Privacy Policy

1. Controller

Richard Preißler MSc
Email: richard@foama.at
Phone: +43 664 28 21 072

Richard Preißler / foama is the controller for personal data processing in connection with this website and the contact and marketing activities described here.

For mobility surveys conducted on behalf of clients, the controller is the respective employer or the municipality, region, or comparable organization named on the survey start page or in the invitation. foama processes the personal data collected in that context as a processor pursuant to Article 28 GDPR. Further details are set out in section 9.

2. Data Protection Officer

Due to the size of our company, we are not required to appoint a data protection officer. If you have any questions about data protection, please contact us directly using the contact details above.

3. General Information on Data Processing

Scope of Processing Personal Data

We process personal data of our users in principle only to the extent necessary to provide a functional website as well as our content and services. Processing is based on the legal bases set out below; for mobility surveys conducted for clients, the roles and legal bases in section 9 apply in addition.

Legal Basis for Processing

Where we obtain consent for processing operations, Article 6(1)(a) GDPR serves as the legal basis. For processing to fulfill a contract, Article 6(1)(b) GDPR serves as the legal basis. For processing to protect legitimate interests, Article 6(1)(f) GDPR is the legal basis.

4. Provision of the Website and Creation of Log Files

Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the accessing computer system. The following data is collected:

• Information about the browser type and version used
• The user's operating system
• The user's internet service provider
• The user's IP address
• Date and time of access
• Websites from which the user's system reaches our website
• Websites accessed by the user's system through our website

Legal Basis and Purpose

The legal basis for the temporary storage of data is Article 6(1)(f) GDPR. The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer.

Storage Duration

The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For data used to provide the website, this is generally the case after the respective session ends.

5. Contact Form and Email Contact

Description and Scope of Data Processing

A contact form is available on our website for electronic contact. The following data is transmitted:

• Name
• Email address
• Company
• Number of employees
• Message
• Time of message

Legal Basis and Purpose

The legal basis for processing is Article 6(1)(f) GDPR. Our legitimate interest lies in processing and responding to your inquiry, as well as any subsequent contact at a later time for follow-up questions or to improve our processes by obtaining feedback.

Storage Duration

The data is deleted after 12 months.

6. Newsletter

We currently do not offer a newsletter. Should we introduce a newsletter in the future, we will inform you about the corresponding data processing.

7. Web Analysis by Google

Scope of Processing

This website uses Google Analytics and Google Ads from Google Ireland Limited. Google Analytics and Google Ads use "cookies," text files that are stored on your computer and enable analysis of your use of the website.

Purpose of Processing

On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity. Google Ads specifically measures the effectiveness of advertising displayed on Google.

Legal Basis

The legal basis for the use of Google Analytics and Google Ads is Article 6(1)(a) GDPR (consent).

Recipients

The recipient of the data is Google as a data processor. Google processes the data in accordance with the Google Ads Data Processing Terms, which are GDPR compliant.

Storage Duration

The storage period is 24 months. Deletion occurs automatically after the storage period expires.

Third Country Transfer

Google also processes your data in the USA. Google is certified under the EU-US Data Privacy Framework.

Objection and Removal Options

You can prevent the collection and processing of your data by Google by deactivating analytics cookies.

8. Cookies

Information about our use of cookies can be found in our Cookie Policy.

9. Mobility Surveys for Employers and Municipalities / Regions

foama conducts mobility surveys and live data collection (including via dedicated survey URLs such as https://probier.foama.at, where used in a given project) exclusively on behalf of a named client. The controller is the employer or the municipality, region, or comparable organization named on the survey start page or in the invitation. foama processes the personal data collected as a processor on documented instructions and under an agreement pursuant to Article 28 GDPR. The respective controller ensures that a suitable legal basis under Article 6 GDPR exists for the processing.

9.1 Participation via an Employer

The purpose of processing is to support the employer’s corporate mobility management: collecting and analysing commuting and mobility data, providing personal feedback and recommendations to participants, and delivering aggregated analyses and advice to the employer.

We process in particular your email address; survey and mobility information (e.g. approximate home area or a nearby GPS position), mode choice, commute times and frequency, costs, satisfaction, and similar mobility-related information); and technical metadata required to run the survey (e.g. timestamp of participation).

The employer generally does not receive personal individual responses, but only aggregated analyses. Participation is voluntary. The employer’s typical legal basis is Article 6(1)(f) GDPR (legitimate interest in corporate mobility management and related aims such as health promotion, safety, sustainability, and compliance, provided the interests of the data subjects do not override). Data-subject rights are primarily exercised against the employer; foama supports the employer and promptly forwards recognisable requests.

9.2 Municipal / Regional Participation (Residents)

For surveys commissioned by municipalities, regions, or comparable organizations, the same processor model applies: the controller is the public body or organization named in the project; foama acts as processor.

The purpose of processing is in particular to support mobility and transport planning, participation, and aggregated decision-making for the client. Data categories and the principle that the client generally receives aggregated analyses rather than personal individual responses correspond to section 9.1, unless communicated otherwise for the specific project.

Participation is voluntary. The controller’s typical legal basis is Article 6(1)(e) GDPR (performance of a task carried out in the public interest or in the exercise of official authority) and/or Article 6(1)(f) GDPR, where applicable. Providing an email address to receive personal results may additionally be based on Article 6(1)(a) GDPR (consent). Data-subject rights are primarily exercised against the named municipality, region, or organization; foama supports and forwards requests.

9.3 Shared Notes on Survey Data

We require your email address so we can send you your personalized survey results. We do not use that address for newsletters, marketing email campaigns, or bulk mailings. Geographic questions may concern your approximate home area; we ask you not to submit your full street-level address. Even so, depending on what you enter, some information may still be subject to stricter GDPR safeguards (including, where applicable, special categories of personal data under Article 9 GDPR).

To run the surveys we use subprocessors within the EU/EEA, in particular PythonAnywhere LLP (hosting of the survey and analysis software / database), Hetzner Online GmbH (hosting / infrastructure), and Brevo (Sendinblue SAS, email delivery and management). A third-country transfer is generally not required for these survey services.

All GDPR data-subject rights set out in section 10 below apply in full. For survey data, the primary contact is the controller named on the survey start page or in the invitation; you may also contact foama (contact details in section 1).

10. Rights of Data Subjects

If personal data about you is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

Right of Access

You can request confirmation from the controller as to whether personal data concerning you is being processed by us.

Right to Rectification

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is inaccurate or incomplete.

Right to Erasure

You can request that the controller delete personal data concerning you without undue delay, provided one of the following reasons applies and insofar as processing is not necessary.

Right to Restriction of Processing

You have the right to request restriction of processing from the controller if one of the following conditions is met.

Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format.

Right to Object

Right to Withdraw Data Protection Consent

You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

11. Data Security

We use the widespread SSL (Secure Socket Layer) procedure in conjunction with the highest level of encryption supported by your browser during website visits. This is usually 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead.

12. Currency and Modification of this Privacy Policy

This privacy policy is currently valid and has the status of September 2026. Due to the further development of our website and offers or due to changed legal or regulatory requirements, it may become necessary to change this privacy policy. The current privacy policy can be accessed and printed at any time on the website at https://foama.at/en/data-privacy.