Get your free SEO & GEO audit

Privacy Policy

This is an English translation for your convenience. The legally binding version is the German Datenschutzerklärung.

Last updated: October 2026

This privacy policy informs you, in accordance with Articles 13 and 14 GDPR, which personal data we process when you visit our website northstarmedia.co, contact us, book an appointment, receive emails or our newsletter from us, use our social media presences or are a client of ours.

1. Controller

Stehrer Ventures GmbH (brand: Northstar Media)
Schweidlgasse 36, 1020 Vienna, Austria
Office address: Donau-City-Straße 3, 1220 Vienna, Austria
Commercial register: FN 572030 x, Commercial Court of Vienna
Managing director: Elias Stehrer, BSc (WU)

Email for all data protection matters: office(at)northstarmedia.co

We are not legally required to appoint a data protection officer. Please send your requests directly to the address above.

2. Legal bases at a glance

We only process personal data where one of the following legal bases applies:

  • Consent (Article 6(1)(a) GDPR, and for cookies and similar technologies additionally § 165(3) of the Austrian Telecommunications Act, TKG 2021), for example for analytics, marketing and embedded videos
  • Contract and pre-contractual steps (Article 6(1)(b) GDPR), for example for appointment bookings, proposals and looking after our clients
  • Legal obligation (Article 6(1)(c) GDPR), for example retention duties under Austrian tax and company law (BAO, UGB) and proof of consent given
  • Legitimate interests (Article 6(1)(f) GDPR), for example the secure and stable operation of the website and answering general enquiries

You can withdraw consent at any time with effect for the future, most easily through the cookie settings (cookie icon at the edge of every page) or by email to us. The lawfulness of processing carried out before the withdrawal remains unaffected.

3. Hosting and server log files

Our website and our email mailboxes are hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. The servers are located in the EU. We have a data processing agreement with OVH under Article 28 GDPR.

Each time the website is accessed, the server automatically processes the following data: IP address, date and time of access, URL requested, referrer URL, amount of data transferred, status code, and browser type and operating system (user agent).

Purpose: delivering the website, ensuring stability and IT security, preventing and investigating attacks.
Legal basis: Article 6(1)(f) GDPR.
Retention: log files are stored for a limited period only and then deleted. They are not combined with other data sources.

Fonts: the typeface used on our website (DM Sans) is hosted locally on our own server. Loading it does not establish a connection to Google Fonts or any other third party.

Performance and image optimisation: we use caching and image optimisation (WP Rocket, EWWW Image Optimizer) that run exclusively on our own server and do not transfer visitor data to third parties.

4. Cookies and consent management

We use cookies and comparable technologies (such as local storage and pixels). Technically necessary cookies are used without consent (§ 165(3) TKG 2021, Article 6(1)(f) GDPR). All other cookies and services, in particular analytics, marketing and embedded videos, are only activated after you have given consent through our cookie banner.

Consent management: CookieYes
To obtain and document your consent we use CookieYes, a service of CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. Your choices, a randomly generated consent ID, the time of your decision and your anonymised IP address are processed and stored in the cookie cookieyes-consent (lifetime 1 year).

Legal basis: Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR (duty to demonstrate consent) and Article 6(1)(f) GDPR. An adequacy decision of the European Commission exists for the United Kingdom.

You can change or withdraw your choices at any time through the cookie icon at the edge of the page.

5. Web analytics

5.1 Google Analytics 4

With your consent we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is integrated through the plugin ”Site Kit by Google” and the Google tag.

Data processed: online identifiers (cookie IDs such as _ga, _ga_<ID>, lifetime up to 2 years), truncated IP address, pages visited, time on page, clicks and scrolling behaviour, traffic source, approximate location, device and browser information. Google Analytics 4 does not store IP addresses permanently.

Purpose: measuring reach and improving what we offer.
Legal basis: your consent (Article 6(1)(a) GDPR, § 165(3) TKG 2021).
Retention: user-level and event-level data is deleted automatically after 14 months at the latest.
Google Consent Mode: we use Google Consent Mode in its advanced implementation. As long as you have not given consent, no analytics cookies are set or read and no user profile is created; in that case Google only receives cookieless signals without an identifier (for example that a page view took place), which are used for statistical modelling.
Third-country transfer: processing by Google LLC in the USA is possible. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); standard contractual clauses apply in addition.

Further information: https://policies.google.com/privacy

5.2 Microsoft Clarity

With your consent we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Clarity records how visitors use our website (mouse movements, clicks, scrolling behaviour, pages visited) and creates heatmaps and session recordings from this. Entries in form fields are masked by default. Cookies are set in the process (including _clck, _clsk, CLID, MUID, lifetime up to 1 year) and IP address, device and browser information are processed.

Purpose: analysing and improving usability.
Legal basis: your consent (Article 6(1)(a) GDPR, § 165(3) TKG 2021).
Retention: session recordings generally 30 days, aggregated reports up to 13 months.
Third-country transfer: processing by Microsoft Corporation in the USA is possible. Microsoft is certified under the EU-U.S. Data Privacy Framework.

Further information: https://privacy.microsoft.com/en-gb/privacystatement

6. Online marketing

6.1 Meta Pixel and Conversions API

With your consent we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The pixel records which pages you visit and which actions you take. Through the Conversions API the same events are additionally sent to Meta server-side from our web server. The data processed is: IP address, browser and device information (user agent), URL visited, time, type of event (for example page view) and the cookie identifiers _fbp and _fbc (lifetime 90 days). Meta can link this data to your Facebook or Instagram account if you have one.

Purpose: measuring the effectiveness of our advertising, building audiences (Custom Audiences, Lookalike Audiences) and showing interest-based advertising on Facebook and Instagram.
Legal basis: your consent (Article 6(1)(a) GDPR, § 165(3) TKG 2021).
Joint controllership: for the collection and transmission of the data to Meta, we and Meta are joint controllers under Article 26 GDPR. The agreement can be found at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent processing. You can exercise your rights directly against Meta or against us.
Third-country transfer: processing by Meta Platforms, Inc. in the USA is possible. Meta is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses apply in addition.

Further information: https://www.facebook.com/privacy/policy

6.2 Lead forms on Facebook and Instagram (Lead Ads)

We run adverts with forms directly on Facebook and Instagram. When you complete and submit such a form, Meta passes the data you entered on to us (for example name, email address, phone number, company, website).

Purpose: contacting you about your enquiry and preparing an initial call or potential analysis.
Legal basis: Article 6(1)(b) GDPR (pre-contractual steps at your request).
Retention: see section 12.

7. Embedded videos

7.1 Wistia

Videos on our website are provided through Wistia, a service of Wistia, Inc., 120 Brookline Street, Cambridge, MA 02139, USA. The player is only loaded after you have given consent or actively clicked on the video; before that we only show a locally stored preview image and no connection to Wistia is established. When the player loads, IP address, device and browser information and usage data for the video (such as start and playback duration) are processed; Wistia may set cookies or local storage entries.

Legal basis: your consent (Article 6(1)(a) GDPR, § 165(3) TKG 2021).
Third-country transfer: processing in the USA. Wistia is certified under the EU-U.S. Data Privacy Framework.

Further information: https://wistia.com/privacy

7.2 YouTube

On individual pages we embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A connection to YouTube’s servers is only established after you have given consent or actively clicked on the video; before that we only show a locally stored preview image. YouTube then receives your IP address and the information which page you visited, and may set cookies. If you are logged in to YouTube, the view can be linked to your account.

Legal basis: your consent (Article 6(1)(a) GDPR, § 165(3) TKG 2021).
Third-country transfer: see section 5.1 (Google).

8. Appointment booking and online meetings

For booking initial calls and audits we use Calendly, a service of Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. Calendly manages our calendar and sends the booking confirmation, calendar invitation and reminders.

Booking window on our website: when you click one of our appointment buttons, a window of our own website opens. Our server retrieves the free slots from Calendly; your browser does not connect to Calendly and Calendly does not set any cookies. Your entries are sent to our server and passed on from there to Calendly once you book the appointment. As soon as you have entered your name and email address, we store your details, even before you click ”Continue”, so that we can get in touch with you once personally if you do not finish the booking; later entries and changes add to them. After a booking, our website reports only the fact of the booking to Google Analytics (section 5.1) and Meta (section 6.1), in each case only with your consent, not your entries.

Calendar directly on Calendly: if you book through a Calendly link (for example from an email) or the Calendly calendar opens as a fallback, Calendly sets its own cookies, including for measuring the booking (Google Analytics, Meta). If you have consented to statistics and marketing in our cookie banner, this consent also applies to Calendly and Calendly does not ask again (Article 6(1)(a) GDPR, § 165(3) TKG 2021). Otherwise you decide in Calendly’s own cookie notice.

Data processed: name, email address, chosen appointment, time zone and your details on website, WhatsApp-enabled phone number, your goals, your available budget and your decision-making authority; also the page on which you booked and, if you have consented to statistics, the source through which you first came to us.
Purpose: arranging, preparing and holding the meeting; if a booking is not completed, a single personal follow-up.
Legal basis: Article 6(1)(b) GDPR (pre-contractual steps); for the follow-up after an unfinished booking, Article 6(1)(f) GDPR (interest in completing an enquiry that has been started).
Retention: our website system deletes enquiries that did not lead to a booking automatically after 180 days; otherwise section 12 applies.
Third-country transfer: processing by Calendly in the USA on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses.

SMS reminder: we pass your phone number on to Calendly so that you receive a reminder by SMS before the appointment. Calendly first sends you a text with a link; the reminders only start once you confirm it. Legal basis: Article 6(1)(b) GDPR.

Case studies before the appointment: after your appointment request we send you a few case studies from our work by email so that you can go into the meeting well prepared. Legal basis: Article 6(1)(f) GDPR (interest in showing you our work before the meeting). You can object at any time, using the unsubscribe link in each of these emails or with a short message to office(at)northstarmedia.co. Section 9 explains how we send and measure these emails.

We hold meetings by video conference using Google Meet, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (third-country transfer: see section 5.1). Your name, your email address and video and audio data are processed for the duration of the meeting. Recordings are only made after prior notice and with your consent.

WhatsApp

If you provide a WhatsApp-enabled number when booking or write to us on WhatsApp yourself, we use WhatsApp for follow-up questions about your appointment and your enquiry. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Message content is end-to-end encrypted; however, WhatsApp processes metadata (such as phone number, time and device information) under its own responsibility, including in the USA (certified under the EU-U.S. Data Privacy Framework).

Legal basis: Article 6(1)(b) GDPR (pre-contractual steps at your request). If you prefer not to use WhatsApp, you can reach us by email at any time.

9. Contacting us, emails and newsletter

When you contact us by email, phone or social media, we process your details (name, contact data, content of the message) in order to handle your enquiry.

Legal basis: Article 6(1)(b) GDPR where your enquiry is aimed at a contract, otherwise Article 6(1)(f) GDPR (interest in answering enquiries).
Retention: see section 12.

Newsletter

About every two weeks we send a newsletter with insights from our work. It goes to people who have signed up with us, for example for a potential analysis or a guide, and to people who book an appointment through our website. Clients do not receive it.

Data processed: email address, first name (if provided), time and source of the sign-up, the issues sent, and opens and clicks (see below).
Legal basis: your consent when signing up (Article 6(1)(a) GDPR); after an appointment booking, our legitimate interest in informing you about topics related to your enquiry (Article 6(1)(f) GDPR).
Unsubscribing: at any time using the ”Abmelden” (unsubscribe) link at the end of every issue or with a short message to office(at)northstarmedia.co. Unsubscribing applies to the newsletter and our case-study emails, not to communication about an ongoing enquiry or collaboration.
Retention: until you unsubscribe. After that we keep your email address on a suppression list so that you no longer receive the newsletter (Article 6(1)(c) and (f) GDPR).

Sending and measurement in our emails

We send the newsletter and the emails following an appointment request (section 8) from the address elias@hello.northstarmedia.co via Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor, through its EU region. Resend tells us whether an email was delivered, could not be delivered or was reported as spam; we send no further emails of this kind to such addresses.

Opens and clicks: these emails contain an invisible image that is loaded from our server app.northstarmedia.co when you open the email with images, and links that forward to their destination via our server. This tells us whether and when you opened an email and which link you clicked, and roughly which program or device you used (for example Gmail, Outlook, iPhone). We store this with your email address, but not your IP address, and use it to improve our emails and to get in touch with you personally when you show interest. Links to our website also carry campaign parameters (UTM) so that Google Analytics (section 5.1, only with your consent) can attribute a visit to the email.
Legal basis: Article 6(1)(f) GDPR (interest in improving our emails and responding to interest). You can object at any time with a short message to office(at)northstarmedia.co; you can also prevent the image from loading by not letting your email program load images automatically.
Retention: we delete opens and clicks automatically after 24 months.

10. Clients, prospects and business partners

10.1 Contract handling

We process master and contact data of our clients, prospects and business partners and of their contact persons, contract and billing data, and ongoing project communication.

Purpose: preparing proposals, performing contracts, project management, reporting, invoicing and meeting statutory retention duties.
Legal basis: Article 6(1)(b), (c) and (f) GDPR.

For this we use carefully selected service providers as processors, in particular for:

  • project and task management and sales pipeline management (Atlassian Jira)
  • cloud storage and documents (Google Workspace / Google Drive)
  • internal and project-related communication (Slack)
  • video reports (Loom)
  • bookkeeping, invoicing, tax advice and banking
  • AI-supported assistant and analysis tools that support evaluation, copywriting and reporting

We have agreements under Article 28 GDPR in place with these service providers. Where providers are based in the USA, data is transferred on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses.

10.2 Client dashboard

Clients receive access to our dashboard at app.northstarmedia.co. There we process

  • access data (name, email address, password in encrypted form, login times) and the time at which consent to this privacy policy was given during registration,
  • key figures from the client’s connected accounts (Google Search Console, Google Analytics), monthly reports, completed work, and tasks and their status,
  • answers to the monthly satisfaction survey and appointments booked through the dashboard,
  • referrals: if a client names a person who may be interested in our services, we store that person’s name and contact details and whether we may mention the referring client. We use this information solely to contact the person, and we inform them where their data came from when we do.

The dashboard runs on an OVH server in Frankfurt am Main, Germany. Database and sign-in are provided by Supabase Pte. Ltd. (Singapore) as a processor; the data is stored in the EU region Ireland. We notify clients of new tasks and reports by email; for sending we use Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor. Emails are sent through its EU region, and open and click tracking are switched off.

Monthly reports are embedded as videos from Loom (Loom, Inc., USA, part of the Atlassian group); data is transmitted to Loom when a video is played. Appointments are booked via Calendly, and we answer questions via WhatsApp (see section 8).

Usage analysis: To improve the dashboard, we analyse how it is used. For this purpose we log the areas accessed in our own database and use Google Analytics 4 and Microsoft Clarity (see sections 5.1 and 5.2); Clarity also records sessions. The legal basis is the consent given at registration when setting the password (Article 6(1)(a) GDPR). It can be withdrawn at any time with effect for the future by email to office(at)northstarmedia.co.

Google reviews: We retrieve the public reviews of our Google Business Profile automatically via Apify (Apify Technologies s.r.o., Vodičkova 704/36, 110 00 Prague 1, Czech Republic) in order to match them to client relationships.

Legal bases: for access and service delivery, Article 6(1)(b) GDPR; for referrals and Google reviews, our legitimate interest in maintaining client relationships and acquiring new clients (Article 6(1)(f) GDPR); for usage analysis, Article 6(1)(a) GDPR.

10.3 Processing on behalf of our clients

Where we gain access to personal data from our clients’ systems in the course of our services (for example website back end, analytics and advertising accounts), we act as a processor for our clients on the basis of an agreement under Article 28 GDPR. The respective client remains the controller for this data, and the client’s privacy policy applies.

11. Social media presences

We maintain profiles on Instagram and Facebook (Meta Platforms Ireland Limited), LinkedIn (LinkedIn Ireland Unlimited Company), YouTube (Google Ireland Limited) and TikTok (TikTok Technology Limited, Ireland). On our website these profiles are only linked; no social media plugins are embedded that transfer data when a page is loaded.

When you visit our profiles or interact with us there, the platform operators process your data under their own responsibility, including for advertising and market research purposes and possibly outside the EU. We receive anonymised statistics from the platforms (such as page insights). To that extent we are joint controllers with the respective operator (Article 26 GDPR); the agreement with Meta can be found at https://www.facebook.com/legal/terms/page_controller_addendum, the one with LinkedIn at https://legal.linkedin.com/pages-joint-controller-addendum.

Purpose: communication with prospects and clients, public relations.
Legal basis: Article 6(1)(f) GDPR; for enquiries about our services Article 6(1)(b) GDPR.

You can exercise your rights most effectively directly against the respective platform operator, as only the operator has access to the user data.

12. Retention

We only store personal data for as long as the respective purpose requires:

  • Contract, invoice and bookkeeping data: 7 years (§ 132 BAO, § 212 UGB), and beyond that for as long as it is relevant to pending proceedings
  • Data needed to defend or enforce claims: until the applicable limitation periods expire (generally 3 years, in individual cases up to 30 years)
  • Enquiries, lead and appointment data without a subsequent contract: generally no later than 12 months after the communication has ended, unless statutory duties require otherwise
  • Consents and proof of consent: until withdrawal, and the proof for up to 3 years beyond that
  • Cookies and tracking data: in line with the lifetimes stated for each service
  • Opens and clicks in our emails: 24 months

13. Recipients and transfers to third countries

We only pass your data on to the processors and service providers named in this policy, to authorities, courts, tax and legal advisers where we are obliged to do so or entitled to do so in order to enforce our rights, and to third parties where this is necessary to perform a contract. We do not sell your data.

Some of the service providers named process data in the USA or the United Kingdom. The transfer is based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework for certified US companies; adequacy decision for the United Kingdom) or on standard contractual clauses under Article 46(2)(c) GDPR. We will provide you with a copy of the safeguards on request.

14. Your rights

You have the right at any time to:

  • access the data we process about you (Article 15 GDPR)
  • rectification of inaccurate data (Article 16 GDPR)
  • erasure (Article 17 GDPR)
  • restriction of processing (Article 18 GDPR)
  • data portability (Article 20 GDPR)
  • object to processing based on legitimate interests, and at any time to direct marketing (Article 21 GDPR)
  • withdraw consent given, with effect for the future (Article 7(3) GDPR)

An informal message to office(at)northstarmedia.co is sufficient. We reply within one month.

Right to complain: if you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

15. Provision of data and automated decisions

You can use our website without providing personal data. For appointment bookings, proposals and contracts we need the mandatory details requested in each case; without them we cannot handle the enquiry or the contract. There is no statutory obligation to provide data.

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

16. Security

We take technical and organisational measures in line with Article 32 GDPR, including TLS encryption of the entire website, role-based access restrictions and regular security updates.

17. Changes to this policy

We update this privacy policy whenever our processing activities or the legal situation change. The version published on this page at any given time applies.