Legal

Privacy Policy

Valid from October 30, 2026

Convenience translation. Only the German version is legally binding.

Which personal data we collect, what we process it for, to whom it is passed on and which rights you have in this respect. Separated into the website ioumi.com and the platform itself.

This policy distinguishes between two areas:

  • Part 1: Marketing website (ioumi.com): public website with information about our products
  • Part 2: Platform (app.ioumi.com and subdomains): the actual software as a service solution used by our sellers and their end customers

‍

1. Controller

ioumi GmbH
Bahnhofstraße 8a
6922 Wolfurt
Austria

Commercial register (Firmenbuch): FN 672206p, Regional Court Feldkirch (Landesgericht Feldkirch)
VAT ID (UID-Nummer): ATU82959014

Email: hallo@ioumi.com
Phone: +43 5574 34630

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR, German: DSGVO) is ioumi GmbH.

ioumi GmbH has not appointed a data protection officer, because the requirements for a mandatory appointment under Art. 37 GDPR are not met.

For data protection matters, you can reach us at datenschutz@ioumi.com.

‍

2. Allocation of roles under the GDPR

ioumi acts in two different roles, depending on which data is processed:

As controller, we process:

  • Data of visitors to our marketing website ioumi.com
  • Data of prospects who book a demo call or subscribe to the newsletter
  • Data of our sellers (account data, onboarding, communication, billing)

As processor within the meaning of Art. 28 GDPR, we process:

  • Data of end customers that our sellers process on the platform (e.g. contract data, invoice data, payment data)

For end customer data, the respective seller is the controller under data protection law. ioumi processes this data exclusively on the seller's instructions on the basis of a separate data processing agreement (ioumi.com/en/legal/dpa).

‍

Part 1: Marketing website (ioumi.com)

‍

3. Hosting of the marketing website

The marketing website ioumi.com is hosted by:

Ploi Cloud B.V., Amperestraat 16J, 3861HB Nijkerk, Netherlands (KvK: 97693731)

Ploi Cloud uses UpCloud as its infrastructure partner; operation takes place in a data center in the European Union (Amsterdam). No transfer of data to a third country takes place in the course of hosting.

In the course of hosting, automatically collected data (IP address, browser data, access times) is processed in server logs. These logs are stored for a maximum of 30 days and then automatically deleted. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website).

Ploi Cloud privacy policy: https://ploi.cloud/privacy

‍

4. Collection and processing when visiting the marketing website

4.1 Automatically collected data

When you visit ioumi.com, the following data is collected automatically:

  • truncated IP address
  • date and time of access
  • browser type and version
  • operating system
  • referrer URL
  • pages visited

This data serves technical security, error analysis and statistical evaluation. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and optimization).

4.2 Web form (demo call request)

There is a single form on the marketing website: the demo call request at ioumi.com/demo. When you submit this form, we process the data you have entered:

  • first and last name
  • company
  • business email address
  • phone number
  • type of offering (multiple choice: coaching, consulting, agency services, digital products & courses, other)

In addition, the following data is technically recorded on submission:

  • submission page (URL)
  • referrer URL
  • UTM parameters (campaign source)
  • if ticked: your voluntary consent to receive information about products, including its wording (see Section 4.7)
  • time of the request

Purpose: Handling your request, scheduling a demo appointment and tracing the source of the request.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) for the data you have entered; Art. 6(1)(f) GDPR (legitimate interest in evaluating our marketing activities) for the source data (submission page, referrer URL, UTM parameters).

Data transfer: The form data is transferred to an automation instance operated by us (n8n), which is hosted on a server at Hetzner Online GmbH, Gunzenhausen, Germany (no third country transfer). From there, the data is

  • stored as a lead in our CRM Close (Close.com Inc., USA). Data transfer to the USA on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses. Close privacy policy: https://www.close.com/privacy
  • forwarded to our team as an internal notification via ClickUp (ClickUp Inc., USA). Data transfer to the USA on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses. ClickUp privacy policy: https://clickup.com/privacy

Storage period: see Section 15 (demo requests and leads).

4.3 Phone field / country code (ipinfo.io)

To preset the country code in the phone field of the demo form, a request is sent to ipinfo.io (IPinfo Inc., USA) when the page ioumi.com/demo is opened. In the process, your IP address is transferred to IPinfo and the country of origin is returned. No further data is stored.

Purpose: User friendliness (automatic preselection of the country code).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in user friendly form entry).

Data transfer: USA, on the basis of the EU-US Data Privacy Framework or Standard Contractual Clauses.

IPinfo privacy policy: https://ipinfo.io/privacy-policy

4.4 Scheduling via Calendly

Calendly is not embedded in the website. We use Calendly LLC, USA to schedule appointments after your demo request: you receive a booking link from us by email or phone. The data transmitted when booking (name, email, preferred date, and where applicable phone and company) is processed by Calendly.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).

Data transfer: USA, on the basis of the EU-US Data Privacy Framework and, where applicable, EU Standard Contractual Clauses.

Calendly privacy policy: https://calendly.com/pages/dpa

4.5 Videos (Wistia)

On the home page (explainer video and video case studies) and on the thank you page after the demo request (video case studies), we embed videos from the provider Wistia (Wistia Inc., USA).

Preview without Wistia: At the top of the home page, a silent preview of the explainer video plays before playback. We deliver this preview from our own server. No connection to Wistia is established, and no data is transferred to Wistia.

Loading only after a click: The Wistia player is only loaded when you actively start a video. From that moment on, your IP address, technical information about your browser and device as well as information about playback are transferred to Wistia.

With or without usage analytics: If you have consented to the “Analytics” category in the cookie banner, we load the player in standard mode. Wistia then records playback statistics (for example start time, playback duration and sections played) and may store information in your browser for this purpose. Without this consent, we load the player in the mode without usage analytics. Wistia then creates no playback statistics on your use. Your selection at the moment of the click is decisive. You can change it at any time via “Cookies” in the footer.

Legal basis: Art. 6(1)(a) GDPR (consent by clicking “Play” and, for usage analytics, by your selection in the cookie banner) or Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation of our offerings).

Data transfer: USA, on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses.

Wistia privacy policy: https://wistia.com/privacy

4.6 Source of your request

So that we can attribute a demo request to the right campaign or the right sales partner, the website stores the following in your browser's local storage for 30 days:

  • campaign and partner parameters from the link through which you came to us (e.g. UTM parameters or a partner identifier), storage key utm_params_storage
  • the domain of the website from which you first came to us, and your landing page, storage key ioumi_erstkontakt

This information only leaves your browser if you submit the demo form; it is then transmitted together with your request (see Section 4.2). After 30 days, it is overwritten or deleted. You can delete it yourself at any time by clearing the website data in your browser.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in attributing requests to the right campaigns and correctly settling commissions with our sales partners.

4.7 Newsletter and information about products

When requesting a demo and when registering on the platform, you can consent via a separate, voluntary checkbox to us informing you by email and phone about ioumi products and offers, for example with our newsletter, product updates and practical tips. For this purpose, we process your name, your email address and your phone number. As proof of your consent, we store the time, the IP address used and the wording of the consent. Without this consent, we contact you exclusively regarding your request.

For sending, we use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo records whether a newsletter was opened and which links in it were clicked, so that we can see which content is of interest.

Legal basis: Art. 6(1)(a) GDPR and § 174 of the Telecommunications Act 2021 (Telekommunikationsgesetz 2021, TKG 2021) (your consent). You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every email, by phone or by email to datenschutz@ioumi.com.

Data transfer: Processing generally takes place in the EU; for technical reasons, data may be transferred to Brevo sub-processors based in the USA, on the basis of Standard Contractual Clauses.

Brevo privacy policy: https://www.brevo.com/de/legal/privacypolicy/

‍

5. Cookies and tracking on the marketing website

5.1 Cookie banner

On your first visit to ioumi.com, you are shown a cookie banner for giving consent. Without your consent, only strictly necessary cookies are set.

Before your consent, we do not load any Google services, and no connection to Google is established. Only when you consent to the “Analytics” or “Marketing” category do we load Google Tag Manager and the services you have consented to (Google Consent Mode v2). We load the Meta Pixel exclusively after your consent to the “Marketing” category.

You can withdraw or adjust your consent at any time with effect for the future via the cookie settings (link in the footer of the website).

5.2 Tracking tools used (only with consent)

Google Tag Manager (Google Ireland Ltd., Dublin) for managing tracking codes. Tag Manager itself does not process any personal data.

Google Analytics 4 (Google Ireland Ltd., Dublin) for audience measurement. Google Analytics 4 does not store complete IP addresses. Data transfer to the USA possible, legal basis: EU-US Data Privacy Framework.

Meta Pixel (Meta Platforms Ireland Ltd., Dublin) for measuring the success of advertisements; loaded exclusively with consent. Data transfer to the USA possible, legal basis: EU-US Data Privacy Framework + Standard Contractual Clauses.

Legal basis for the tracking tools: Art. 6(1)(a) GDPR (consent via the cookie banner). You can withdraw your consent at any time via the cookie settings.

5.3 Cookies and browser storage in detail

  • fs-cc (ioumi, cookie banner): stores your selection in the cookie banner. Strictly necessary. Storage period: 180 days.
  • _ga (Google Analytics 4): distinguishes visitors. Only with consent (Analytics). Storage period: 2 years.
  • _ga_<ID> (Google Analytics 4): stores the session state. Only with consent (Analytics). Storage period: 2 years.
  • _fbp (Meta Pixel): attributes visits to advertisements. Only with consent (Marketing). Storage period: 90 days.
  • _fbc (Meta Pixel): stores the click identifier if you come via a Meta ad. Only with consent (Marketing). Storage period: 90 days.
  • wistia and wistia-video-progress-<ID> (Wistia, local storage): playback statistics and resuming a video at the point last watched. Only with consent (Analytics) and only after clicking “Play”. Storage period: until you clear the website data in your browser.
  • utm_params_storage and ioumi_erstkontakt (ioumi, local storage): source of a request, see Section 4.6. Storage period: 30 days.

‍

Part 2: Platform (app.ioumi.com)

6. Hosting of the platform

The ioumi platform (app.ioumi.com, api.ioumi.com, pay.ioumi.com, files.ioumi.com) is operated exclusively in EU data centers.

Platform provider:
Ploi Cloud B.V., Amperestraat 16J, 3861HB Nijkerk, Netherlands
KvK: 97693731

Sub-processors (infrastructure):

  • Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France (cloud infrastructure, container registry)
  • UpCloud Ltd, Aleksanterinkatu 15 B, 00100 Helsinki, Finland (cloud infrastructure)

All platform data (database, file storage, cache, workers, backups) is stored in EU data centers. In the course of hosting, platform data is not transferred to third countries.

A data processing agreement is in place with Ploi Cloud B.V.

‍

7. Seller data

When you register as a seller on ioumi, we process the following data:

7.1 Account and master data

  • first and last name, company name, trading name if applicable
  • address, VAT ID, commercial register number
  • email address, phone number
  • login data (email, password hash, optional 2FA)
  • stored bank details
  • terms and conditions URL and other individual platform configurations
  • logo and branding elements

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

7.2 KYC data at the external payment service provider

As part of onboarding with the external payment service provider (Stripe), additional identification and company data is processed. You enter this data directly at Stripe. ioumi only receives the status of the KYC process from Stripe, not the detailed data.

7.3 Usage and communication data

  • login times, IP addresses at login
  • activities on the platform (contracts, invoices, payments created)
  • support communication with ioumi
  • email correspondence in the course of the business relationship

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR. Our legitimate interest lies in the security of the platform, the detection and prevention of misuse and unauthorized access, and the documentation of our communication with you.

7.4 Billing data

  • booked pricing plan
  • invoices for monthly base fees and transaction fees
  • payment status

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (retention obligations under tax law pursuant to § 132 of the Federal Fiscal Code (Bundesabgabenordnung, BAO)).

‍

8. End customer data (processing on behalf)

When our sellers use the platform, we process personal data of their end customers exclusively on behalf of the seller as a processor pursuant to Art. 28 GDPR.

8.1 Categories of data processed

  • master and contact data (name, address, email, phone, company, VAT ID)
  • contract data (contract contents, services, payment plans)
  • payment data (status, amounts, Stripe payment IDs, no complete card data)
  • signature and audit trail data (see § 9)
  • customer portal usage data (login times, IP addresses)
  • email communication (sending contracts, reminders, payment confirmations)

8.2 Responsibility

The controller for this data processing is the respective seller. The seller is responsible for the lawfulness of the data collection, informing the end customers and responding to data subject rights requests.

ioumi processes this data exclusively in accordance with the seller's documented instructions (which are generally given through the use of the platform functions) and on the basis of the data processing agreement between ioumi and the seller.

8.3 Access and erasure requests from end customers

End customers who wish to exercise their rights under the GDPR (access, rectification, erasure, data portability, objection) should contact the seller directly as the controller. ioumi supports the seller in responding to such requests.

‍

9. Electronic signature and audit trail

When a contract is signed via the platform, we log the following data to preserve its evidentiary value:

  • IP address of the end customer
  • timestamp (date and time accurate to the second)
  • user agent (browser and operating system)
  • hash value of the signed contract document
  • version of the accepted documents (contract, the seller's terms and conditions, ioumi terms and conditions, ioumi privacy policy)
  • email address to which the contract was sent
  • the drawn or typed signature

Purpose: Proof of the authenticity and integrity of the electronic signature, performance of the contract.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in securing evidence).

Storage period: Seven years after conclusion of the contract pursuant to § 132 BAO. The controller for this processing is the seller; ioumi acts as processor.

‍

10. Customer portal and magic link authentication

End customers access the customer portal via so-called magic links. In doing so, we process:

  • email address of the end customer
  • time of the magic link request and use
  • IP address at request and login
  • session cookies (strictly necessary, no tracking)

Magic links are valid only once and for a limited period of time. Authentication takes place without a password.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract on behalf of the seller).

‍

11. Sending emails

For sending transactional emails (sending contracts, signature reminders, payment and invoice confirmations, magic links), we use:

Sendinblue SAS / Brevo, 106 boulevard Haussmann, 75008 Paris, France

Brevo processes the data required for sending (email addresses, email contents) as a processor. Processing generally takes place in the EU; for technical reasons, data may be transferred to sub-processors based in the USA. Legal basis for possible third country transfers: Standard Contractual Clauses.

Emails to end customers are sent from the sender address no-reply@ioumi.com with the name of the respective seller as the sender name. The support address stored by the seller is used as the reply-to address.

‍

12. Payment processing

All payments on the platform are processed via the external payment service provider:

Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland

Data transmitted in the course of payment processing:

  • end customer payment data (card information, SEPA data): collected directly from the end customer in Stripe Checkout and does not enter our systems
  • transaction data (amount, currency, status, timestamp)
  • seller KYC data: collected directly from the seller

Allocation of roles:

  • For card data tokenization, Stripe acts as processor.
  • With regard to statutory anti-money laundering and KYC obligations as well as fraud prevention, Stripe is an independent controller.

Third country transfer: Stripe may transfer data to its parent company Stripe Inc. in the USA. Legal basis: EU-US Data Privacy Framework (Stripe is DPF certified) and supplementary Standard Contractual Clauses.

Stripe privacy policy: https://stripe.com/de/privacy

‍

13. Further sub-processors

To provide the platform services, we use the following further processors:

13.1 Communication and support

Intercom R&D Unlimited Company, 124 St. Stephen's Green, Dublin 2, Ireland
Purpose: support communication between the ioumi team and sellers, help center
Data categories: email address, name, communication contents
Third country transfer: possible to the USA (DPF + SCCs)

13.2 Internal work tools

For communication within the ioumi team and for handling data of our sellers and end customers, we use internal tools (in particular Google Workspace, ClickUp, Figma, GitHub, Anthropic Claude). These tools are not integrated into the data flow of the platform's end customer data, but are used exclusively for our internal business activities.

ClickUp (ClickUp Inc., USA) additionally receives an internal notification with the form data in the course of a demo call request via the marketing website (see Section 4.2). Third country transfer: USA (DPF + SCCs).

n8n (automation tool): For forwarding demo call requests to our CRM and to ClickUp, we operate a self hosted n8n instance on a server at Hetzner Online GmbH, Gunzenhausen, Germany. No third country transfer takes place in this context.

13.3 Error monitoring

Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) records technical errors of the platform so that we can fix them quickly. In doing so, technical information about the error, the affected request and the browser is processed. The transfer of personal data such as IP addresses or user identifiers is disabled by default.
Third country transfer: possible to the USA (DPF + SCCs)

‍

14. Third country transfers: summary

Platform processing (hosting, database, backups, file storage) takes place exclusively in the EU. Personal data is transferred to third countries exclusively in the following cases:

Stripe Inc. (via Stripe Payments Europe), USA. Purpose: payment processing. Legal basis: EU-US Data Privacy Framework and Standard Contractual Clauses.

Brevo sub-processors, partly USA. Purpose: sending transactional emails and newsletters. Legal basis: Standard Contractual Clauses.

Calendly LLC, USA. Purpose: scheduling appointments after a demo request. Legal basis: EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses.

Close.com Inc., USA. Purpose: CRM / lead management (demo call requests). Legal basis: EU-US Data Privacy Framework and Standard Contractual Clauses.

ClickUp Inc., USA. Purpose: internal notifications (demo call requests). Legal basis: EU-US Data Privacy Framework and Standard Contractual Clauses.

Wistia Inc., USA. Purpose: video playback on the marketing website (only after clicking “Play”; usage analytics only with consent). Legal basis: EU-US Data Privacy Framework and Standard Contractual Clauses.

IPinfo Inc., USA. Purpose: country detection for the phone field of the demo form. Legal basis: EU-US Data Privacy Framework or Standard Contractual Clauses.

Google Ireland Ltd. (tracking tools, Workspace), EU with US transfer. Purpose: website analytics, internal communication. Legal basis: EU-US Data Privacy Framework.

Meta Platforms Ireland Ltd., EU with US transfer. Purpose: tracking on the marketing website. Legal basis: EU-US Data Privacy Framework and Standard Contractual Clauses.

Functional Software, Inc. (Sentry), USA. Purpose: error monitoring of the platform. Legal basis: EU-US Data Privacy Framework and Standard Contractual Clauses.

Intercom R&D Unlimited Company, Ireland with possible US transfer. Purpose: support communication. Legal basis: EU-US Data Privacy Framework and Standard Contractual Clauses.

‍

15. Storage periods

Seller account data: For the entire term of the contract.

Seller data after account deletion: Soft delete for 7 years pursuant to § 132 BAO, followed by automatic hard deletion.

End customer data: During the seller's active contractual relationship, thereafter 7 years.

Contract documents and signed PDFs: 7 years after conclusion of the contract pursuant to § 132 BAO.

Payment data: 7 years pursuant to § 132 BAO.

Audit trail of the electronic signature: 7 years.

Server logs (app.ioumi.com): 30 days, followed by automatic deletion.

Server logs (ioumi.com): a maximum of 30 days, followed by automatic deletion.

Cookie data of the marketing website: Depending on the cookie, a maximum of 2 years. For details on each cookie, see Section 5.3.

Source data in the browser (Section 4.6): 30 days.

Demo requests and leads: 3 years after the last interaction.

Newsletter subscribers: Until withdrawal, thereafter 3 years of archiving as proof.

Applicant data without consent to the talent pool: 6 months after rejection.

‍

16. Rights of data subjects

Under the GDPR, you have the following rights:

  • Access to the data processed about you (Art. 15 GDPR)
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR)
  • Erasure of your data, unless statutory retention obligations prevent this (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future

Please send requests to: datenschutz@ioumi.com

We handle requests within the statutory period of 30 days.

Note for end customers of our sellers: Since ioumi is merely a processor with regard to end customer data, please first contact the respective seller directly. We support sellers in responding to data subject rights requests.

‍

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. Competent authority in Austria:

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna
https://www.dsb.gv.at/

‍

18. Data security

We use appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect your data against loss, manipulation and unauthorized access, including encrypted transmission (TLS) and role based access controls. Sellers can find the description of the measures in Annex ./2 of the data processing agreement.

‍

19. Changes to this privacy policy

We reserve the right to amend this privacy policy, for example when introducing new functions or tools or in the event of changes in the legal situation. The current version is available at ioumi.com/legal/privacy. In the event of material changes, we will inform active sellers by email.

This privacy policy is also available in English at ioumi.com/en/legal/privacy. The English version is provided for information purposes only. In the event of any discrepancies, the German version shall prevail.