner.

5. Consent management (cookie banner)

We obtain and manage your consent with our own cookie banner. No third-party consent management service is used, and no data is transmitted to third parties in the course of consent management. Your choices (categories “Statistics” and “External media”, time, version of the prompt) are stored solely in your browser's local storage and requested again after 12 months. You can change or withdraw your choices at any time via the “Cookie settings” link in the footer.

Legal basis: proof of consent (Art. 7(1) GDPR) and our legitimate interest in lawful operation of the site (Art. 6(1)(f) GDPR).

6. Google Analytics 4 (only with your consent)

To measure the reach of our website we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). The measurement code is loaded only after you have consented to the “Statistics” category; until then no data is sent to Google. We use Google Consent Mode v2, whose default setting denies all storage purposes.

After your consent, Google processes pseudonymised information about your visit: pages viewed, time on page, approximate location (based on the truncated IP address, which Google Analytics 4 does not store), device, browser, referrer and events such as submitting a form or clicking an e-mail address. We use Google Analytics solely for statistical evaluation; we do not use advertising features or linking with Google accounts. Retention of user and event data at Google is limited to a maximum of 14 months.

The legal basis is your consent (Art. 6(1)(a) GDPR). Google may transfer data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition. Further information: policies.google.com/privacy. You can withdraw your consent at any time via “Cookie settings”; the Google cookies are then removed.

7. Google Maps (only with your consent)

On the “Contact” and “About ReqPOOL” pages we show our locations on a Google Maps map (Google Ireland Limited, address above). The map is loaded as an embedded frame only after you have consented to the “External media” category or clicked “Load Google Maps”. When the map loads, your browser transmits your IP address and browser information to Google; Google sets its own cookies (see table above) and may process the data for its own purposes.

The legal basis is your consent (Art. 6(1)(a) GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.

8. Spam protection with Cloudflare Turnstile

Our forms are protected against automated submissions by Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Turnstile is loaded only on pages with forms and checks in the background whether the input comes from a human. Your IP address, browser and device information and interaction data are transmitted to Cloudflare; the result is sent to us with the form as a short-lived verification code, which our server validates with Cloudflare. Turnstile does not set tracking cookies and does not build a user profile.

The legal basis is our legitimate interest in protecting our forms against abuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework. Further information: www.cloudflare.com/privacypolicy.

9. Contact form and e-mail contact

If you write to us via the contact form or by e-mail, we process the data you provide (name, company, e-mail address, message) and the time of submission in order to answer your request. Form entries are received by a function operated in Azure and delivered via Microsoft Graph as an e-mail to our mailbox office@reqpool.com (Microsoft 365, Exchange Online). The data is not stored in a separate database.

The legal basis is the performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Where you additionally give your consent to storage in the form, the processing is also based on Art. 6(1)(a) GDPR. We delete enquiries once they have been dealt with; business-relevant correspondence is retained for the duration of statutory retention obligations (up to seven years, Section 132 of the Austrian Federal Fiscal Code).

10. Newsletter

Via the form in the footer you can subscribe to our newsletter with articles, publications and event announcements. For this we process your e-mail address, the time of sign-up and the page on which you signed up. The sign-up is delivered to office@reqpool.com; a member of our team will then contact you personally to confirm your subscription and ask about your interests. Only after this confirmation do we add you to the distribution list.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 174 of the Austrian Telecommunications Act 2021). You can unsubscribe at any time by e-mailing office@reqpool.com or by using the unsubscribe link in any of our mailings; your data is then removed from the list. Mailings are sent from our Microsoft 365 environment; no external newsletter service is used.

11. Registration for publications, tools and demo appointments

We offer registration forms for downloading publications, white papers and infographics, for access to tools of the ReqPOOL Suite (for example reqChecker) and for demo requests for our platforms. We process name, company, e-mail address, an optional message, the selected publication or tool, language, time and the page you were on. The data is delivered to office@reqpool.com via an Azure function and Microsoft Graph, as with the contact form.

Upon registration you receive the download link, or we get in touch about access or an appointment. Registration also includes your agreement that we may inform you by e-mail about new publications and updates on the selected topic; we point this out in the form. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future by e-mailing office@reqpool.com. Downloads already unlocked remain unaffected. So that the download link remains visible on your next visit, we store a marker per publication in your browser's local storage (see the table in section 4); this marker is not transmitted to us.

12. Appointment booking via Microsoft Bookings

On the “Book an expert conversation” page we link to our booking page on Microsoft Bookings, which is part of our Microsoft 365 environment. The booking page is not embedded in our website; it opens only when you click the button. The data you enter there (name, e-mail address, phone, company, preferred time, notes) is processed to arrange and hold the appointment on the basis of Art. 6(1)(b) GDPR. Microsoft (Microsoft Ireland Operations Ltd.) processes this data as our processor in data centres in the EU.

13. Embedded application reqChecker

The page for the reqChecker tool contains the application reqchecker.reqpool.com, operated by us, as an embedded frame (iframe). The requirements check runs entirely in your browser; entered content is not transmitted to a server, no cookies are set and no tracking is used. When the frame loads, only the technical access data described in section 3 is transmitted to our hosting provider.

14. Applications via the careers portal

Job offers and applications are handled via our careers portal jobs.reqpool.com, which runs on the applicant management system of Talention GmbH (Germany). The links on our website lead to this portal; the privacy information published on the portal applies to data collected there. Applications that reach us by e-mail are processed to carry out the application procedure (Art. 6(1)(b) GDPR); after the procedure has ended we delete the documents within seven months at the latest, unless you have agreed to longer retention.

15. External links and social networks

Our website contains links to external services, including our company page on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland), the publishers' pages of our books and publications, and event recordings on YouTube. This content is not embedded; when you click, you leave our website and the privacy policy of the respective provider applies. The share buttons on blog posts are plain links without tracking.

For our LinkedIn company page we are joint controllers with LinkedIn (Art. 26 GDPR). LinkedIn provides us with aggregated statistics on the use of the page; we do not receive personal data from them. Further information: linkedin.com/legal/privacy-policy.

16. Events and webinars

If you register for one of our events or webinars, we process the data provided (name, company, e-mail address, position where applicable) to organise and hold the event (Art. 6(1)(b) GDPR). Registration takes place via the platform named on the respective event page; its privacy notice applies in addition. Online events are usually held via Microsoft Teams.

17. Recipients and transfers to third countries

We share personal data only where necessary for the respective purpose. Processors acting on our behalf are Microsoft (hosting, Microsoft 365, Exchange Online, Bookings) and Cloudflare (spam protection). After your consent, Google processes some data under its own responsibility. Transfers to third countries, in particular the USA, take place only on the basis of an adequacy decision (EU-U.S. Data Privacy Framework, under which Microsoft, Google and Cloudflare are certified) or the EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

18. Retention periods

• Technical access data and diagnostic logs: no longer than 30 days.
• Cookie choices: 12 months in your browser's local storage.
• Google Analytics data: no longer than 14 months at Google; cookies for a maximum of 2 years.
• Contact enquiries: until dealt with; business-relevant correspondence for up to seven years.
• Newsletter and registrations: until you withdraw or unsubscribe.
• Appointment and event data: until the event has taken place and been settled, no longer than seven years where retention obligations apply.

19. Security

The website is delivered exclusively over encrypted HTTPS (TLS 1.2 or higher). Form data is transmitted and delivered in encrypted form. Only the staff responsible have access to the mailboxes and systems in which enquiries are handled; access is protected by multi-factor authentication.

20. Changes to this privacy policy

When we change services or processing operations, we update this policy. The current version is always available on this page; the date of the last change is shown at the top of the document.