Privacy Policy
Seatsmatch GmbH – VirtualHub
pursuant to Art. 13 & 14 GDPR | Version 1.0 | As of: March 2026
Controller within the meaning of the GDPR:
Seatsmatch GmbH
Seitenstettengasse 5/37, 1010 Vienna, Austria
Email: [email protected]
Web: virtualhub.seatsmatch.com
1. Scope
This privacy policy applies to the processing of personal data by Seatsmatch GmbH in the operation of the SaaS platform VirtualHub (virtualhub.seatsmatch.com), including the Mail Hub and Payment Hub modules.
It is addressed to:
- Operators: Companies that use VirtualHub as Software-as-a-Service
- Visitors of the website virtualhub.seatsmatch.com
Note on data processing: The processing of personal data of operators' end customers is carried out exclusively within the framework of commissioned processing pursuant to Art. 28 GDPR. The respective operator is responsible for this processing. The legal bases and information obligations towards end customers are the responsibility of the operator.
2. What Data We Process and Why
2.1 Website Visit
When you access our website, technical access data is automatically collected:
| Data Category | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Server log files (IP address, browser, referrer, time) | Technical operation, security, troubleshooting | Art. 6(1)(f) GDPR (legitimate interest) | 7 days, then automatic deletion |
| Cookies (technically necessary) | Session management, login function | Art. 6(1)(f) GDPR | Session / max. 12 months |
2.2 Registration and Account Management (Operators)
| Data Category | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Contact data (name, email, phone, company name, address) | Contract performance, account creation, communication | Art. 6(1)(b) GDPR (contract) | Duration of contract + 7 years (legal retention) |
| Access credentials (email, encrypted password) | Authentication, security | Art. 6(1)(b) GDPR (contract) | Duration of contract |
| VAT ID / Tax number | Invoicing, legal obligations | Art. 6(1)(c) GDPR (legal obligation) | 7 years (UGB/BAO) |
2.3 Software Usage (Mail Hub / Payment Hub)
Within the framework of commissioned processing pursuant to Art. 28 GDPR, Seatsmatch GmbH processes end customer data on behalf of operators. The operator is responsible for this processing. Details are set out in the Data Processing Agreement (DPA).
| Data Category | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Usage data (login times, actions, system logs) | Operation, troubleshooting, security | Art. 6(1)(f) GDPR (legitimate interest) | 90 days rolling |
| Billing data (usage, booked modules) | Contract fulfillment, invoicing | Art. 6(1)(b) GDPR (contract) | 7 years (legal retention) |
2.4 Email Communication and Support
| Data Category | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Email content, support inquiries | Processing inquiries, contract handling | Art. 6(1)(b)/(f) GDPR | 3 years after completion of the matter |
2.5 Newsletter and Marketing (optional)
If the operator has expressly consented to receiving marketing communications:
| Data Category | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Email address for newsletter | Product news, updates | Art. 6(1)(a) GDPR (consent) | Until withdrawal |
Consent may be withdrawn at any time by clicking "Unsubscribe" in the newsletter or by emailing [email protected].
3. Disclosure to Third Parties
We only disclose personal data to third parties in the following cases:
- Processors: Technical service providers (hosting, email delivery) under a DPA
- Legal obligations: When we are legally required to do so (e.g., at the request of authorities)
- Corporate transactions: In the event of a merger or sale of the company, with prior notification
Disclosure for advertising purposes or to third parties without a legal basis does not take place.
3.1 Engaged Processors (Sub-processors)
| Provider | Purpose | Location | Basis |
|---|---|---|---|
| Supabase Inc. | Database infrastructure, document storage | USA (EU server Frankfurt preferred) | DPA + SCCs (ID 2021/914) |
4. Data Transfers to Third Countries
Where possible, data is processed exclusively within the EU/EEA. In cases where sub-processors outside the EU are used (in particular Supabase Inc., USA), we ensure an adequate level of data protection through appropriate safeguards – EU Standard Contractual Clauses pursuant to Implementing Decision 2021/914.
5. Data Security
We implement technical and organizational measures to protect your data against unauthorized access, loss, or misuse. These include in particular:
- Encrypted data transmission via TLS/SSL
- Encrypted data storage (AES-256 or equivalent, via Supabase)
- Access restrictions through role management and two-factor authentication
- Regular security updates and penetration tests
- Employee training in data protection and information security
6. Your Rights as a Data Subject
As a data subject, you have the following rights:
| Right | Description |
|---|---|
| Access (Art. 15 GDPR) | You may request information about the personal data we store about you. |
| Rectification (Art. 16 GDPR) | You may request the correction of inaccurate or incomplete data. |
| Erasure (Art. 17 GDPR) | You may request the deletion of your data, provided no legal retention obligations apply. |
| Restriction (Art. 18 GDPR) | You may request the restriction of processing. |
| Data Portability (Art. 20 GDPR) | You may receive your data in a common, machine-readable format. |
| Objection (Art. 21 GDPR) | You may object to processing based on legitimate interest. |
| Withdrawal (Art. 7(3) GDPR) | You may withdraw consent at any time with effect for the future. |
| Complaint (Art. 77 GDPR) | You have the right to file a complaint with the Austrian Data Protection Authority (dsb.gv.at). |
To exercise your rights, please contact: [email protected]
7. Cookies
We only use technically necessary cookies on our website that are required for the operation of the platform (e.g., session cookies for login). These cookies do not require consent.
We currently do not use tracking or marketing cookies. Should we use such cookies in the future, we will ask for your consent in advance.
8. Links to Other Websites
Our website may contain links to external websites. We are not responsible for data protection on those sites. Please refer to the privacy policies of the respective providers.
9. Changes to This Privacy Policy
We reserve the right to update this privacy policy when legal requirements or our services change. The current version is always available at virtualhub.seatsmatch.com/privacy. Registered operators will be notified of significant changes by email.
As of this privacy policy: March 2026
10. Data Protection Contact
For data protection inquiries, please contact:
Seatsmatch GmbH – Data Protection
Email: [email protected]
Mail: Seitenstettengasse 5/37, 1010 Vienna, Austria
Austrian Data Protection Authority:
Barichgasse 40–42, 1030 Vienna
dsb.gv.at | [email protected]
Seatsmatch GmbH · VirtualHub · Privacy Policy · Version 1.0 · As of March 2026