Privacy Policy

This English version is a courtesy translation. In case of any discrepancies, the German version shall prevail.

Last updated: June 2025

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

Data collection on this website

Who is responsible for data collection?

Data is processed by the website operator. You can find the contact details in the "Controller" section.

How do we collect your data?

Some of your data is collected when you provide it to us (e.g. contact form). Other data is collected automatically or with your consent when you visit the website (e.g. technical data such as browser, IP address).

What do we use your data for?

Some of the data is collected to ensure the website is provided without errors. Other data is used to analyze your user behavior and optimize our services.

Analytics tools and third-party tools

When you visit this website, your browsing behavior may be statistically analyzed. This is done mainly with cookies and analytics programs. The analysis is usually anonymous. You can object to this analysis via our cookie banner.

2. Controller

Brainwave Entertainment GmbH

Starhembergstraße 7

4020 Linz, Austria

Email: ticket system

Website: www.brainwave3d.com

Company details:

  • VAT ID no.: ATU 66866812
  • Tax number: DVR 46 185/6221
  • Company register number: FN 372708 a
  • Management: Marko Christopher Lorenz, Steven Mendicino, Fabian Meisinger

3. General information and mandatory information

Data protection

Protecting your personal data is particularly important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, Digital Services Act, Austrian data protection law).

Note on data transfers to third countries

Our website uses tools from companies based in the USA or other third countries. When these are actively used, your data may be transferred to these third countries. Wherever possible, we use providers certified under the EU-US Data Privacy Framework.

Withdrawal of your consent

You can withdraw consent you have already given at any time. The lawfulness of data processing carried out before the withdrawal remains unaffected.

Right to object to data collection

If data processing is based on Art. 6 (1) (f) GDPR (legitimate interests), you have the right to object at any time. After your objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds (Art. 21 GDPR).

Right to lodge a complaint

In the event of violations of the GDPR, you can lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority (Datenschutzbehörde)

Barichgasse 40-42, 1030 Vienna

Phone: +43 1 52 152-0

Email: dsb@dsb.gv.at

Your rights

You have the following rights:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)

4. Data collection on this website

Server log files

When you visit the website, our provider automatically collects:

  • Browser type and version
  • Operating system
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address

Legal basis: Art. 6 (1) (f) GDPR (legitimate interests)

Storage period: 7 days

Contact form and email

If you contact us, we store your details in order to process your inquiry.

Data collected:

  • Name, email address
  • Message content
  • Time of the inquiry

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures)

Storage period: 6 months after the inquiry has been fully processed

Email marketing via Klaviyo
We use Klaviyo Inc. as a service provider for our email marketing. With your express consent, we process and send personal data (e.g. email address) via Klaviyo in accordance with its Privacy Notice (as of May 15, 2025).

We use Klaviyo to carry out our email and optional SMS marketing. With your consent, data (email, phone number if applicable) is transferred to Klaviyo and processed there in accordance with its Privacy Notice. You can unsubscribe from further communication or object to its use at any time. (Derived from Klaviyo's data protection guide)

Registration and user account

When you register, we collect:

  • Email address
  • Username
  • Password (encrypted)
  • Purchase history and preferences

Legal basis: Art. 6 (1) (b) GDPR (performance of contract)

Storage period: Until the account is deleted

A. Shopify integration
We use Shopify to process orders, payments and customer data. Shopify acts as a data processor on our behalf. Your information (e.g. name, address, payment details) is stored securely
and used only to fulfil the purchase contract. For more information, please refer to Shopify's privacy policy.

(Based on Shopify terms of service & privacy policies)

Cookies

Our website uses cookies. These are small text files that are stored on your device.

Cookie categories:

  • Necessary cookies: For the basic functions of the website
  • Analytics cookies: To improve the website
  • Marketing cookies: For personalized advertising

You can adjust your cookie settings at any time via our cookie banner.

5. Group of companies and data processing

Brainwave group of companies

Brainwave Entertainment GmbH belongs to the Brainwave group of companies together with its subsidiary Brainwave3D Technology GmbH.

Business areas:

  • Brainwave Entertainment GmbH: Research, development, online shop
  • Brainwave3D Technology GmbH: App development and operation

Data sharing within the group
To provide our services and ensure consistent customer support, data may be shared between Brainwave Entertainment GmbH (responsible for the shop) and Brainwave3D Technology GmbH (responsible for the app). This applies in particular to personal data such as name, email address, order information and app usage data. Data is shared exclusively for the performance of contracts, customer service and the technical implementation of the services offered.

Data processing within the group

To ensure smooth integration of our services, we share customer data between the companies:

  • A single customer account for shop and app
  • Synchronization of purchased content
  • Shared customer service

Legal basis: Art. 6 (1) (b) GDPR (performance of contract) and Art. 6 (1) (f) GDPR (legitimate interests)

6. Online shop and e-commerce

Contract processing

Data collected when you order:

  • Name and address
  • Email address
  • Phone number (optional)
  • Payment details
  • Order history

Legal basis: Art. 6 (1) (b) GDPR (performance of contract)

Storage period:

  • Contract data: 7 years (retention under tax law)
  • Product liability: 10 years (name, address, goods purchased)

Data disclosure:

  • Payment service providers (for payment processing)
  • Tax advisor (to meet tax obligations)

Special case: digital content

Important note: When you buy digital frequency downloads, your right of withdrawal expires when the download begins, pursuant to § 356 (5) BGB. You can find detailed information in our withdrawal information.

Payment service providers

Stripe

Stripe Payments Europe Ltd., Dublin, Ireland

Privacy: https://stripe.com/privacy

PayPal

PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg

Privacy: https://www.paypal.com/privacy

Mobile payments

  • Apple In-App Purchase: Apple's privacy policy applies
  • Google Play Store: Google's privacy policy applies

7. Analytics tools and advertising

Google Analytics 4

This website uses Google Analytics 4 (Google Ireland Limited, Dublin).

Data collected:

  • Page views and time spent on the page
  • Device and browser information
  • Anonymized IP address
  • Demographic characteristics (optional)

Legal basis: Art. 6 (1) (a) GDPR (consent via cookie banner)

Data transfer: EU-US Data Privacy Framework

Storage period: 14 months

Opt-out: Disable Google Analytics

Google Ads & conversion tracking

We use Google Ads with conversion tracking for advertising purposes.

Legal basis: Art. 6 (1) (a) GDPR (consent)

Cookie lifetime: 30 days

Facebook Pixel (Meta Pixel)

We use the Meta Pixel to optimize Facebook ads.

Provider: Meta Platforms Ireland Limited, Dublin

Legal basis: Art. 6 (1) (a) GDPR (consent)

Data transfer: EU-US Data Privacy Framework

Opt-out: Facebook ad preferences

Meta Conversions API

When you sign up for an email through one of our self-tests (wiederschlafen.com, getmysleepback.com), our server also reports this sign-up directly to Meta so we can measure which ad led to it.

Data transferred: email address only as a hash (SHA-256, not reversible), time, page visited (without test answers or results), ad click ID (fbclid), IP address and browser identifier.

Recipient: Meta Platforms Ireland Limited, Dublin. Data transfer: EU-US Data Privacy Framework.

Retention: hash and IDs at most 90 days on our side, at Meta according to its policies.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in measuring our advertising).

Google Ads: conversion measurement via upload

For sign-ups through our self-tests we send Google the sign-up with the ad click ID (gclid, gbraid, wbraid) and the email address only as a hash (SHA-256) to measure the success of our ads. IP address and browser identifier are not sent to Google.

Recipient: Google Ireland Limited, Dublin. Data transfer: EU-US Data Privacy Framework.

Retention: at most 90 days on our side, at Google according to its policies.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in measuring our advertising).

Click IDs

If you reach us through an ad, your browser stores the ad click ID (fbclid, gclid, gbraid, wbraid) locally for up to 30 days so that a later sign-up can be attributed to the ad.

Meta Pixel and Google tag on our self-tests

On our self-test pages (wiederschlafen.com, getmysleepback.com) we use the Meta Pixel (Meta Platforms Ireland Limited, Dublin) and the Google Ads tag (Google Ireland Limited, Dublin) to measure which ad led to a visit, to starting or completing the test and to a sign-up. Cookies are set for this (_fbp, _gcl_au, lifetime up to 90 days).

Data transferred: page view on the home page, topic pages and the test page, the events "test started" and "test completed", time, IP address and browser identifier. Test answers, results and result pages are never transferred.

Data transfer: EU-US Data Privacy Framework.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in measuring our advertising).

Objection: You can object at any time by blocking third-party cookies in your browser or by writing to us (contact see section 15). Ad preferences: Meta (facebook.com/adpreferences), Google (adssettings.google.com).

Hotjar

We use Hotjar (Hotjar Ltd., Malta) for heatmaps and session recordings.

Data collected:

  • Mouse movements and clicks
  • Screen size and device type
  • Anonymized IP address

Legal basis: Art. 6 (1) (a) GDPR (consent)

Opt-out: Disable Hotjar

8. Newsletter

GetResponse

We use GetResponse (GetResponse Sp. z o.o., Gdansk, Poland) for our newsletter.

Sign-up process: Double opt-in with confirmation email

Analytics:

  • Open rates
  • Click behavior
  • Conversion tracking

Legal basis: Art. 6 (1) (a) GDPR (consent)

Storage period: Until you unsubscribe

Unsubscribe: Link in the newsletter or via our ticket system

9. Social media

Social media plugins with Shariff

We use the privacy-friendly Shariff solution for social media buttons.

How it works: Data is only transferred after you click the respective button.

Supported platforms:

  • Facebook (Meta Platforms Ireland Limited)
  • Twitter/X (X Corp., San Francisco)
  • Pinterest (Pinterest Inc., San Francisco)

Legal basis: Art. 6 (1) (a) GDPR (consent by clicking)

10. Plugins and tools

YouTube

We embed YouTube videos (Google Ireland Limited).

Privacy-enhanced mode: Enabled for better protection

Legal basis: Art. 6 (1) (a) GDPR (consent via cookie banner)

SoundCloud

SoundCloud plugins (SoundCloud Limited, London) are only loaded after activation.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interests)

11. Mobile app

App-specific data processing

Data collected:

  • Device ID and app version
  • Usage statistics
  • Crash reports
  • Push notification token

Legal basis: Art. 6 (1) (b) GDPR (performance of contract)

App store payments

Apple App Store: Apple's privacy policies apply

Google Play Store: Google's privacy policies apply

We do not receive any payment details, only confirmations of successful transactions.

12. Online dispute resolution

The European Commission provides a platform for online dispute resolution:
https://ec.europa.eu/consumers/odr/

Note: We are not obliged to take part in dispute resolution proceedings before consumer arbitration boards.

13. Data security

Technical and organizational measures

  • SSL/TLS encryption for all data transfers
  • Regular security updates and audits
  • Access controls and permission management
  • Backup systems for data availability
  • Staff training on data protection

Note on internet security

Data transmission over the internet may have security gaps. Complete protection against access by third parties is not possible.

14. Changes to this privacy policy

We reserve the right to adapt this privacy policy if our services or the legal situation change. You will always find the current version on this page.

15. Data protection contact

If you have questions about data protection, want to exercise your rights or have a complaint, please contact:

Brainwave Entertainment GmbH
Starhembergstraße 7
4020 Linz, Austria
Email: ticket system

This privacy policy was prepared to the best of our knowledge and belief to meet current legal requirements. It replaces all previous versions.

Last updated: June 2025