Privacy policy

1. Controller

Antonioali OG
Matte1 Brazilian Jiu Jitsu
Morzinplatz 4
1010 Vienna, Austria
FN 520379 p

Email: office@matte-eins.at
Phone: +43 664 456 55 54

2. General information

Protecting your personal data matters to us. We only process your data in accordance with the law (GDPR, the Austrian Data Protection Act and the Austrian Telecommunications Act 2021). This policy explains which data is processed when you visit our website, why, and on what legal basis.

In short: We don’t set any cookies ourselves and don’t track you across websites. For anonymous visitor statistics we use a cookie-free tool from our hosting provider (see section 4). External content from GymDesk (our schedule and booking forms) only loads when you explicitly choose to load it.

3. Hosting by Vercel

Our website is hosted by Vercel. The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

When you visit our website, Vercel processes technically necessary data in server log files, in particular:

• IP address
• Date and time of the request
• Page or file requested
• Referrer URL (the page you came from)
• Browser type, browser version and operating system

This data is needed to deliver the website and to keep it stable and secure (for example, to fend off attacks). The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in providing the website securely and reliably). The data is not combined with other data sources.

Vercel runs a global server network, so data may be transferred to the USA. According to Vercel, it is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses in Vercel’s Data Processing Addendum also apply. Details: vercel.com/legal/privacy-policy

4. Cookies and local storage

Our website itself doesn’t set any cookies and doesn’t use any marketing tools. Cookies can only be set by external GymDesk content – and only after you have actively loaded it (see section 5).

Visitor statistics and page speed (Vercel Web Analytics & Speed Insights)

To understand which pages are used and how fast they load, we use Vercel Web Analytics and Vercel Speed Insights. They record the page visited (without URL parameters), the referring page, approximate country, device type, browser and operating system, plus technical loading times. No cookies are set and nothing is stored on your device. Instead of recognising you, a random value is derived from request data and discarded after 24 hours; IP addresses are not stored. The data is not combined with other data and there is no tracking across websites. Measurement runs through our own domain. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a website that meets visitors’ needs and works properly). vercel.com/docs/analytics/privacy-policy

If you choose “Always allow” for the schedule, we store that choice in your browser’s local storage (entry “matte1-extern-gymdesk”). This is technically necessary so we don’t have to ask you on every visit; no data is sent to us. You can withdraw this choice at any time via the “Privacy settings” link in the footer.

Fonts are loaded directly from our own server – there’s no connection to Google Fonts or any other font provider.

5. Schedule, bookings and memberships via GymDesk

For our class schedule, booking trial classes and regular classes, signing up for the beginners course and drop-ins, and for membership contracts, we use the GymDesk platform provided by Gymdesk Ltd. This content is provided as embedded forms (iframes) or via links to matte1.gymdesk.com.

Only loaded with your consent (two-click solution)

The schedule only appears once you click “Show once” or “Always allow”. Booking forms only load when you click a booking button. Only then does your browser connect to GymDesk and the services it uses. The legal basis is your consent under Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021; for processing bookings and contracts, additionally Art. 6(1)(b) GDPR.

Data processed

When the content loads: IP address, browser and device information. When you book or sign up, additionally:

• Personal details (name, date of birth, gender)
• Contact details (email, phone number, address)
• Payment information
• Training data and class bookings
• Emergency contacts and health information (optional, where relevant for training)

Services used within GymDesk

• Stripe – payment processing and fraud prevention. Provider: Stripe Payments Europe, Ltd., Dublin, Ireland (parent company Stripe, Inc., USA). stripe.com/privacy
• hCaptcha – protects forms against spam and bots. Provider: Intuition Machines, Inc., USA. www.hcaptcha.com/privacy
• jQuery CDN – GymDesk loads the jQuery library from code.jquery.com, which sends your IP address to the operator of that content delivery network.

Cookies set by these services

After the GymDesk content loads, we found the following cookies (as of October 2026):

Data processing agreement, third countries and retention

We have concluded a data processing agreement with Gymdesk Ltd. under Art. 28 GDPR. Where data is transferred to the USA (Stripe, Inc., Intuition Machines, Inc.), this is based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Membership data is kept for the duration of your membership and afterwards in line with statutory retention periods (in particular the 7-year retention period under tax law).

More on how GymDesk processes data: gymdesk.com/page/privacy

Withdrawing consent: you can withdraw your consent at any time using the “Privacy settings” link in the footer. The page then reloads, and GymDesk content is only shown again once you agree again.

6. Contacting us by email or phone

If you contact us by email or phone, we process the details you give us (such as your name, email address, phone number and message) to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We delete the data once it’s no longer needed – at the latest after 6 months, unless statutory retention obligations apply.

7. Social media and maps

Our website links to our Instagram (@matteeins) and Facebook profiles. Our server fetches the preview images of our latest Instagram posts and serves them from our own domain – your browser doesn’t connect to Instagram. Only when you click a link are you taken to Instagram or Facebook, and your IP address is sent to Meta Platforms Ireland Ltd. Meta’s privacy policy applies: privacycenter.instagram.com/policy

For directions we link to Google Maps. No map is embedded on our site; data is only transferred once you open the link. Google’s privacy policy applies: policies.google.com/privacy

8. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR) – to the data we process about you
• Rectification (Art. 16) – of inaccurate or incomplete data
• Erasure (Art. 17) – unless legal obligations or legal claims prevent it
• Restriction of processing (Art. 18)
• Data portability (Art. 20) – in a structured, commonly used, machine-readable format
• Objection (Art. 21) – to processing based on legitimate interests
• Withdrawal of consent (Art. 7 Abs. 3) – at any time, with effect for the future

For any requests, please contact office@matte-eins.at.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority is:
Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna
Phone: +43 1 52 152-0 · Email: dsb@dsb.gv.at · www.dsb.gv.at

9. Data security

Every connection to our website is encrypted with TLS (you’ll see “https://” and the padlock icon in your browser). We use appropriate technical and organisational measures to protect your data against manipulation, loss, destruction and unauthorised access.

10. Updates to this policy

Last updated: October 2026. As our website evolves or legal requirements change, we may need to update this privacy policy. You’ll always find the current version on this page.