Privacy Policy
Effective date: February 19, 2026
You can download the German version here. In the event of any discrepancies between the English and German versions, the provisions of the German version shall prevail.
Introduction, applicability
1.1. This data protection information applies to the processing of personal data in the operations of The 2025 Club, FN 658916w, Dallingerstraße 30a/Top 2, 4060 Leonding, hello@the2025club.com (hereinafter referred to as "The 2025 Club").
1.2. The protection of personal data and compliance with the relevant data protection regulations – currently Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – "GDPR") and the Data Protection Act in its currently valid version ("DSG") as well as the legal acts enacted on the basis thereof – are of the highest priority at The 2025 Club. In accordance with Articles 12 and 13 of the GDPR, this privacy policy provides an overview of what personal data The 2025 Club processes in its operations, for what purposes, and how The 2025 Club ensures the protection of this data.
1.3. This privacy policy can be accessed electronically, printed, downloaded, and stored on a storage medium at https://www.twentyfiveclub.com ("website").
1.4. The terms used in this privacy policy are understood in accordance with the definitions in Article 4 of the GDPR.
Controller, data protection officer
2.1. The controller within the meaning of Art. 4(7) GDPR is The 2025 Club (see point 1.1 for contact details).
2.2. As the requirements of Art. 37 (1) GDPR are not met, in particular as the core activity of The 2025 Club does not consist of carrying out data processing operations which, due to their nature, scope and/or purposes, require extensive regular and systematic monitoring of data subjects, no data protection officer has been appointed at The 2025 Club.
Processing of personal data in general
3.1. The 2025 Club processes (see Art. 4(2) GDPR) personal data of natural persons ("data subjects") in the course of its business only in compliance with the principles set out in Art. 5 et seq. GDPR and only if at least one condition of lawfulness within the meaning of Art. 6 GDPR is met. The purpose and duration of processing are regulated by category in the following points. The 2025 Club does not process any special categories of personal data within the meaning of Art. 9 (1) GDPR.
3.2. If necessary, i.e. if no other condition of lawfulness listed in Art. 6 GDPR applies (or as a precautionary measure in addition to this), The 2025 Club will obtain the consent of the data subjects. If data subjects voluntarily disclose data not requested by The 2025 Club, this data will not be "collected" by The 2025 Club and the data subject thereby gives their express consent to the processing of this data by The 2025 Club, in particular for storage in The 2025 Club's customer and investor lists.
3.3. The 2025 Club will only disclose, transfer, or pass on data to the extent permitted or required by applicable law. The categories of recipients to whom The 2025 Club discloses data are – apart from the category-related recipients listed in point 4 – in particular the processors of The 2025 Club in accordance with Art. 28 GDPR, authorities and courts, and, in the case of debt collection measures, collection agencies and lawyers. Within The 2025 Club, the organizational units and employees receive the data they need to perform their duties.
3.4. No automated decision-making ("profiling") takes place on The 2025 Club's digital services.
Collection of data from data subjects and processing thereof
4.1. Collection and processing of data when expressing interest in offers from The 2025 Club and when contacting The 2025 Club
When expressing interest in offers and services from The 2025 Club and when contacting The 2025 Club, data from interested parties and those making contact is processed on the basis of Art. 6 (1) (b) GDPR (implementation of pre-contractual measures) for the purpose of sending targeted offers and processing inquiries. The following categories of data are processed: access data, contact, correspondence, and communication data (in particular email address, telephone number), as well as employment data (in particular employer). The relevant data is stored for a period of 6 (six) months for the purpose of sending targeted offers and responding to any enquiries and follow-up questions within The 2025 Club, and is then automatically deleted unless a contractual relationship is established with the data subject.
4.2. Collection and processing of data upon conclusion of a contract and during the execution of contractual relationships
In the event of the conclusion of a contract and the subsequent processing and fulfillment of the contract, the following data will be collected from the data subjects and processed on the basis of Art. 6 (1) (b) GDPR for the purpose of fulfilling and processing the contract with the data subject: First and last name, date of birth, billing and delivery address (street, postal code, state), email address, telephone number, order and contract data, billing data, bank, account, and payment data (in particular, name of the bank, IBAN, and BIC), and, if necessary, (additional) identification, correspondence, communication, and (message) content data. The data of the data subjects will be treated confidentially and – insofar as this is necessary for the fulfillment of the contract – passed on to the vicarious agents and/or executing (third-party) companies involved in the processing of the contractual relationship (e.g., cooperation partners, subcontractors, etc. of The 2025 Club). The data will be processed and stored for as long as is necessary for the fulfillment of the contractual relationships (including post-contractual obligations) and for legal reasons (in particular for sales tax purposes).
4.3. Collection and processing of technical data when accessing digital services
When accessing digital services from The 2025 Club, The 2025 Club automatically collects and processes necessary (technical) data (access data and data through the use of cookies) of the data subjects for the purpose of operation, security, and optimization on the basis of the legitimate interests of The 2025 Club in accordance with Art. 6 (1) (f) GDPR and, if necessary, on the basis of consent in accordance with Art. 6 (1) (a) GDPR (see points 7 and 8).
4.4. Processing of data for the purpose of sending a newsletter
If The 2025 Club sends email newsletters, The 2025 Club collects and processes the email addresses of the persons concerned only on the basis of consent in accordance with Art. 6 (1) (a) GDPR, which is obtained via a so-called "double opt-in procedure," and stores the email addresses of the persons concerned until they have unsubscribed or revoked their consent (see section 15.10.).
4.5. Processing of data for the purpose of direct marketing
If The 2025 Club receives the email address of data subjects in connection with the provision of a service, The 2025 Club is entitled, on the basis of its legitimate interest pursuant to Art. 6 (1) (f) GDPR, to send direct marketing by email in the form of information and mailings for its own or similar services (in particular event information), products, and promotional campaigns. Data subjects have the right to object at any time (in particular when receiving emails) to the processing of data concerning them for the purpose of such advertising (see section 15.8.).
Collection of data from third parties
With the exception of automatically collected technical access data in accordance with point 7 and data collected via the website through necessary cookies in accordance with point 8, The 2025 Club does not process any data that is not collected from the data subjects themselves.
Duration of data processing, retention and storage period
6.1. The 2025 Club does not process and store data permanently, but only in accordance with the periods prescribed by the applicable legal provisions, and in any case only for as long as is necessary for the purposes for which the data was collected. The 2025 Club stores data in a form that allows the identification of the data subjects only for as long as is necessary for the purposes for which it is processed.
6.2. If data is processed solely on the basis of consent, this data will be deleted immediately and will no longer be processed if the data subjects withdraw their consent in accordance with Art. 7 (3) GDPR. The same applies in the event of a legitimate objection pursuant to Art. 21 GDPR if data is processed solely on the basis of a legitimate interest pursuant to Art. 6 (1) (f) GDPR.
Collection of access data when accessing digital services
7.1. When you access its digital services (such as, in particular, the website), The 2025 Club automatically collects and processes technical data about each access that is considered personal data or could be used to identify the data subjects or personal data and that is stored in so-called server log files ("access data"). This includes the IP address, unique device identification (in particular device EUI, device ID), type and version of the operating system and browser, file name and path, type of transmission protocol, clickstream data, date and time of access, time spent on the website, bytes transferred, referrer URL (previously visited page), and the requesting provider.
7.2. However, The 2025 Club does not process this access data for the purpose of identifying individuals or determining other personal data, but exclusively for the purpose of operation, needs-based design, adaptation, improvement, maintenance, optimization, and further development of the digital services it operates (including functions, modules, and features), as well as for error detection and correction, to maintain system security, and—if web analysis tools are used—for the purpose of internal statistical evaluation, without drawing any conclusions about the individuals concerned. No profiling takes place in this regard. The access data is deleted after 14 (fourteen) days.
Collection of data when accessing digital services through cookies
8.1. Cookies are files that are stored locally in the cache of the Internet browser of the data subjects when digital services are accessed and which serve in particular to offer additional functions, to make the digital service more user-friendly, effective, and secure by recognizing the accessing Internet browser and storing temporary files, and—if web analysis tools are used—to enable an (anonymized) analysis of usage.
8.2. Cookies that are strictly necessary for the functioning of digital services are used on the basis of the legitimate interests of The 2025 Club pursuant to Art. 6 (1) (f) GDPR for the operation, security, and optimization of the website. Any other cookies are only processed on the basis of consent pursuant to Art. 6 (1) (a) GDPR, which the data subjects can give by actively clicking a tick box after being asked. Individuals have the option to revoke their consent at any time by deactivating and/or deleting cookies in their internet browser settings and specifying how long they are stored and when they are deleted. The procedure for doing so depends on the internet browser used by the individuals concerned. However, not accepting and deactivating cookies may result in certain functions and/or content of the digital services not working or not working as expected.
8.3. Session cookies are stored temporarily for the duration of the person's access and deleted after the browser is closed; permanent cookies remain stored on the person's device until they are removed from their browser.
Google Analytics
9.1. Google Analytics is used on The 2025 Club website on the basis of the legitimate interests of The 2025 Club pursuant to Art. 6 (1) (f) GDPR in the operation and optimization of the website, and additionally on the basis of consent pursuant to Art. 6 (1) (a) GDPR, which can be given by actively clicking a tick box when visiting the website. Google Analytics, a web analytics service provided by Google, LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), uses cookies that enable an analysis of the use of the website. The information generated by cookies about the use of the website is transmitted by Google to a Google server in the USA and stored there. Google Analytics is only used with IP anonymization enabled, i.e., the IP address of individuals is truncated by Google within EU or EEA member states.
9.2. Google uses this information to evaluate the use of the website, to compile reports on website activity for The 2025 Club, and to provide other services related to website activity. Google also uses the transmitted information to provide, support, and improve its services, to develop new services, to measure the effectiveness of certain advertisements, and to protect against fraud and abuse.
9.3. Apart from not giving their consent, data subjects can always disable and/or delete cookies in their internet browser settings and decide how long they are stored and when they are deleted. The procedure for doing so depends on the Internet browser used by the data subjects. In addition, data subjects can prevent the processing of data generated by cookies and related to their use by downloading and installing the browser add-on available at http://tools.google.com/dlpage/gaoptout?hl=de to deactivate Google Analytics.
Google Marketing Services, Remarketing
10.1. If Google marketing or remarketing services (within the Google Ads service) are used on the website, this is only done on the basis of consent in accordance with Art. 6 (1) (a) GDPR, which can be given by actively clicking a tick box when visiting the website. With the remarketing function, The 2025 Club can present advertisements based on the interests of individuals on websites within the Google Display Network (on Google itself, so-called "Google Ads," or on other websites). To do this, the interaction of the persons concerned on the website is analyzed, e.g., which offers the person was interested in, in order to be able to display targeted advertising to this person on other websites even after visiting the website.
10.2. For this purpose, (re)marketing tags (web beacons) may be integrated into the website when it is accessed and Google marketing services are activated after consent has been given. With their help, cookies are set in the internet browser of the data subject, which record the visits. In particular, the following data is recorded in this file: website visits, content in which the person concerned was interested, offers clicked on, technical information about the person's browser and operating system, referring websites, visit time/duration, information about the use of the online offer/interaction with the website, IP address of the person. When the person subsequently visits other websites, they may be shown advertisements tailored to their interests. The data collected in this way is used only to uniquely identify a web browser and is processed pseudonymously within the framework of Google Marketing Services. The information collected by Google Marketing Services about the person concerned is transmitted to Google and stored on Google's servers in the USA (see section 9.1 above).
10.3. The Google Ads service uses what is known as "conversion tracking." If individuals access the website via an ad placed by Google, Google Ads cookies are set on the computer of the individual concerned. These cookies expire after 30 (thirty) days and are not used for personal identification. The information collected using conversion cookies is used to compile statistics for The 2025 Club. If the person concerned visits the website and the cookies have not yet expired, The 2025 Club can recognize that the person concerned clicked on the ad and was redirected to the website. The 2025 Club thus learns the total number of people who clicked on its ad and were redirected to its website. However, it does not receive any information that could be used to personally identify the individuals concerned.
10.4. Apart from not giving their consent, individuals can deactivate personalized advertising by Google Marketing Services at any time in their internet browser settings. Alternatively, they can download and install a browser plug-in at the following link to deactivate personalized advertising: https://www.google.com/settings/ads/plugin.
Integration of third-party services and content, social plugins
11.1. Third-party plugins are also used on the website to integrate their content and services (such as videos). However, such plugins are only called up on the basis of consent in accordance with Art. 6 (1) (a) GDPR. If individuals consent to the use of such plugins, a connection to the third-party providers' servers is established and the corresponding plugin is called up. The content of the plugins is transmitted directly from the respective third-party provider to the browser of the person concerned. By calling up the plugins, the third-party providers receive the information that the browser of the person concerned has called up the website of The 2025 Club, even if they are not registered with the third-party provider in question or are not currently logged in. The plugin transmits log data to the respective servers of the third-party providers. This log data contains the following information: IP address, the address of the website visited, which also contains plugin functions, type and settings of the browser, date and time of the request, how the plugin is used, and cookies.
11.2. The data is processed by the third-party providers in accordance with their respective data protection regulations. As the operator of the website, The 2025 Club has no knowledge of the content of the data transmitted to third-party providers or how it is processed. Third-party providers may use so-called pixel tags (invisible graphics or "web beacons") for statistical or marketing purposes. In addition, pseudonymous information may be stored in cookies on the device of the persons concerned and may include technical information about the browser and operating system, referring websites, visit time, and other information about the use of the website, and may be linked to such information from other sources.
11.3. If the data subject is registered with the third-party providers and logged into the third-party providers' user accounts, the third-party provider can personally assign the user behavior of this person. The data subject can prevent this by logging out of their user account beforehand. If the person is not a member of the third-party provider, the third-party provider can still obtain and store certain data (see point 12.1.).
11.4. Apart from not giving their consent, individuals can completely prevent the plugins from loading by using add-ons for their browser, e.g., the script blocker "NoScript" (http://noscript.net/). Furthermore, we would like to point out once again that it is possible to deactivate cookies (see section 8.2.).
11.5. The following table provides an overview of the third-party services used:
- Videos from the third-party provider Google's "YouTube" website;
- Social plugins from the third-party provider Facebook;
- Social plugins from the "X" service of the third-party provider X, Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (privacy policy: https://twitter.com/de/privacy);
- Social plugins from the "Instagram" service provided by third-party provider Instagram, Inc, 1601 Willow Road, Menlo Park, CA, 94025, USA (privacy policy: http://instagram.com/about/legal/privacy);
- Social plugins from the social network "Pinterest" provided by third-party provider Pinterest, Inc, 635 High Street, Palo Alto, CA, 94301, USA (privacy policy: https://about.pinterest.com/de/privacy-policy).
Data processing on behalf of The 2025 Club
12.1. If data is processed on behalf of The 2025 Club, it only works with processors within the meaning of Art. 4(8) GDPR who provide sufficient guarantees that appropriate technical and organizational measures are implemented in such a manner that the processing complies with existing legal provisions and the protection of individuals' rights is ensured. To this end, The 2025 Club concludes appropriate contracts with its processors that comply with the requirements of Art. 28 GDPR and observes Art. 44 ff GDPR for processors based in third countries.
12.2. The 2025 Club's processors are currently:
- Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, The Netherlands (programming, IT/computer support)
- Corporate Headquarters, 100 S. Mill Ave Suite 1600, Tempe, AZ 85281 USA (hosting and web space provider)
- South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (software)
Data processing security
The 2025 Club takes appropriate and suitable technical and organizational measures to ensure the security of data and data processing in accordance with the criteria set out in Article 32 of the GDPR and ensures that the data is protected against unauthorized or unlawful processing and against loss, damage, and alteration.
Rights of data subjects
14.1. The 2025 Club protects the rights of data subjects in accordance with the applicable legal provisions. Under current law, data subjects are entitled to the rights listed below (in abstract terms). Data subjects can assert their rights by sending a specific request – preferably in writing (e.g., letter or email) – to The 2025 Club (see section 1.1 for contact details). If the applicable legal provisions stipulate deadlines for responding to the request, The 2025 Club will comply with these.
14.2. Right to confidentiality
The 2025 Club protects the fundamental right of data subjects to data protection in accordance with Section 1 (1) of the Austrian Data Protection Act (DSG) and the right to data secrecy in accordance with Section 6 of the DSG.
14.3. Right to access and information
Under the conditions and in accordance with Articles 13 to 15 of the GDPR, data subjects have the right to access and information about the processing of their data by The 2025 Club and about their rights.
14.4. Right to rectification and completion
Under the conditions and in accordance with Art. 16 GDPR, data subjects have the right to rectify inaccurate data and complete incomplete data concerning them.
14.5. Right to erasure
Under the conditions and in accordance with Art. 17 GDPR, data subjects have the right to request the immediate erasure of data concerning them.
14.6. Right to restriction of processing
Under the conditions and in accordance with Art. 18 GDPR, data subjects have the right to request the restriction of the processing of their data.
14.7. Right to data portability
Under the conditions and in accordance with Art. 20 GDPR, data subjects have the right to to receive data concerning them that they have provided to The 2025 Club in a structured, commonly used, and machine-readable format and to transmit this data to another controller or to request The 2025 Club to transmit the data it processes directly to another controller, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.
14.8. Right to object
Under the conditions and in accordance with Art. 21 GDPR, data subjects have the right to object at any time, on grounds relating to their particular situation, to the processing of data concerning them which is carried out on the basis of Art. 6(1)(e) or (f) GDPR. In the event of a justified objection, The 2025 Club will no longer process the data of these persons affected by the objection, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subjects, or the processing serves to assert, exercise, or defend legal claims. If the persons object to processing for direct marketing purposes, their data will no longer be processed for these purposes.
14.9. Right not to be subject to an automated decision
Under the conditions and in accordance with Art. 22 GDPR, data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
14.10. Right of withdrawal
Pursuant to Art. 7(3) GDPR, data subjects have the right to withdraw their consent to the processing of data concerning them at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until withdrawal.
14.11. Right to lodge a complaint
Pursuant to Art. 77 GDPR in conjunction with § 24 DSG, data subjects have the right to lodge a complaint with the competent supervisory authority (data protection authority), without prejudice to any other administrative or judicial remedy.
14.12. Right to judicial remedy
Pursuant to Art. 79 GDPR in conjunction with § 27 DSG, data subjects have the right to an effective judicial remedy against a legally binding decision of the supervisory authority concerning them (right to appeal to the Federal Administrative Court), without prejudice to any other administrative or extrajudicial remedy.
Contact Information
The 2025 Club e.U.
Mag. Silvia Wurzer
Dallingerstraße 30a, 4060 Leonding, Austria
hello@the2025club.com