Last updated: 12 June 2026
1. Data Controller
Vessel FlexCo
Kranewittergasse 20, 8042 Graz, Austria
Company Register Number: 629078 s
Email: office@vesseldna.com
2. What Data We Collect
Contact form submissions (Typeform)
- Name, email address, organization, role/title
- Audience type (pharma, hospital, clinician)
- Submission timestamp
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) - responding to your inquiry
Program Configurator
- Name, email address, organization, role/title
- Program configuration selections (modules, scope, intensity)
- This data is encoded in shareable URLs (base64) - anyone with the link can see it
- Legal basis: Consent (Art. 6(1)(a) GDPR) - you choose to generate and share the concept
Website analytics (PostHog)
- Pages visited, interaction events, referral source
- Device type, browser, approximate location (country level)
- For visitors who are not logged in, no personal identifiers are linked to analytics data
- For logged-in members, analytics events are linked to a pseudonymous member ID, never to your name or email address
- Analytics only run after you accept the "Analytics" category in our cookie banner
- Legal basis: Consent via cookie banner (Art. 6(1)(a) GDPR)
Ghost membership (if applicable)
- Email address for newsletter/blog subscriptions
- Legal basis: Consent (Art. 6(1)(a) GDPR)
3. How We Use Your Data
- To respond to your inquiry and provide program information
- To generate personalized, non-binding program concepts
- To improve our website and services through anonymized analytics
- To send relevant updates if you have subscribed (you can unsubscribe at any time)
We do not:
- Sell your data to third parties
- Use your data for automated decision-making or profiling
- Share personal data with pharmaceutical partners without your explicit consent
4. Third-Party Processors
| Processor | Purpose | Location | Privacy Policy |
|---|---|---|---|
| Typeform S.L. | Contact form hosting | EU (Spain) | typeform.com/privacy |
| PostHog Inc. | Website analytics | EU data residency (eu.posthog.com) | posthog.com/privacy |
| Ghost Foundation | Website hosting & membership | EU (Netherlands); global content delivery via Cloudflare CDN | ghost.org/privacy |
| Stripe Payments Europe Ltd | Payment processing & fraud prevention (membership features) | EU (Ireland) | stripe.com/privacy |
| CookieYes Ltd | Cookie consent management | UK (adequacy decision) | cookieyes.com/privacy |
International transfers: Where a processor or its sub-processors are located outside the European Economic Area, transfers are safeguarded by an adequacy decision of the European Commission, the EU Standard Contractual Clauses, or certification under the EU–US Data Privacy Framework, as set out in each processor's data processing agreement.
5. Cookies
We use cookies for:
- Essential cookies: Required for website functionality (no consent needed)
- Analytics cookies: PostHog - tracks pseudonymized usage patterns (consent required)
You can manage your cookie preferences at any time using the cookie settings button on our website. For details, see our cookie consent banner.
6. Data Retention
- Contact form submissions: Retained until your inquiry is resolved, then deleted within 12 months unless a business relationship is established
- Program configurator data: Stored only in your browser and shareable URLs; Vessel does not retain server-side copies
- Analytics data: Pseudonymized, retained for 12 months
- Newsletter subscriptions: Until you unsubscribe
7. Your Rights (GDPR)
Under the General Data Protection Regulation, you have the right to:
- Access your personal data
- Rectification of inaccurate data
- Erasure ("right to be forgotten")
- Restriction of processing
- Data portability
- Object to processing based on legitimate interest
- Withdraw consent at any time
To exercise any of these rights, contact us at: office@vesseldna.com
8. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Austrian Data Protection Authority:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Vienna, Austria
dsb@dsb.gv.at
www.dsb.gv.at
9. Changes to This Policy
We may update this privacy policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced on this website. Where processing is based on your consent, changes to that processing require your renewed consent; continued use of the website alone does not constitute consent.