Privacy Policy

1. Controller

The controller responsible for processing personal data on this platform is:

If you have questions about data protection or wish to exercise your rights, you can contact us at any time at hallo@unfallbericht.at.

We have not appointed a data protection officer, as there is no statutory obligation to do so.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide, use, secure, troubleshoot and improve the platform, where a legal obligation exists, or where you have given us consent.

Personal data means any information relating to an identified or identifiable natural person. This includes in particular names, contact details, vehicle data, location information, insurance data, accident and damage data, photos, signatures, technical usage data and communication data.

The following processing activities, purposes and legal bases are particularly relevant for the platform:

3. Data We Process

Depending on how the platform is used, the following data in particular may be processed:

1. Master and profile data: name, email address, phone number, user account, language settings, profile information, login data and other information you provide when using the platform.
2. Accident report data: information about the accident location, accident time, accident circumstances, involved persons, vehicles, insurance providers, damage, comments, sketches, signatures and other report content.
3. Vehicle and insurance data: license plates, make/model, vehicle identification number, keeper data, insurance company, policy numbers, green card data, broker data and other information for claims handling.
4. Identity data from ID Austria: name, date of birth, nationality, main residence, bPK and vehicle registrations, if you use login or data import with ID Austria.
5. Photos, sketches and files: accident photos, damage photos, sketches, signatures, driving licence scans, insurance cards or other files uploaded by you.
6. Communication data: emails, support requests, follow-up questions about accident reports, technical notifications, review invitations as well as technical delivery and open events.
7. Payment and contract data: for business features, company and billing data, VAT ID, booked products, subscription and payment status.
8. Technical and usage data: IP address, browser and device information, operating system, screen size, pages accessed, usage behavior, technical events, error data, cookies, consent status and similar technical information.
9. Partner and referral data: information about whether partner offers were displayed, requested or used, as well as data required for specifically requested claims management.

4. Use of the Platform and Creation of Accident Reports

When you create an accident report via unfallbericht.at, we process the data you enter in order to digitally record and store the accident report, enable joint editing with other involved parties, provide it as a PDF and make it usable for further claims handling.

This includes recording involved persons, vehicle and insurance data, accident circumstances, photos, sketches, comments, signatures, PDF reports and provision to authorized involved parties.

Processing is carried out for performance of the user relationship and on the basis of legitimate interests in proper documentation, traceability, claims handling and legal defense.

5. Necessity of Providing Data

Providing data that is marked as mandatory in the platform or is required to create, store, provide and handle an accident report is necessary for using the respective function.

Without this data, we cannot provide the accident report or individual functions, or can provide them only in a limited form. Voluntary information is not mandatory; if you do not provide it, this will not disadvantage you. However, individual convenience, analytics, partner or additional functions may then be unavailable or limited.

For scan functions and data import with ID Austria, you may alternatively enter the relevant information manually. Uploading a document or using ID Austria is therefore not required.

6. Data Not Collected Directly from the Data Subject

Users may enter data about other persons in an accident report, in particular data about accident participants, vehicle keepers, policyholders, witnesses, passengers and other data subjects.

The source of this data is usually the respective user or accident participant who creates, edits or supplements the report.

The categories concerned correspond to the accident, contact, vehicle, insurance, damage, photo, signature and communication data entered or uploaded for the respective report.

Processing takes place to create, edit, document, provide and handle the accident report and to protect legitimate documentation and legal defense interests.

Information under Art. 14 GDPR is provided to data subjects no later than at the first contact, provision of an access link, invitation to joint editing or in another suitable way, unless a statutory exception applies.

Data subjects may exercise their rights of access, rectification, erasure, restriction, objection and data portability subject to the statutory requirements.

7. Joint Editing by Accident Participants

The platform enables joint editing of an accident report by several accident participants. Certain data you enter may become visible to other authorized participants, in particular name, contact details, vehicle data, insurance data, information about the accident circumstances, photos, sketches, comments and signatures.

Please therefore enter only data that is necessary or useful for creating and documenting the accident report.

Because an accident report regularly concerns several persons, one individual participant cannot freely dispose of the entire report. A deletion or correction request by one person therefore does not necessarily result in deletion of the entire accident report if legitimate interests of other participants, documentation purposes, legal claims or statutory retention obligations conflict with this.

8. Claims Management and Disclosure to Partner Companies

For recipients and partners, we distinguish between necessary or user-initiated disclosure, claims-handling partners, and marketing or partner offers.

A. Necessary or user-initiated recipients: This includes other accident participants, authorized involved parties, insurance providers, recipients selected by the user and recipients of PDF reports or access links. Data is transmitted only where initiated by use of the function or required for the report and claims handling.

B. Claims-handling partners: This may include repair shops, assessors, roadside assistance, towing services, replacement mobility providers and insurance or claims management service providers. Personal data is disclosed to such partners only where this is required in the specific accident context or actively requested or selected by the user.

C. Marketing, recommendations and partner offers: Promotional contact or partner offers that are not directly required take place only with your separate consent. Partners are not allowed to freely contact all users.

Where partners are merely displayed in the platform or in the PDF, this does not automatically mean that the respective partner receives accident report data. If you open a partner link or actively contact a partner, the privacy information of the respective partner also applies.

9. Photos, Signatures and Possible Health Data

You can upload or capture photos, sketches, signatures and other files within the platform.

Signatures are stored as image files. We do not perform biometric evaluation or analysis of signatures for the purpose of uniquely identifying a person.

The platform is not primarily intended for processing health data. Please do not upload sensitive content, especially injury photos or health data, unless this is required for accident documentation.

Where special categories of personal data, in particular health data, are processed, this is done only where necessary for documenting the accident event, handling claims or establishing, exercising or defending legal claims, or where explicit consent has been given.

In these cases, in addition to an appropriate legal basis under Art. 6 GDPR, the legal basis is in particular Art. 9(2)(f) GDPR for legal claims or Art. 9(2)(a) GDPR where explicit consent is given.

10. Driving Licence Scan, Insurance Scan and Text Recognition

The platform offers functions for capturing driving licence and insurance data by photo. If you use such a function, the captured or uploaded document photo is transferred to our server and forwarded to Anthropic (AI model Claude) for text recognition. The extracted information (e.g. name, licence number, licence categories, issuing authority, validity dates, insurance and vehicle data) is filled into the input fields, where you can check and correct it.

Anthropic processes the data as our processor under a data processing agreement solely to provide text recognition and does not use it to train its models. For the transfer to the USA, see section 21.

Processing takes place only if you actively use the scan function, on the basis of Art. 6(1)(b) GDPR. You may alternatively enter the relevant data manually.

11. Location Data, Camera and Browser Functions

Location data is not permanently collected automatically. If you enter an accident location or actively use a location function in the browser, we process the location information you provide to create and document the accident report.

If you use camera, file or upload functions, the platform processes the photos, files or camera content you select only within the scope of the respective function.

Camera or location access is granted through your browser and only if you grant it. You can change or revoke permissions you have granted at any time in your browser settings.

12. Map and Address Functions

For map, address and location functions we use Google Maps, Google Places and Google Geocoding (Google Ireland Limited, Ireland) as well as OpenStreetMap data via Overpass servers (including overpass-api.de).

Your IP address, technical browser data and the addresses or coordinates you enter are transmitted to the respective providers to the extent necessary to display maps, search for places or process address information. The legal basis is Art. 6(1)(b) GDPR, as these functions serve to record the accident location in the report.

13. Login and Data Import with ID Austria

You can optionally log in with ID Austria or import your data into the accident report via ID Austria. For this purpose, you are redirected to the ID Austria login service. Authentication there is the responsibility of the Austrian Federal Ministry of the Interior as a separate controller; its privacy information applies.

After your approval in the login process, we receive the following data from ID Austria: first name, last name, date of birth, nationality, main residence, the sector-specific personal identifier (bPK) and your vehicle registrations. We use this data to log you in and to prefill the driver, address and vehicle information in the accident report. We store the bPK only as a cryptographic hash in order to recognize your account on later logins.

The legal basis is Art. 6(1)(b) GDPR, as you actively choose this function to create the report. Using ID Austria is voluntary; all information can also be entered manually.

14. Payment Processing via Stripe

For paid business features, we process payments via Stripe (Stripe Payments Europe, Limited, Ireland). When you purchase a business product, we transmit the company name, email address and an internal customer identifier to Stripe. You enter your billing address, VAT ID and payment method data (e.g. credit card or SEPA details) directly on Stripe's payment page; we do not receive complete payment method data.

The legal basis is Art. 6(1)(b) GDPR; invoice and accounting data is retained under Art. 6(1)(c) GDPR in conjunction with Section 132 BAO. Stripe processes the data for payment processing, fraud prevention and compliance with its own regulatory obligations as a separate controller; Stripe's privacy notice also applies.

15. Email Delivery and Delivery/Open Events

We use Resend to send emails. This includes in particular login emails, Magic Links, technical notifications, invitations, follow-up questions, support messages, information about accident reports and other transactional emails.

In this context, we process in particular email address, name, message content, sending time, delivery status and technical sending information.

Resend provides us with technical delivery and open events. We use them solely for delivery control, error analysis, security and support on the basis of Art. 6(1)(f) GDPR. No evaluation for advertising or profiling purposes takes place.

16. Review Invitations via Trustpilot

Once an accident report has been completed and generated as a PDF, we transmit the name, email address and a report reference number (without any further report content) to Trustpilot A/S (Copenhagen, Denmark). This only concerns people who use our service themselves: the person who created the report and a party who joined the report with their own access. Accident participants whose details were entered by another person do not receive an invitation. Trustpilot then sends, on our behalf, a one-time email inviting you to review our service.

The legal basis is our legitimate interest in feedback on the quality of our service (Art. 6(1)(f) GDPR) in conjunction with Section 174(4) TKG 2021, as we received your email address in connection with the use of our service. You can object to this use at any time free of charge – via the unsubscribe link in every invitation or by email to hallo@unfallbericht.at.

Trustpilot acts as our processor for sending the invitation. If you submit a review, Trustpilot processes the related data as a separate controller; Trustpilot's privacy notice then applies.

17. Analytics, Usage Statistics and Product Improvement

We use analytics and statistics services to understand how the platform is used, detect technical issues, improve functions and further develop user-friendliness.

Vercel Web Analytics: We use Vercel Web Analytics (Vercel Inc., USA) for anonymized audience measurement. No cookies are set and no information is stored on your device. Visitors are counted only via a hash derived from request data, which is discarded daily; the IP address is not stored. The data collected is the page visited, referrer, device type, browser, operating system and country. The legal basis is our legitimate interest in statistical evaluation and improvement of our service (Art. 6(1)(f) GDPR).

Google Analytics and Microsoft Clarity: These services use cookies or similar technologies and are loaded only if you have given consent via the cookie banner (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). You can withdraw or adjust your consent at any time with effect for the future via the “Cookie settings” link in the footer.

18. Cookies and Similar Technologies

Our platform uses cookies and similar technologies such as your browser's local storage (localStorage). We distinguish between technically necessary technologies and analytics or statistics cookies, which are used only with your consent.

Technically necessary are in particular cookies and storage entries for login, session management, security (e.g. during the ID Austria login process), language settings and storing your cookie choice. We use these without consent on the basis of Section 165(3) TKG 2021 and Art. 6(1)(b) or (f) GDPR.

On your first visit, you can choose “Accept all”, “Essential only” or select individual categories via “Settings” in the cookie banner. Your choice is stored in your browser's localStorage under the keys “analytics_consent” and “analytics_consent_settings”. You can change your settings and withdraw any consent given with effect for the future at any time via the “Cookie settings” link in the footer.

19. Accessibility Widget (barrierefinder.at)

On our information pages, we embed an accessibility widget from barrierefinder.at that allows you to adjust, for example, font size, contrast or read-aloud functions. barrierefinder.at is a product of FDM Software GmbH itself; no disclosure to third parties takes place as a result.

When the widget is loaded, your IP address, user agent (browser and device information) and the page visited are transmitted to the barrierefinder.at server. The legal basis is our legitimate interest in making the website accessible to everyone (Art. 6(1)(f) GDPR).

20. Fonts

The fonts used on this website are served locally from our own server. No connection is made to Google Fonts servers or other external font providers.

21. Service Providers, Recipients and Third-Country Transfers

We use external service providers and recipients only where this is necessary for operation, maintenance, security, troubleshooting, contract performance, communication, analytics or the function actively used. We have concluded data processing agreements pursuant to Art. 28 GDPR with our processors.

Data is transferred to third countries only where an adequacy decision of the European Commission exists (in particular for companies certified under the EU-US Data Privacy Framework) or appropriate safeguards pursuant to Art. 46 GDPR, in particular the European Commission's Standard Contractual Clauses, have been agreed. You can request a copy of the respective safeguards at hallo@unfallbericht.at.

22. Storage Duration and Deletion

We store personal data only for as long as necessary for the respective purposes, as statutory obligations exist, legitimate interests require it, or evidence and legal defense purposes require further storage.

When storage is no longer required, personal data is deleted or anonymized.

23. Anonymized and Aggregated Evaluations

We may anonymize or aggregate data and then use it for statistical evaluations, quality assurance, error analysis, product development or industry statistics.

Anonymized data does not allow conclusions to be drawn about individual persons and is no longer subject to the GDPR.

24. Data Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration or disclosure.

These include in particular access restrictions, authentication mechanisms, encryption, logging, permission management, secure storage and regular technical development.

Despite careful measures, no electronic data transmission or storage can be guaranteed to be completely risk-free.

25. No Automated Decision-Making

We do not use personal data for automated decision-making within the meaning of Art. 22 GDPR that has legal effect on you or similarly significantly affects you.

26. Your Rights

Subject to the statutory requirements, you have the following rights:

1. right of access to the personal data processed by us;
2. right to rectification of inaccurate or incomplete data;
3. right to deletion of personal data;
4. right to restriction of processing;
5. right to data portability;
6. right to object to processing based on legitimate interests;
7. right to withdraw consent granted with effect for the future;
8. right to lodge a complaint with a supervisory authority.

To exercise your rights, please contact us at hallo@unfallbericht.at. Please note that we may need additional information to confirm your identity when processing your request.

27. Withdrawal and Objection

Where processing is based on your consent, you may withdraw this consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. The easiest way to withdraw consent for analytics services is via the “Cookie settings” link in the footer.

If we process personal data on the basis of legitimate interests, you may object to this processing on grounds relating to your particular situation. You may object to processing for direct marketing purposes, including review invitations, at any time without giving reasons.

28. Right to Lodge a Complaint with the Data Protection Authority

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

In Austria, the competent authority is:

29. Changes to this Privacy Policy

We may adapt this Privacy Policy if our platform, our data processing activities, the service providers we use or legal requirements change.

The current version is available on our website.

30. Last Updated

Last updated: October 2026