Privacy Policy

Data controller

Marija Kostovski is the controller for information submitted through the registration form.

Information collected

When you register interest, the form collects these fields: Name, Company, Email, Country of origin, Product category, Target EU countries and Message.

The registration record is stored in the service-intake system. A notification is sent to the EU Gateway company inbox so the enquiry can be answered.

Purpose and lawful basis

Submitted form data is used only to reply to enquiries, including the early-access registration and requested free market-entry review. The lawful basis is Article 6(1)(b) GDPR: taking steps at your request before a possible contract. Registering interest does not book or confirm a paid service.

To prevent repeated submissions, the intake system also stores a one-way hash derived from the submitted email address and uses it for a limit of five registrations per address in a 15-minute window. This hash is not used to contact you or build a profile. The lawful basis for this limited security processing is Article 6(1)(f) GDPR: the legitimate interest in protecting the registration form from repeated or abusive submissions.

The form fields are required to submit a registration. If you do not provide them, the form cannot be submitted and we cannot respond to that registration. No automated decision-making or profiling is used for these form submissions.

Recipients and transfers

Access is limited to Marija Kostovski and authorized administrators who handle enquiries. Website, database and email-delivery providers process information as needed to host the form, store registrations and deliver the notification to the company inbox. Information may also be disclosed where the law requires it.

If a service provider processes information outside the European Economic Area, the transfer must use an applicable GDPR transfer mechanism, such as an adequacy decision or appropriate safeguards.

How long information is kept

There is no fixed automatic deletion period in the registration system. Information is kept while it is needed to handle and follow up on the enquiry. Once the enquiry no longer needs a response, it is reviewed for deletion; it may be kept longer where needed to meet a legal obligation or establish, exercise or defend legal claims.

The rate-limit table has no automatic cleanup in the current system. An email-derived hash can remain there after its 15-minute counter window until a later submission from that address updates it. No fixed deletion interval is configured for these records.

Your rights

Subject to the conditions in the GDPR, you may request access to your information, correction of inaccurate information, erasure, restriction of processing and, where the requirements apply, data portability or objection. To make a request, contact the controller using the details above. We will respond within the period required by the GDPR.

You may also complain to the Austrian Data Protection Authority (Datenschutzbehörde, DSB), the supervisory authority in Austria. Information on lodging a complaint.