Privacy Policy

PRIVACY POLICY

Expand Future GmbH

Last updated: September 2026


1. CONTROLLER

The controller responsible for the processing of personal data described
in this Privacy Policy is:

Expand Future GmbH
Seitenstettengasse 5/37
1010 Vienna
Austria

Email:
hello@expand-future.com

Website:
https://www.expand-future.com


2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy explains how Expand Future GmbH processes personal data
in connection with, among other things:

• our websites and landing pages;
• contact and application forms;
• the Expand Future Opportunity Finder;
• requested Opportunity Briefs and other lead magnets;
• Private Review requests and appointment bookings;
• Systeme.io CRM, email and workflow functionality;
• email communication and optional marketing communications;
• professional programmes and workshops;
• market and opinion research;
• market validation;
• international expansion and market-entry projects;
• business-development activities;
• professional introductions;
• IT, automation and AI implementation projects;
• contractual and pre-contractual relationships;
• professional networking and B2B relationship management.

Our commercial services are primarily B2B.

The GDPR nevertheless applies whenever we process information relating to
an identified or identifiable natural person, including founders, directors,
employees, representatives, professional contacts, research participants,
investors and other individuals.


3. CATEGORIES OF PERSONAL DATA


3.1 CONTACT AND IDENTIFICATION DATA

Depending on your interaction with us, we may process:

• first and last name;
• business email address;
• telephone number;
• job title or professional role;
• company or organisation;
• country or region;
• preferred language;
• professional profile information;
• other information voluntarily supplied by you.


3.2 COMPANY AND BUSINESS INFORMATION

We may process information including:

• company name;
• website;
• industry or sector;
• business model;
• company stage;
• company size;
• target customers;
• products and services;
• current markets;
• planned target markets;
• expansion objectives;
• commercial priorities;
• challenges;
• budget or indicative budget ranges;
• timing;
• funding or capital requirements;
• partnership requirements;
• distribution requirements;
• other professional information relevant to the requested service.


3.3 OPPORTUNITY FINDER DATA

When you use the Expand Future Opportunity Finder or a comparable diagnostic
tool, we may process information such as:

• company type;
• company stage;
• industry;
• customer type;
• current market;
• target region;
• expansion interest;
• timing;
• budget range;
• available resources;
• capital need;
• service interest;
• answers to diagnostic questions;
• surfaced or recommended markets;
• opportunity signals;
• inquiry category;
• language;
• operational lead priority.

This information may be used to generate or prepare your requested
Opportunity Brief.


3.4 ENQUIRIES, APPLICATIONS AND PRIVATE REVIEW REQUESTS

If you contact us or apply for a service or programme, we may process:

• contact information;
• company information;
• requested service;
• inquiry type;
• project information;
• messages and correspondence;
• meeting information;
• submitted documents;
• information voluntarily entered into forms;
• notes relating to professional communication or meetings.


3.5 CAPITAL-RELATED AND BUSINESS OPPORTUNITY INFORMATION

Where an enquiry concerns funding, investors, professional introductions,
partnerships or another commercial opportunity, we may process professional
information including:

• company or project information;
• management information;
• financing requirements;
• indicative transaction amounts;
• company stage;
• geographic scope;
• relevant professional counterparties;
• business documentation;
• professional correspondence;
• timelines.

Such processing does not constitute investment advice or another regulated
financial service.


3.6 MARKET AND OPINION RESEARCH DATA

As part of market and opinion research, market validation or comparable
professional research, data may be obtained through:

• surveys;
• questionnaires;
• interviews;
• qualitative research;
• quantitative research;
• expert interviews;
• customer research;
• stakeholder research;
• market tests;
• desk research;
• publicly available professional sources;
• lawfully supplied client datasets;
• research databases;
• research notes.

Depending on the project, this may include professional opinions,
preferences, experience or commercial assessments relevant to a defined
research question.

Where appropriate and feasible, research outputs may be aggregated,
pseudonymised or anonymised.


3.7 CONTRACTUAL AND BILLING DATA

Where a contractual relationship exists, we may process:

• contracts;
• proposals;
• statements of work;
• services purchased;
• programme participation;
• invoices;
• billing information;
• payment status;
• tax-relevant documentation;
• project documentation;
• contractual correspondence.


3.8 TECHNICAL WEBSITE DATA

When our website is accessed, technical systems may process:

• IP address;
• date and time of access;
• requested URL;
• referrer;
• browser and browser version;
• operating system;
• device information;
• server status and error codes;
• technical logs;
• security-related information.

These data are generally necessary for website delivery, operation,
security and troubleshooting.


4. PURPOSES AND LEGAL BASES


4.1 WEBSITE OPERATION AND SECURITY

Purpose:

• website delivery;
• technical stability;
• security;
• troubleshooting;
• protection against misuse and attacks.

Legal basis:

Article 6(1)(f) GDPR – our legitimate interest in operating a secure and
reliable website.


4.2 ENQUIRIES AND PRE-CONTRACTUAL COMMUNICATION

We process information to:

• answer enquiries;
• evaluate requested services;
• arrange calls;
• assess project fit;
• prepare offers;
• take requested pre-contractual steps.

Legal basis:

Article 6(1)(b) GDPR where processing is necessary in order to take steps
at your request before entering into a contract.

Where Article 6(1)(b) GDPR does not apply, processing may be based on
Article 6(1)(f) GDPR and our legitimate interest in responding to
professional B2B enquiries.


4.3 OPPORTUNITY FINDER AND REQUESTED OPPORTUNITY BRIEF

Where you submit the Opportunity Finder and request an Opportunity Brief,
we process the relevant information in order to:

• receive and evaluate your submission;
• generate or assign relevant result information;
• create or update your CRM record;
• store the relevant Finder fields and operational categories;
• send the specifically requested Opportunity Brief;
• enable a requested next step such as a Private Review.

Receiving the specifically requested Opportunity Brief is separate from
optional marketing consent.

Depending on the circumstances, the legal basis is Article 6(1)(b) GDPR
and/or Article 6(1)(f) GDPR.


4.4 OPTIONAL EMAIL MARKETING

Where you expressly opt in, we may send communications including:

• international-expansion insights;
• market and research insights;
• invitations;
• programme information;
• relevant professional content;
• information concerning our services.

Marketing consent is separate from:

• using the Opportunity Finder;
• receiving the specifically requested Opportunity Brief;
• submitting an enquiry;
• requesting a Private Review.

The marketing checkbox is not preselected.

Legal basis for personal-data processing:

Article 6(1)(a) GDPR.

Electronic marketing communications are additionally sent only in accordance
with the applicable requirements of § 174 Austrian Telecommunications Act
2021 (TKG 2021), including any statutory exceptions that may apply.

You may withdraw consent at any time with effect for the future, including
through the unsubscribe function contained in marketing emails.

Following withdrawal, minimal suppression information may be retained where
necessary to ensure that your opt-out continues to be respected.


4.5 CONTRACTUAL PERFORMANCE

Where a contract exists, we process information necessary to provide the
agreed services, manage the relationship, communicate with the Client,
administer projects and issue invoices.

Legal basis:

Article 6(1)(b) GDPR.


4.6 LEGAL OBLIGATIONS

We may process and retain information where required by:

• tax law;
• accounting law;
• company law;
• regulatory requirements;
• statutory record-keeping duties;
• lawful authority requests.

Legal basis:

Article 6(1)(c) GDPR.


4.7 PROFESSIONAL B2B RELATIONSHIP MANAGEMENT

We may process proportionate publicly available or lawfully obtained
professional information in order to:

• identify potentially relevant professional contacts;
• manage existing professional relationships;
• evaluate possible cooperation;
• document professional introductions;
• maintain professional CRM records;
• organise business-development activities.

Depending on the circumstances, processing may be based on our legitimate
interest under Article 6(1)(f) GDPR.

Reliance on Article 6(1)(f) GDPR does not override separate restrictions
applicable to electronic advertising or direct marketing under the
TKG 2021.


4.8 MARKET AND OPINION RESEARCH

Personal data may be processed for market and opinion research, market
validation and associated analysis.

Depending on the particular research project, processing may be based on:

• Article 6(1)(a) GDPR – consent;
• Article 6(1)(b) GDPR – contractual necessity;
• Article 6(1)(f) GDPR – legitimate interests;
• another applicable legal basis.

The legal role of Expand Future GmbH depends on the specific project.

Where appropriate, Expand Future GmbH may act as controller, processor or,
where legally applicable, joint controller.

Where Expand Future processes personal data on behalf of a Client,
an Article 28 GDPR Data Processing Agreement is concluded where required.

Research processing is kept separate from promotional communication where
required by law.


5. REQUIRED DATA PROCESSING AND OPTIONAL CONSENT

Where a form requires confirmation that the Privacy Policy has been read,
this does not mean that all underlying processing is based on consent.

Processing that is necessary in order to:

• respond to an enquiry;
• provide a specifically requested Opportunity Brief;
• take pre-contractual steps;
• perform a contract;

is processed on the applicable GDPR legal basis.

Optional marketing consent remains separate and voluntary.


6. CRM ROUTING AND LEAD PRIORITY

We may use submitted information to organise professional enquiries
internally, including by:

• source;
• language;
• region;
• inquiry type;
• market interest;
• service interest;
• capital interest;
• readiness;
• operational priority;
• follow-up status.

For example, an inquiry may be classified operationally as:

• high priority;
• medium priority;
• nurture.

These classifications are used for internal organisation, routing,
follow-up and human business review.

They do not constitute investment scoring, credit scoring or regulated
financial assessment.

Unless expressly disclosed otherwise, such classifications are not used to
make solely automated decisions producing legal effects concerning an
individual or similarly significantly affecting an individual within the
meaning of Article 22 GDPR.

Material business decisions remain subject to human review.


7. SYSTEME.IO

We use Systeme.io, operated by ITACWT Limited, Ireland, for functions that
may include:

• CRM and contact management;
• custom fields;
• tags and segmentation;
• forms and funnels;
• requested emails;
• email marketing;
• workflow automations;
• programme administration;
• payment-related functionality where applicable.

Systeme.io may therefore process data submitted through our forms and related
CRM and email interaction information.

Where Systeme.io processes data on our behalf, the applicable contractual
and data-protection arrangements apply.

According to Systeme.io's published information, its principal infrastructure
for the relevant service is hosted on AWS servers in Ireland.

Further information is available in Systeme.io's own Privacy Policy.


8. HOSTINGER

We use Hostinger services for website and server infrastructure.

Depending on the services used, Hostinger may process data necessary for:

• hosting;
• server requests;
• storage;
• security;
• technical logs;
• backups;
• domain and infrastructure administration.

Where Hostinger acts as processor, its applicable Data Processing Agreement
and contractual terms govern the processing.

Further information is available in Hostinger's Privacy Policy.


9. CALENDLY

We use Calendly for appointment scheduling, including Private Review calls.

When you use Calendly, information processed may include:

• name;
• email address;
• company information;
• meeting date and time;
• timezone;
• information entered in booking questions.

Calendly stores invitee information on infrastructure located in the
United States and provides mechanisms for transfers of personal data from
the EEA in accordance with its applicable privacy and transfer framework.

Further information is available in Calendly's Privacy Policy.


10. PAYMENT PROVIDERS

Where online payment functionality is offered for a particular service or
programme, an external payment provider such as Stripe may process:

• name;
• email;
• billing information;
• transaction information;
• payment and authentication information;
• fraud-prevention information.

Expand Future GmbH generally does not receive complete payment-card
credentials.

High-value or individually negotiated engagements may instead be invoiced
and paid by:

• bank transfer;
• direct debit;
• another individually agreed method.


11. ARTIFICIAL INTELLIGENCE AND AUTOMATED SYSTEMS

Expand Future GmbH may use AI-supported and automated systems internally
and in connection with professional services.

Such systems may support activities including:

• research;
• information retrieval;
• market analysis;
• drafting;
• summarisation;
• classification;
• data analysis;
• CRM organisation;
• workflow automation;
• reporting;
• content assistance;
• business-process support;
• technical implementation.

Where personal data is processed by an external AI or technology provider,
we assess the relevant processing relationship and use appropriate
contractual and data-protection safeguards where required.

We do not intentionally provide confidential client information or personal
data to third-party AI services where doing so would conflict with our
contractual, confidentiality or data-protection obligations.

Where Expand Future processes personal data through AI or IT systems on
behalf of a Client, controller/processor roles and an Article 28 GDPR
Data Processing Agreement are established where required.

AI-assisted processing may also support internal operational classifications
such as CRM routing and lead priority.

Unless expressly disclosed otherwise, such systems are not used to make
solely automated decisions producing legal effects concerning an individual
or similarly significantly affecting an individual within the meaning of
Article 22 GDPR.

Human review is used where appropriate taking into account the purpose,
nature and risk of the processing.


12. EU ARTIFICIAL INTELLIGENCE ACT TRANSPARENCY

Where an AI system used by Expand Future GmbH directly interacts with a
natural person and applicable law requires disclosure, users will be informed
that they are interacting with an AI system unless this is obvious from the
circumstances and context.

Where applicable law requires AI-generated or AI-manipulated content to be
labelled, disclosed or technically marked, the measures required for the
legal role actually performed by Expand Future GmbH will be taken.

The precise requirements applicable to an individual client implementation
depend on the relevant AI system, intended purpose and regulatory roles of
the parties.


13. COOKIES, LOCAL STORAGE AND SIMILAR TECHNOLOGIES

Our website may use cookies, local storage or similar technologies.

Technically necessary technologies may be used for:

• website operation;
• security;
• form functionality;
• language and session functionality;
• consent management;
• functionality specifically requested by the user.

Where storage of or access to information on a user's terminal equipment
requires consent under applicable law, including § 165(3) TKG 2021,
the relevant technology will not be activated before the necessary consent
has been obtained.

Optional analytics, advertising or marketing technologies requiring consent
therefore remain blocked until the relevant consent has been given.

Rejecting optional technologies does not prevent the operation of strictly
necessary website functionality.

Where a consent-management function is provided, users may subsequently
change or withdraw their choices.


14. ANALYTICS AND MARKETING TRACKING

At the date of this Privacy Policy, no optional third-party analytics or
marketing tracking technologies are intentionally activated on the main
Expand Future website unless expressly identified through the website's
consent interface.

If optional analytics, advertising pixels or comparable non-essential
tracking technologies are introduced in the future:

• this Privacy Policy will be updated where required;
• technologies requiring consent will remain blocked before consent;
• the relevant provider and purpose will be identified.


15. SOCIAL MEDIA AND PROFESSIONAL NETWORKING

We may maintain professional profiles on platforms such as:

• LinkedIn;
• Instagram;
• Xiaohongshu / RED;
• YouTube;
• other professional platforms.

When you use an external platform, that platform processes information
under its own privacy terms.

We may separately process publicly available professional information for
legitimate B2B relationship-management purposes, including:

• name;
• professional role;
• company;
• business profile URL;
• publicly available professional information;
• relevant professional interaction history.

Possible sources include:

• company websites;
• public professional profiles;
• public business registers;
• professional directories;
• conferences and events;
• professional introductions;
• lawfully used business data providers.

Where Article 14 GDPR requires individual information, the relevant
information will be provided within the applicable legal period or at the
relevant first communication, subject to statutory exceptions.

Electronic promotional outreach remains separately subject to applicable
electronic-communications and direct-marketing law.


16. BUSINESS INTRODUCTIONS

Where you request or authorise a professional introduction, information
reasonably necessary for that introduction may be shared with the intended
professional counterparty.

Depending on the context, this may include:

• name;
• professional role;
• company;
• business contact information;
• high-level company or project information;
• reason for the proposed introduction.

Confidential or sensitive information will not intentionally be shared beyond
the authorised or reasonably expected scope.


17. CLIENT PROJECT DATA

Certain research, IT, automation and AI projects may involve personal data
supplied by a Client.

The applicable legal roles are determined by the actual processing activity.

Where Expand Future GmbH acts as processor under Article 28 GDPR, a Data
Processing Agreement will be entered into where required.

Clients are responsible for ensuring that:

• data supplied to Expand Future was obtained lawfully;
• required transparency obligations have been fulfilled;
• a lawful basis exists for the intended processing;
• required consents or permissions have been obtained;
• their processing instructions are lawful.


18. RECIPIENTS AND SERVICE PROVIDERS

Where necessary and lawful, personal data may be processed by or disclosed
to categories of recipients including:

• hosting and infrastructure providers;
• CRM and email providers;
• appointment scheduling providers;
• payment providers;
• IT and software providers;
• AI and automation providers;
• contractors involved in agreed service delivery;
• professional research partners;
• accountants;
• legal and professional advisers;
• banks;
• competent authorities where required by law;
• professional counterparties where an introduction has been requested
  or appropriately authorised.

We do not sell personal data to advertisers.


19. INTERNATIONAL DATA TRANSFERS

Some providers or subprocessors may process data outside the European
Economic Area.

Where Chapter V GDPR applies, an appropriate transfer mechanism is used,
where required, such as:

• an adequacy decision;
• the EU-U.S. Data Privacy Framework where applicable;
• Standard Contractual Clauses;
• another legally recognised safeguard.

Where appropriate, supplementary technical or organisational safeguards
may also be used.


20. RETENTION

Personal data is retained only for as long as necessary for the respective
purpose, contractual relationship, legal obligation or legitimate legal
interest.


20.1 WEBSITE AND SECURITY LOGS

Technical logs are retained according to the relevant hosting and security
configuration only for as long as reasonably necessary for website operation,
security, troubleshooting and incident investigation.


20.2 OPPORTUNITY FINDER SUBMISSIONS AND ORDINARY ENQUIRIES

Where an enquiry does not result in a contractual relationship, relevant CRM
and enquiry information is generally retained for up to three years after the
last substantive interaction, unless:

• earlier deletion is appropriate;
• continued professional interaction justifies retention;
• a legal claim requires longer retention;
• another lawful basis applies.


20.3 MARKETING DATA

Marketing information is retained until:

• consent is withdrawn;
• the individual unsubscribes;
• the marketing purpose ends.

Minimal suppression information may subsequently be retained where necessary
to ensure that the opt-out continues to be respected.


20.4 CLIENT AND CONTRACT DATA

Contractual and project information is retained during the relationship and
thereafter for applicable statutory limitation, defence, documentation,
accounting and tax periods.


20.5 ACCOUNTING AND TAX INFORMATION

Accounting records, invoices and tax-relevant business documents are generally
retained for seven years in accordance with applicable Austrian accounting and
tax law, and longer where required in an individual case.


20.6 MARKET-RESEARCH DATA

Identifiable research information is retained for as long as necessary for:

• the defined research purpose;
• the research mandate;
• contractual documentation;
• applicable legal obligations.

Where feasible and appropriate, identifiable research data may subsequently
be deleted, anonymised or aggregated.


20.7 CRM RELATIONSHIP INFORMATION

Professional CRM information is periodically reviewed and retained only while
a documented lawful business purpose or another legal basis exists.


21. DATA SECURITY

We implement appropriate technical and organisational measures designed to
protect personal data against:

• unauthorised access;
• unlawful disclosure;
• alteration;
• accidental loss;
• destruction;
• misuse.

Measures may include, depending on the system:

• access restrictions;
• authentication;
• secure credential storage;
• encrypted transmission;
• backups;
• confidentiality obligations;
• processor agreements;
• security procedures.

No electronic system can be guaranteed to be completely secure.


22. YOUR RIGHTS

Subject to applicable legal conditions, you may have the right to:

• information regarding processing;
• access to your personal data;
• rectification of inaccurate data;
• erasure;
• restriction of processing;
• data portability;
• objection to certain processing;
• objection to direct marketing;
• withdrawal of consent;
• complaint to a supervisory authority.

Requests may be sent to:

hello@expand-future.com


23. RIGHT TO OBJECT

Where processing is based on Article 6(1)(f) GDPR, you have the right to
object on grounds relating to your particular situation.

Where personal data is processed for direct marketing, you have the right
to object at any time to processing for that purpose.


24. WITHDRAWAL OF CONSENT

Where processing is based on consent, consent may be withdrawn at any time
with effect for the future.

Withdrawal does not affect the lawfulness of processing undertaken before
the withdrawal.


25. AUSTRIAN DATA PROTECTION AUTHORITY

You have the right to lodge a complaint with a competent supervisory
authority.

In Austria:

Österreichische Datenschutzbehörde
Austrian Data Protection Authority

https://www.dsb.gv.at


26. NO SALE OF PERSONAL DATA

Expand Future GmbH does not sell personal data to advertisers.


27. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy where necessary due to:

• changes to services;
• new or changed technology providers;
• changes to processing;
• legal or regulatory developments.

The current version will be published on our website.


28. DATA PROTECTION CONTACT

Expand Future GmbH
Seitenstettengasse 5/37
1010 Vienna
Austria

hello@expand-future.com