Privacy Policy

Last updated: Sept 29 2026

This privacy policy explains which personal data we process when you visit productrocker.com, sign up for our newsletter, book a meeting or get in touch with us – why we do it, on which legal basis, how long we keep the data and which rights you have. We keep data collection to the minimum the website needs to work.

1. Who is responsible

Controller within the meaning of the General Data Protection Regulation (GDPR):

Gregor Marboe – Product Rocker Krummbaumgasse 2-4 1020 Vienna, Austria Email: hello@productrocker.com Phone: +43 676 4 942 942

We are not legally required to appoint a data protection officer. For any privacy question, write to hello@productrocker.com.

2. Hosting and server log files

Our website runs on servers of World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, 4020 Linz, Austria, in a data centre in Austria. World4You processes data on our behalf under a data processing agreement (Art. 28 GDPR).

Every time you open a page, your browser automatically sends information that the server stores in log files:

  • IP address
  • date and time of the request
  • page or file requested
  • referrer URL (the page you came from)
  • browser type and version, operating system
  • HTTP status code and amount of data transferred

Purpose: delivering the website, ensuring stability and security, detecting and defending against attacks. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure, working website. Retention: World4You deletes log files automatically after 14 days. Longer retention only applies if we need a specific entry to investigate a security incident.

Our website uses TLS encryption (recognisable by “https://” and the lock icon in your browser).

3. Cookies and access to your device

We do not use cookies for tracking, advertising or profiling. We do not store or read information on your device unless this is strictly necessary for a service you have explicitly requested (§ 165(3) Austrian Telecommunications Act 2021 – TKG 2021). That is why this website shows no cookie banner.

Fonts are hosted on our own server. Your browser does not connect to Google or any other font provider. Our bot protection (section 5) connects your browser to Cloudflare, but it does not set cookies either.

4. Web analytics with Matomo

To understand which pages are read and how people find us, we use the open-source analytics software Matomo. Matomo runs as a plugin inside our own WordPress installation on the servers of World4You in Austria (see section 2). No data goes to Matomo, to other third parties or outside the EU.

We have configured Matomo in the most privacy-friendly way:

  • no cookies and no other storage on your device
  • your IP address is shortened by two bytes before storage (e.g. 192.168.xxx.xxx), so it can no longer be linked to you
  • no cross-site tracking and no fingerprinting to recognise you across days or websites
  • no user ID, no linking with other data, no profiling
  • Do Not Track and Global Privacy Control signals in your browser are respected

Matomo records pages visited, time of the visit, referring website, approximate region (country level), device type, browser and screen resolution. We only look at aggregated statistics.

Purpose: measuring reach and improving the content and structure of the website. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in anonymised usage statistics for our own website. Retention: raw data is deleted after 13 months, aggregated reports contain no personal data.

Your right to object: you can opt out of Matomo analytics at any time. If you click the button below, your browser stores a single opt-out cookie that tells Matomo not to record your visits. If you delete your cookies, you need to opt out again.

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.

5. Bot protection (Cloudflare Turnstile)

To keep spam bots away from our forms, we use Turnstile, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Turnstile replaces the usual puzzle captchas: you do not have to click on traffic lights or type distorted letters. It checks in the background whether a request comes from a person or from a bot.

What Cloudflare receives: your IP address, your browser’s user agent, a TLS fingerprint of your connection, the key that identifies our website and the address of the page you are on. Turnstile does not read what you type into a form and does not set cookies on our website. At present the Turnstile script loads on every page of our website, not only on the pages that carry a form.

Purpose: protecting our forms and our website against automated abuse and spam. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in keeping our forms usable and free of automated abuse. Retention: we do not store any of this data ourselves. How long Cloudflare keeps these signals is set out in its Turnstile privacy addendum.

Roles: Cloudflare acts on our behalf when it checks a request for us. When it uses the same signals to improve the bot detection behind Turnstile, Cloudflare acts as controller in its own right, on the basis of its legitimate interest.

Transfers outside the EU: the check runs on Cloudflare’s global network, so your data may be processed in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Details: https://www.cloudflare.com/turnstile-privacy-policy/

6. Newsletter (Brevo)

You can subscribe to our newsletter “Product Rocker studio updates” on this website. We send the newsletter with Brevo, operated by Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France. Brevo processes the data on our behalf under a data processing agreement (Art. 28 GDPR) and stores it in the EU.

What we process: your email address and first name (to address you personally in the newsletter), date and time of sign-up and confirmation, IP address at sign-up and confirmation.

Double opt-in: after you sign up, you receive an email asking you to confirm your subscription. Only after you click the link do we add you to the list. We log the sign-up and the confirmation to prove your consent.

Open and click tracking: our newsletters contain a small pixel and personalised links. They tell us whether and when you opened an email and which links you clicked. We use this to see which topics interest our readers and to improve the newsletter. You consent to this measurement when you subscribe. If you do not want it, you can unsubscribe at any time – separate consent to the newsletter without tracking is not possible.

Legal basis: Art. 6(1)(a) GDPR and § 174 TKG 2021 – your consent. Logging the double opt-in is based on Art. 6(1)(c) and (f) GDPR (our obligation and interest in proving consent). Withdrawal: you can unsubscribe at any time via the link at the end of every newsletter or by writing to hello@productrocker.com. Withdrawal does not affect the lawfulness of processing before it. Retention: until you unsubscribe. After that, we keep your email address on a block list so we do not write to you again by mistake, and keep the proof of consent for up to three years (limitation period for claims).

Transfers outside the EU: Brevo stores data in the EU. For support and maintenance, staff of Brevo and its service providers in the USA and India may access it. For the USA, Brevo relies on the EU-U.S. Data Privacy Framework and, in addition, on the EU Standard Contractual Clauses; for India, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Providing your email address and first name is voluntary. Without them, we cannot send you the newsletter.

7. Booking a meeting (Brevo Meetings)

You can book a Discovery Call or other meeting via Brevo Meetings at meet.brevo.com/productrocker. The booking page runs on Brevo’s servers (Sendinblue SAS, see section 6). Video calls take place via Brevo Video, also provided by Brevo.

What we process: name, email address, chosen date and time. During a video call, audio and video are transmitted in real time. We do not record calls.

Purpose: scheduling and holding the meeting you asked for. Legal basis: Art. 6(1)(b) GDPR – steps prior to a possible contract at your request. Retention: booking data is deleted no later than 12 months after the meeting unless a business relationship follows; then the retention periods in section 9 apply.

Transfers outside the EU: see section 5. For information on how Brevo processes data on its booking page, see Brevo’s privacy policy: https://www.brevo.com/legal/privacypolicy/

8. Contact by email, phone or WhatsApp

If you write to us or call, we process your name, contact details and message to answer your enquiry.

Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR – our legitimate interest in answering enquiries. Retention: we delete your enquiry once it is fully handled, unless statutory retention obligations apply or a business relationship follows.

WhatsApp: the WhatsApp link on our website is a plain link. Only when you click it and send a message does WhatsApp (WhatsApp Ireland Ltd., Merrion Road, Dublin 4, Ireland) process your data, including your phone number and metadata, and may transfer it to Meta Platforms Inc. in the USA (EU-U.S. Data Privacy Framework). If you prefer, contact us by email or phone.

9. Clients and business relationships

If a business relationship results from your contact, we process the data needed to prepare and perform the contract (Art. 6(1)(b) GDPR). Invoices and business records are kept for seven years as required by Austrian tax law (§ 132 BAO; Art. 6(1)(c) GDPR).

10. Links to social networks

Our website links to our profiles on LinkedIn and Instagram. These are plain links, not embedded plugins: no data flows to these networks when you visit our website. Only when you click a link and open the network does its operator process your data according to its own privacy policy.

11. Google Search Console

 We use Google Search Console (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to check how our website appears in Google search results. For this, our website contains a verification tag. Search Console does not load any script on our website and does not process data about your visit here. Google receives search data solely when you use Google Search, under Google’s own responsibility.

12. Recipients

We only share personal data with the service providers named above, who process it on our behalf and under our instructions (World4You, Cloudflare and Brevo). We do not sell data and do not share it for advertising. Beyond that, we only disclose data if the law requires it (e.g. to authorities).

13. Your rights

You have the right to:

  • access the data we hold about you (Art. 15 GDPR)
  • rectification of incorrect data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. You can object to processing for direct marketing at any time, without giving reasons.

To exercise your rights, write to hello@productrocker.com. We answer within one month.

Right to lodge a complaint: if you believe we process your data unlawfully, you can complain to a supervisory authority. In Austria, this is:

Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna, Austria dsb@dsb.gv.at – www.dsb.gv.at

14. No automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

15. Changes to this policy

We update this privacy policy when our website or the law changes. The current version is always available on this page.