Privacy.

Your launch registration

If you register your interest before launch, we process your email address, selected language, request time and proof of consent. We send a confirmation and, at launch, the download link for the 2026/27 edition. The legal basis is your freely given consent under Article 6(1)(a) GDPR. This does not subscribe you to marketing emails. You can withdraw at any time at office@office-report.org. After delivery and necessary follow-up, the details are deleted unless legal obligations or legitimate claims require further retention.

For an explicitly requested client preview, a necessary cookie remembers the preview preference for 15 minutes. It is not used for analytics or advertising.

Controller & contact

Office Report is operated by Bertram ZT GmbH, Apollogasse 9/1, 1070 Vienna, Austria. For data protection questions and to exercise your rights, contact office@office-report.org.

Your report request or study registration

We process your email address, the requested edition or study registration, website language and submission date and time. For study registrations, we also process your organisation’s name. We record the wording, version and time of your consent and the applicable privacy notice URL. These details allow us to fulfil your request and document your choice.

For a report request, we email the requested PDF link. If an edition is not yet published, we first send a confirmation and then a separate download email on publication. For the 2027 study, we send a registration confirmation and an invitation when the questionnaire opens. This does not subscribe you to marketing emails.

The legal basis for this processing is your consent under Article 6(1)(a) GDPR. The checkbox is not preselected. Providing your details and consent is voluntary; without them we cannot provide the requested email service. You can withdraw consent at any time by emailing office@office-report.org. Withdrawal stops future processing for that purpose and does not affect processing that was lawful before withdrawal.

Storage & email delivery

Requests are stored in a protected register on our World4You hosting account and are accessible only to authorised administrators. Emails are sent through the Office Report mailbox using World4You SMTP. Hosting and email providers process the necessary technical data to deliver these services. We do not sell request details or use them for unrelated advertising. No transfer outside the EEA is intended for this service.

Country & protection against abuse

We estimate your country using your IP address and a local DB-IP Country Lite database. No visitor IP address is sent to a geolocation service. The result is approximate, may reflect a VPN and is left blank if unavailable. The optional country is saved with your request. Raw IP addresses are not saved in the request register.

For rate limits, we use keyed hashes of IP addresses and email addresses for periods of up to 24 hours. Expired entries are removed when further requests arrive. Hidden fields, short-lived session tokens and submission timing also protect the forms. These security measures and necessary technical logs serve our legitimate interest in operating a reliable, secure website under Article 6(1)(f) GDPR.

PDF access log

For the Office Report 2026/27 PDF, we keep a server-side access log containing the request time, IP address reported by our hosting server, browser User-Agent, inferred browser and operating system, HTTP method, response status and requested byte range. We use technical access records to monitor delivery, investigate errors or abuse, and assess demand for the publication, on the basis of our legitimate interest under Article 6(1)(f) GDPR.

For new report requests, the email contains a random personal link identifier, rather than your email address. The protected link register connects that identifier to your request and allows authorised administrators to see the email recipient, estimated PDF openings, dates, IP addresses and browsers. This association is based on the recorded consent under Article 6(1)(a) GDPR. Previously issued ordinary links cannot be attributed to a recipient. A forwarded link remains associated with its original recipient; a request does not prove who actually read the report. We do not use email-open pixels.

Access records are retained for 30 calendar days; recipient identifiers expire after 30 days. The PDF remains accessible after the identifier expires. You may withdraw consent by contacting office@office-report.org; this removes the email association for your links. The register is accessible only in the password-protected administration area, is not sent to Google Analytics and does not set a PDF tracking cookie.

Browser storage & cookies

After a report request is accepted, your email address is remembered in local storage on this device to prefill later report requests in either language. It is not passed to Google Analytics or advertising services. You can change it in the form or remove it by clearing this website’s browser data. Necessary session cookies protect forms and administrator access; they are not used for advertising or analytics.

We remember your cookie choice, its version and the time of your decision in local storage under officeReport.cookieConsent.v1 for up to 180 days. This preference applies to both language versions on the same website and device. If persistent storage is unavailable, we use session storage where possible. Remembering your choice is necessary to respect it and does not use a tracking identifier.

Google Analytics — only with your consent

With your optional consent, we use Google Analytics 4 (measurement ID G-JJ2H5SFB9M) to understand website use and improve our content. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent under Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).

The Google tag is loaded only after you choose “Accept all”. Before consent, or if you choose “Necessary only”, we do not load Analytics or send Analytics requests to Google. Your choice does not affect access to the website, reports or registration forms.

Analytics can process page views, interactions, session information, browser and device details, approximate location and online identifiers. Google receives technical connection information, including your IP address, when its service is contacted. We do not pass the email address or organisation entered in our forms to Analytics. We remove query strings and fragments from the page address supplied to Analytics and supply only the referring website’s origin. Google signals and advertising personalisation signals are disabled in our tag configuration.

Analytics uses first-party cookies such as _ga and _ga_JJ2H5SFB9M to distinguish browsers and sessions. We configure these cookies to expire after at most 180 days, without extending their lifetime on each page load. Retention of data within Google Analytics is governed separately by the Analytics property’s retention settings; you can contact us for details.

Google may also process data in the United States and other countries outside the EEA. Information about Google’s processing and international transfer safeguards is available in Google’s Privacy Policy and its explanation of data from websites that use Google services.

You can decline Analytics or withdraw your consent at any time using “Cookie settings” in the footer. Withdrawal stops further Analytics collection by this website and removes the Analytics cookies accessible to it; it does not affect the lawfulness of earlier processing. If Analytics was already loaded, the page reloads to stop its existing listeners.

Retention

Report requests are kept for delivery and any necessary follow-up. Study registrations are kept for the invitation and participation process for the relevant study. We delete details once these purposes are complete and no further retention is needed, unless a legal obligation or the establishment, exercise or defence of legal claims requires retention. Consent evidence is retained only as necessary to document lawful processing. You can request deletion or withdraw a pending request by emailing office@office-report.org.

Your rights

Subject to the GDPR’s conditions, you have the right to access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent at any time. We do not make automated decisions with legal or similarly significant effects.

You also have the right to complain to the Austrian Data Protection Authority or another competent supervisory authority.

Website services

Fonts, images and the website’s own scripts are hosted locally. The optional Google Analytics script is loaded from Google only after consent, as described above. We do not use an external font service. Hosting providers may maintain technical access logs separately.

Last updated: 20 October 2026.