Last updated: October 12, 2026
Data controller
The personal data controller is Investment Migration GmbH, legal address: Operngasse 20b, 1040 Wien, Austria. Data Protection Officer: dpo@investment-migration.com. Response time: 30 days per GDPR requirements.
What data we collect
We collect only the minimum necessary data for the operation of the site and editorial office:
- Technical data: IP address, browser, operating system, pages visited, time spent — collected automatically for traffic analytics
- Contact data: email, name, company — only when you voluntarily send a form or email
- Subscription data: email address for the quarterly report newsletter — stored until you unsubscribe
- Cookies: identifiers for theme and settings — only with your consent via the cookie banner
We do not collect financial data, documents, passport data or any sensitive personal data. If you want to be included in the ranking, these are provided separately and processed under a different legal basis (contract).
Why we need the data
Each data category has a specific purpose and legal basis per Article 6 of GDPR:
- Technical data — editorial office's legitimate interest in analyzing site effectiveness (Art. 6(1)(f))
- Contact data — fulfillment of your request or contract performance (Art. 6(1)(b))
- Subscription — your express consent that can be withdrawn at any time (Art. 6(1)(a))
- Marketing cookies — your consent via the cookie banner (Art. 6(1)(a))
How long we keep data
Storage periods are set by the minimum necessary:
- Server logs — 30 days, then automatic deletion
- Google Analytics data — 14 months, anonymized
- Email correspondence — 3 years for editorial communications, 10 years for contracts
- Newsletter — until you unsubscribe via the link in each email
- Cookies — session (until browser closes) or up to 365 days per cookie
Who we share data with
We do not sell data to third parties. We transfer data only to processors who help operate the site, under strict GDPR agreements:
- Hostinger International Ltd (Lithuania) — site hosting, EU jurisdiction
- Google LLC (USA) — Google Analytics, under EU-US Data Privacy Framework
- Mailchimp (USA) — newsletter, under EU-US Data Privacy Framework
- Cloudflare Inc (USA) — DDoS protection, under EU-US Data Privacy Framework
Legal transfer to the USA is based on the European Commission's adequacy decision (EU-US DPF, July 2023).
Your rights under GDPR
You have the following rights, which you can exercise by writing to dpo@investment-migration.com:
- Right of access — get a copy of all your data (Art. 15)
- Right to rectification — correct inaccurate data (Art. 16)
- Right to erasure — "right to be forgotten" (Art. 17)
- Right to restriction of processing (Art. 18)
- Right to data portability — receive data in machine-readable format (Art. 20)
- Right to object — object to processing based on legitimate interest (Art. 21)
- Right to withdraw consent — at any time, without consequences (Art. 7(3))
Response time: 30 days. If we cannot fulfill the request, we explain the reasons in writing.
Supervisory authority
If you believe we have violated your rights, you can file a complaint with the Austrian supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien. Website: dsb.gv.at.
Cookies
The detailed cookie policy is published on a separate page: cookie policy. In short: essential cookies cannot be disabled (they maintain the interface's basic function), analytics and marketing cookies — only with your consent via the banner on the first visit.
Policy changes
We update this policy when legislation or data processing procedures change. Significant changes are reported by email to newsletter subscribers 30 days before entry into force. The policy change history is available upon request to dpo@investment-migration.com.