Privacy Policy

Last updated: July 27, 2026

This Privacy Policy describes how gravgrav ("the Company", "We", "Us" or "Our") collects, uses and protects Your personal information when You use Our website at https://www.gravgrav.cc ("the Service").

We are committed to protecting Your privacy and handling Your Personal Data in accordance with the General Data Protection Regulation (GDPR) and applicable Austrian data protection laws.

1. Company Information

Company name: gravgrav – Max Riese
Address: Halleiner Landesstrasse 28 / Top 3, 5061 Elsbethen, Austria
Email: [email protected]
Website: https://www.gravgrav.cc

2. Definitions

Personal Data means any information relating to an identified or identifiable individual.
Usage Data means data collected automatically when using the Service (e.g. IP address, browser type, pages visited, duration of visit).
Cookies are small text files stored on Your device.
Local Storage refers to data saved in Your browser (e.g. preferences or consent decisions).
Service Provider means third parties who process data on behalf of the Company.

3. Data We Collect

We collect the following types of data:

a) Information You Provide

Name, email address, and any information you choose to share when contacting us, registering for a membership, signing up for an event, or subscribing to communication (e.g. newsletter).

b) Automatically Collected Data

Usage Data such as pages visited, time spent on pages, and browser information.
Local Storage Entries for:
- language preferences (e.g. "en" / "de"),
- cookie consent state,
- newsletter popup accepted/rejected.

c) Analytics Data

We use Plausible Analytics, a privacy-first, GDPR-compliant service that does not use cookies or personal identifiers, and does not track individual users across sites or devices. Data collected by Plausible is fully anonymized and aggregated (e.g. total visitors, referrers, device type, and usage trends).

d) Tracking and Marketing (Conditional)

If You accept cookies via our cookie banner, we activate:

Google Tag Manager to manage tags,
Google Analytics 4 (GA4) to collect aggregated information on usage and behavior.

These cookies are only set after You have given explicit consent. You may withdraw consent at any time via the cookie settings.

e) Payment Data

For memberships, event fees, and other paid services, You will be redirected to Stripe, our payment processor. Stripe collects and processes payment information (e.g. card details, billing address) directly — we do not store Your full payment details ourselves. Stripe acts as an independent data controller for this data; please refer to Stripe's Privacy Policy for details.

f) Embedded Third-Party Content

Articles, event pages, and other content on the Service may include embedded media from third-party platforms, such as:

Komoot
RideWithGPS
YouTube
Instagram
and similar platforms

These embeds are added by content contributors and may set cookies or collect data (e.g. IP address, device information) according to the respective platform's own privacy policy, independent of Us. We request contributors to use the highest available privacy settings for embeds (e.g. privacy-enhanced modes where offered), but We have no control over data processing by these third parties. We recommend reviewing the privacy policies of these platforms before interacting with embedded content.

4. Purpose and Legal Basis for Processing

We process Your Personal Data for:

providing and maintaining the Service, including memberships, event registrations, and payments (Art. 6(1)(b) GDPR),
analysing usage and improving performance (Art. 6(1)(f) GDPR),
complying with legal obligations (Art. 6(1)(c) GDPR),
analytics and marketing based on consent (Art. 6(1)(a) GDPR).

You may withdraw Your consent at any time via the cookie settings or by contacting us.

5. Retention of Data

We retain Personal Data only as long as necessary for the purposes described:

Contact and membership data: as long as required to fulfill communication, contractual, or legal obligations.
Payment data: retained by Stripe according to their own policies and applicable financial regulations; we do not separately store full payment details.
Analytics and marketing data: stored according to Google's or Plausible's retention settings or until consent is withdrawn.
Local storage and cookie preferences: remain until cleared in Your browser.

6. Transfer of Personal Data

We process data primarily within the European Union.
When using Google Analytics or Stripe, data may be transferred outside the EU (e.g. to the United States). We rely on Standard Contractual Clauses (Art. 46 GDPR) and adequate safeguards implemented by these providers to protect personal data.
Embedded third-party content (e.g. YouTube, Instagram) may also involve data transfers outside the EU, governed by the respective platform's own policies.

7. Sharing of Your Data

We may share data only as follows:

With Service Providers (e.g. Plausible, Google, Stripe) for analytics, payment processing, and site operation, under GDPR-compliant agreements where applicable.
With third-party embed platforms (e.g. Komoot, RideWithGPS, YouTube, Instagram) when You interact with embedded content — see Section 3(f).
As required by law or legal authorities.

We do not sell personal information.

8. Your Rights Under GDPR

You have the right to:

Access Your Personal Data (Art. 15 GDPR),
Correct incomplete or inaccurate data (Art. 16 GDPR),
Request deletion of Your data (Art. 17 GDPR),
Restrict or object to processing (Art. 18–21 GDPR),
Withdraw consent at any time (Art. 7 GDPR),
Lodge a complaint with the Austrian Data Protection Authority (DSB).

To exercise Your rights, contact us at [email protected].

9. Cookies and Local Storage

You can at any time control cookies and local storage items via Your browser settings. For more information about which cookies and services are used, please refer to our Cookie Policy.

Our Service uses both essential cookies (required for website functionality) and optional cookies (analytics, activated only with consent).

10. Security

We take appropriate technical and organizational measures to protect Your data.
However, no transmission over the internet is 100% secure, and We cannot guarantee absolute security.

11. Links to Third-Party Sites and Embedded Content

Our Website may contain links to, or embedded content from, other websites and platforms (see Section 3(f)). We are not responsible for the content, functionality, or privacy practices of those third parties and encourage You to review their respective policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be published on this page with a new "Last updated" date.

13. Contact

If You have any questions about this Privacy Policy or wish to exercise Your rights, You can contact us:

gravgrav – Max Riese
Halleiner Landesstrasse 28 / Top 3
5061 Elsbethen, Austria
Email: [email protected]
Website: https://www.gravgrav.cc