Privacy Policy
CFS – Consulting, Franchise & Sales GmbH
Heinrichstraße 145, 8010 Graz
Version 09/2026
This Privacy Policy explains how CFS Consulting, Franchise & Sales GmbH processes personal data when you visit our website, contact us, or use our offers and services.
1. Controller
The controller responsible for the processing of personal data is: CFS Consulting, Franchise & Sales GmbH, Heinrichstraße 145, 8010 Graz, Austria. Contact: office@capito.eu.
2. Processing of personal data
We process personal data only where this is legally permissible, in particular for providing the website, handling enquiries, performing contracts, complying with legal obligations, and safeguarding legitimate interests.
3. Processing in connection with our services
We also process personal data in connection with our offers and services. These include, in particular, the capito.ai writing assistant, the capito.ai course generator, human expert language services, consulting services, training sessions and workshops, as well as services as franchisor.
Depending on the service, contact data, contract data, usage data, billing data, communication data, and content data may be processed. Content data may include texts, documents, prompts, task descriptions, translation and simplification requests, course content, learning objectives, target group information, and generated results.
4. Use of the capito.ai writing assistant
When using the capito.ai writing assistant, we process data that users enter, upload, or generate in the system. This includes, in particular, texts, documents, prompts, analysis results, translations, simplifications, summaries, and other AI-supported text transformations.
Processing is carried out to provide the agreed SaaS service, perform the requested text analysis and text transformation, ensure technical operation, remedy errors, prevent misuse, and comply with contractual and legal obligations.
5. Use of the capito.ai course generator
For the capito.ai course generator, we process data for the AI-supported creation of e-learning courses, course structures, learning content, exercises, summaries, and didactic materials. This may include entered texts, documents, learning objectives, target group information, course specifications, prompts, and generated content.
Where customers include personal data in course content or source materials, such data is processed within the framework of the relevant contractual agreement and, where applicable, as processing on behalf of a controller pursuant to Article 28 GDPR.
If a course includes an AI chat, we process the entries made by participants in order to answer their questions about the course content. These entries are not stored and are processed without any information identifying the person.
To evaluate learning progress, we process the name, email address and the answers given by participants to the questions asked during the course. This processing is carried out as processing on behalf of the respective customer pursuant to Article 28 GDPR; the customer informs participants about the processing.
For image generation we use the GPT-Image model. The GPT-Image 1.5 variant is operated in data centres within the EU; the GPT-Image 2 variant is operated as “Global Standard”, which means the image generation request may also be processed in Microsoft data centres outside the EU. Only the image generation request and the generated image are transmitted; the course content itself and the participants’ data remain within the EU. At our customers’ request we use GPT-Image 1.5 exclusively.
6. Human language services
In the context of human expert language services, in particular translation, simplification, editing, quality assurance, and linguistic consulting, we process the content provided by the customer as well as project-related contact and communication data.
Texts and documents may be passed on to internal or external language experts for processing where this is necessary for the provision of the service. These persons are bound by confidentiality obligations and are appropriately integrated into data protection arrangements.
7. Consulting services
For consulting services, we process personal data for the preparation, performance, and follow-up of consulting projects. This includes, in particular, contact data, organisational data, communication data, project documents, analysis results, minutes, offers, contracts, and billing data.
8. Training sessions and workshops
For training sessions, workshops, and comparable qualification offerings, we process personal data for planning, organising, conducting, and following up on the relevant event. This may include contact data, organisational affiliation, registration data, participation data, communication data, training materials, feedback, certificate or confirmation-of-participation data, and, where applicable, content provided during the event.
9. Franchise system
As franchisor, we process personal data of existing and potential franchise partners, their contact persons, and employees. Processing is carried out in particular to review enquiries, initiate and manage franchise agreements, provide training and support, ensure quality assurance, communicate about the brand and system, handle billing, and perform controlling activities.
Depending on their specific activities, franchise partners may themselves be controllers within the meaning of the GDPR. Where personal data is exchanged between us and franchise partners, this takes place only on an appropriate legal basis and to the extent necessary.
10. AI-supported processing
AI systems may be used to provide our services. These systems may analyse, structure, translate, simplify, summarise, rephrase, or use entered or uploaded content to create course and learning materials.
Customer data is not used to train generally available AI models unless this has been expressly agreed. Where external AI service providers are involved, this is done on the basis of appropriate contractual, technical, and organisational safeguards.
11. Roles under the GDPR
Depending on the context, we process personal data either as controller or as processor. We act as controller in particular in relation to website operation, marketing, sales, contract administration, invoicing, general communication, initiation of consulting relationships, and franchise administration.
We act as processor in particular where customers enter personal data into our SaaS solutions or transmit content to us for processing within the scope of contractually agreed services. In such cases, the respective customer remains responsible for the lawfulness of the data processing.
12. Processing on behalf of a controller
Where we process personal data on behalf of a customer, this is done on the basis of a data processing agreement pursuant to Article 28 GDPR. We process such data only on documented instructions from the customer, unless we are legally required to process it otherwise.
The customer is responsible for ensuring that the personal data entered or provided by the customer may be lawfully processed and that data subjects have been informed accordingly where required.
13. Data processed when visiting the website
- IP address
- Date and time of access
- Pages and files accessed
- Browser and operating system used
- Referrer URL
14. Contacting us
If you contact us by email, telephone, form, or any other means, we process the data you provide to handle your enquiry and any follow-up questions.
15. Cookies and similar technologies
Our website may use cookies and similar technologies to provide technical functions, store usage preferences, optimise content, and measure reach. Where required, this is done only on the basis of your consent.
16. Legal bases for processing
Personal data is processed in particular on the basis of Article 6(1)(a) GDPR where consent has been given, Article 6(1)(b) GDPR for the performance of a contract or pre-contractual measures, Article 6(1)(c) GDPR for compliance with legal obligations, and Article 6(1)(f) GDPR for the purposes of legitimate interests.
17. Disclosure of data
Personal data is disclosed only where this is necessary for the performance of a contract, where there is a legal obligation, where you have given consent, or where a legitimate interest exists. Service providers engaged by us are contractually obliged to comply with data protection requirements.
18. Recipients and service providers
To provide our services, we may use service providers and recipients in the following categories: hosting and infrastructure providers, AI and language model service providers, email and communication services, CRM and support systems, payment and invoicing service providers, analytics and monitoring services, external language experts, franchise partners, tax advisers, legal advisers, and public authorities.
| Company | Registered office | Location of data processing | Function / purpose | Safeguards |
|---|---|---|---|---|
| A1 Digital International GmbH | Lassallestraße 9, 1020 Vienna, Austria | Austria | Cloud service provider Server infrastructure within the scope of the capito.ai SaaS service CRM |
Data processing agreement, technical and organisational measures |
| Microsoft Österreich GmbH | Am Euro Platz 3, 1120 Vienna, Austria | EU | Microsoft 365 / Exchange Online Provision of parts of the infrastructure for operating capito.ai, in particular the large language models and AI capacities (text processing, AI chat) via Microsoft Azure Services |
Microsoft Products and Services Data Protection Addendum (DPA); technical and organisational measures |
| Microsoft Österreich GmbH | Am Euro Platz 3, 1120 Vienna, Austria | EU (model GPT-Image 1.5) or worldwide (model GPT-Image 2, “Global Standard”) | Image generation in the capito.ai course generator | Microsoft Products and Services DPA; EU-US Data Privacy Framework or Standard Contractual Clauses |
| Amazon Web Services, Inc. | P.O. Box 81226 Seattle WA 98108-1226, USA |
Germany | Database for operating the capito reading app | Data Protection Addendum (DPA), technical and organisational measures |
| Stripe Payments Europe Ltd | Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland | Global | Subscription management, invoicing, and payment processing | Data Processing Addendum (DPA), technical and organisational measures |
| Sentry Functional Software, Inc. | 45 Fremont Street, 8th Floor, San Francisco, CA 94105 | Germany | Logging and system monitoring | Data Processing Addendum (DPA), technical and organisational measures |
| Stackhero | 1 rue de Stockholm, 75008 Paris, France | France | Logging | Data Processing Addendum (DPA), technical and organisational measures |
| Brevo / Sendinblue GmbH | Köpenicker Straße 126, 10179 Berlin, Germany | Germany | Newsletter system | Data Processing Addendum (DPA), technical and organisational measures |
19. Sub-processors
Where we act as processor, we engage sub-processors only in accordance with the GDPR and the relevant contractual agreements. Sub-processors are selected carefully, contractually bound, and reviewed regularly.
20. Transfers to third countries
Where personal data is transferred to recipients outside the European Union or the European Economic Area, this is done only where an appropriate legal basis exists, in particular an adequacy decision, Standard Contractual Clauses, or other appropriate safeguards under the GDPR.
Processing outside the EU or the EEA currently occurs in two cases: payment processing via Stripe, and — where the customer uses the GPT-Image 2 model — image generation in the capito.ai course generator.
21. Retention period
Personal data is stored only for as long as this is necessary for the respective purposes or as long as statutory retention obligations apply. Thereafter, the data is deleted or anonymised.
22. Deletion and export of customer data
After termination of the contract, customer data is deleted or returned in accordance with the contractual agreements, unless statutory retention obligations or legitimate interests prevent this. Where technically provided, customers may export their data before the contract ends.
23. Data security
We implement appropriate technical and organisational measures to protect personal data. These include, in particular, access restrictions, role and authorisation concepts, confidentiality obligations, encryption during transmission, logging, data backup, tenant separation, and measures to ensure the availability and integrity of systems.
24. Special categories of personal data
Customers may also provide special categories of personal data within the meaning of Article 9 GDPR in texts, documents, or course content, such as health data or other sensitive information. In such cases, processing is carried out only within the scope of the relevant service and, where applicable, on the customer’s instructions. The customer remains responsible for ensuring that there is a sufficient legal basis for providing and processing such data.
25. Rights of data subjects
Subject to the provisions of the GDPR, you have in particular the right of access, rectification, erasure, restriction of processing, data portability, withdrawal of consent previously given, and objection to certain processing operations.
26. Right to lodge a complaint
If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with the competent data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority.
27. Validity of this Privacy Policy
This Privacy Policy may be amended if legal, technical, or organisational circumstances change. The current version shall apply.