DIVU is an analytics and technology firm operating from Austria and Canada. Most of our work involves aggregated, de-identified operational data supplied by client companies under written engagement agreements. This policy covers the far smaller set of personal data we process, typically the names, emails and job titles of people we meet in the course of that work. It applies to both divu.tech and divu.ca.
01 Data controller
The controller for the personal data described here is DIVU GmbH (Graz, AT) or DIVU Canada Ltd. (Calgary, CA), depending on which entity you contracted with or contacted. Reach either office by email: office@divu.tech or office@divu.ca.
02 What we collect
Directly from you
- Identity and contact data (name, work email, role, employer) when you book a session, subscribe to our writing, or contact us.
- Content of the messages you send us.
- Meeting notes and agenda items you provide ahead of a working session.
From your employer, under engagement
- User accounts in systems you grant us access to (ERP, CRM, BI stack), scoped to named engagement members.
- Workshop attendance, role descriptions, and the data-personality tool answers you choose to submit.
Automatically
- Standard server logs (IP address, user agent, request time) retained for 30 days for security.
- First-party analytics: see Cookies & analytics.
03 Purpose & legal basis
We process personal data on one of the following legal bases under Art. 6(1) GDPR:
- Contract (b), to deliver an engagement you or your employer has commissioned.
- Legitimate interest (f), to reply to inbound enquiries and to keep our own systems secure.
- Consent (a), for optional things like the newsletter or the data-personality tool.
- Legal obligation (c), to retain accounting records as required by Austrian and Canadian law.
04 Sharing & processors
We do not sell personal data. We use a small set of vetted processors to run the business, each under a DPA and EU-standard contractual clauses where applicable.
- Email & calendar: Microsoft 365 (EU region).
- Form delivery: Resend (US), used to deliver the messages you send through the contact and newsletter forms to our own inbox.
- Document hosting: Microsoft (EU and CA regions).
- Site analytics & hosting: Vercel and Google Analytics, each under SCCs where applicable.
- Accounting: BMD (Steyr, AT) for the Austrian entity; QuickBooks for the Canadian entity.
Client operational data ingested during an engagement stays inside your environment or in an isolated DIVU workspace provisioned for you. It is never shared across clients.
05 Retention
- Inbound enquiries we do not act on, 12 months, then deleted.
- Engagement records, 7 years (AT accounting law) or 6 years (Canada Revenue Agency), whichever applies.
- Server logs, 30 days.
- Newsletter list, until you unsubscribe.
- Data-personality tool answers, anonymized on submission; no personal linkage retained.
06 Your rights
Under GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. Canadian residents have equivalent rights under PIPEDA and Alberta's PIPA.
Write to office@divu.tech or office@divu.ca. We reply within 30 days. If you feel we have not handled a request well, you may lodge a complaint with the Austrian Datenschutzbehörde (dsb.gv.at) for EU matters, or the Office of the Information and Privacy Commissioner of Alberta for Canadian matters.
07 Cookies & analytics
This site uses a cookie consent banner. Site measurement (Google Analytics) loads only after you accept analytics cookies. Strictly necessary cookies required for the site to function are set without consent. You can withdraw or change your cookie preferences at any time using the Cookie preferences link in the site footer.
Spam protection (Google reCAPTCHA v3).
Our contact form is protected by Google reCAPTCHA v3. When you load a page
containing the form, Google sets a _GRECAPTCHA cookie and
receives technical signals (IP address, user agent, mouse and keyboard
patterns, referring URL) which it uses to compute a risk score. We use
that score solely to filter automated abuse; we do not use it for
profiling or advertising. We treat reCAPTCHA as a strictly necessary
security measure under Art. 6(1)(f) GDPR (legitimate interest in
protecting our infrastructure). Google's processing is governed by the
Google Privacy Policy
and
Google Terms of Service.
08 International transfers
Most data stays inside the EU or Canada. Where a processor is established in a third country (for example, Google Analytics or Vercel in the US), transfers rely on the EU Standard Contractual Clauses (2021/914) plus the supplementary measures recommended by the EDPB, and on adequate-safeguards equivalents under Canadian law.
09 Contact us
Questions, requests, or a worry: office@divu.tech or office@divu.ca. See the Imprint for full company details.