Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) responsible for the processing of personal data on this website is:

LeonTalents FlexCo Lakeside B01 9020 Klagenfurt am Wörthersee Austria

Phone: +43 677 61424912 Email: support@leontalents.com

Company Register Number: FN 639679 f Company Register Court: Regional Court of Klagenfurt VAT ID: ATU81471024 Registered Office: Klagenfurt am Wörthersee

ExpatsFirst is a product of LeonTalents FlexCo.

No Data Protection Officer has been appointed. If you have any questions regarding data protection, you can contact us at any time at support@leontalents.com.

2. Scope and Purpose of This Website

This Privacy Policy applies to the website www.expatsfirst.com.

The website currently serves in particular to:

• provide information about ExpatsFirst and the planned launch of the platform,
• allow interested persons to join the ExpatsFirst waiting list (“Waitlist”),
• inform persons on the Waitlist about the launch of ExpatsFirst, access to the platform and relevant product developments.

The full ExpatsFirst platform is currently still in preparation. This Privacy Policy therefore applies to the current landing page and the Waitlist function provided there.

3. Provision and Hosting of the Website

The website is provided using services of:

Cloudflare, Inc. 101 Townsend Street San Francisco, CA 94107 USA

For the technical provision of the website, we use in particular Cloudflare Workers.

When you access the website, the following data may be processed for technical reasons:

• IP address,
• date and time of access,
• pages and files accessed,
• browser type and browser version,
• operating system used,
• referrer URL, if transmitted by the browser,
• technical connection and security information.

The processing of this data is necessary in order to provide the website technically, ensure its stability and security, and detect and prevent misuse and technical attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of our website.

Cloudflare is a company based in the United States. Data may therefore also be processed outside the European Economic Area. Cloudflare states that for data transfers from the European Economic Area to the United States it relies, among other things, on the EU-U.S. Data Privacy Framework and, where applicable, on the European Commission’s Standard Contractual Clauses.

4. Registration for the ExpatsFirst Waitlist

You can voluntarily register for the ExpatsFirst Waitlist on our website.

For this purpose, based on the current technical setup, we process:

• your full name,
• your email address,
• your country of origin,
• your planned migration timeline,
• your planned migration path,
• how you heard about ExpatsFirst,
• the date and time of your consent,
• your personal referral code and, where you registered through the referral link of another person, a reference to that person's registration.

Further personal information such as your telephone number, address or date of birth is not required to register for the Waitlist.

We use this data in particular to:

• manage your registration on the Waitlist,
• inform you about the upcoming launch of ExpatsFirst,
• inform you when access to ExpatsFirst becomes available,
• send you relevant information and product updates about ExpatsFirst,
• send you future information about ExpatsFirst and related offers, to the extent covered by your consent,
• prepare ExpatsFirst for the countries of origin, timelines and migration paths of the persons on the Waitlist,
• operate the referral programme, in particular to determine whether three persons have registered through your personal referral link, which gives you priority access at launch.

5. Legal Basis for the Waitlist and Email Communications

The processing of your personal data for the Waitlist and related communication is based on your voluntary consent pursuant to:

Art. 6(1)(a) GDPR.

Where emails serve direct marketing purposes, they are also sent in accordance with Section 174 of the Austrian Telecommunications Act 2021 (TKG 2021).

Under Section 174(3) TKG 2021, the sending of electronic mail for direct marketing purposes is generally permitted only with the recipient’s prior consent.

You may withdraw your consent at any time with effect for the future.

You can withdraw your consent in particular:

• via an unsubscribe link included in our emails, where available, or
• by email to support@leontalents.com.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

6. Storage of Waitlist Data with Supabase

We use the service Supabase to store and manage the ExpatsFirst Waitlist.

The provider is:

Supabase Pte. Ltd. 65 Chulia Street #38-02/03 OCBC Centre Singapore 049513

We store the Waitlist data listed in section 4 in a Supabase database located in the European Union (Frankfurt am Main, Germany).

Supabase acts as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR. As Supabase is based outside the European Economic Area, access to the data from third countries, for example for support and maintenance purposes, cannot be ruled out. For such transfers, Supabase uses Standard Contractual Clauses of the European Commission.

Further information regarding Supabase's processing of personal data can be found in Supabase's privacy policy.

7. Transfers to Third Countries

Some of the service providers we use are based outside the European Economic Area, in particular in the United States and in Singapore.

This currently applies in particular to:

• Cloudflare,
• Supabase.

Personal data is transferred to third countries only in compliance with the requirements of Art. 44 et seq. GDPR.

Appropriate safeguards may include in particular:

• an adequacy decision by the European Commission,
• a valid certification under the EU-U.S. Data Privacy Framework,
• Standard Contractual Clauses of the European Commission,
• or other safeguards permitted under the GDPR.

Cloudflare states that it relies, among other things, on its certification under the EU-U.S. Data Privacy Framework and, where applicable, on Standard Contractual Clauses.

Supabase states that it uses Standard Contractual Clauses of the European Commission for such transfers.

8. Retention Period

We generally store your Waitlist data:

• until the launch of ExpatsFirst,
• beyond that, for as long as valid consent exists for the respective email communication,
• or until you withdraw your consent.

If you withdraw your consent, we will generally remove your email address from the active mailing list without undue delay and delete it, unless statutory retention obligations or other legal grounds prevent deletion.

Where individual data is required solely to demonstrate that valid consent had previously been given, such data may be retained for a limited period to the extent legally necessary.

9. Product Updates, Newsletter and Marketing

With your corresponding consent, we may use your email address to send you information about ExpatsFirst.

This may include in particular:

• information about the launch,
• information about your access to the platform,
• important product updates,
• new features,
• information about ExpatsFirst offers,
• future newsletters and marketing communications.

Your email address will only be used for such purposes within the scope of the consent you have given or on another legally permissible basis.

At present, no separate external newsletter service is being used.

10. Cookies and Similar Technologies

Our website may use technically necessary cookies or comparable technologies where required for the secure and functional operation of the website.

Where only technically necessary cookies are used, they are used on the basis of the applicable legal provisions.

Non-essential cookies, in particular for analytics, tracking or marketing purposes, will only be used where a corresponding legal basis exists and, where required, after obtaining your prior consent.

11. Analytics and Tracking Services

On the current landing page, we do not currently use our own analytics or marketing tracking services such as:

• Google Analytics,
• Meta Pixel,
• LinkedIn Insight Tag,
• TikTok Pixel,
• Microsoft Clarity.

If analytics or marketing services are used in the future, this Privacy Policy will be updated accordingly and any required consent will be obtained.

12. Social Media

Our website may contain links to social media platforms or to our profiles on such platforms.

In the case of simple links, a connection to the respective social media platform is only established when you click the link.

From that point onward, the respective platform operator is responsible for its own data processing. The privacy policy of the respective provider applies.

If active social media content is directly embedded into our website in the future and data is transmitted to an external provider already when the page is loaded, this will only take place in compliance with applicable data protection requirements and, where required, after obtaining prior consent.

13. External Content

At present, we do not use embedded Google Maps services on the landing page.

To protect the Waitlist registration against automated and abusive sign-ups, we use Cloudflare Turnstile, a service of Cloudflare, Inc. (see section 3). Turnstile is loaded only in the last step of the registration form. When it is loaded, Cloudflare processes technical information about your browser and device, such as your IP address and browser characteristics, in order to distinguish human visitors from automated access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the Waitlist against misuse.

Videos or comparable external content are currently not part of the landing page.

If further external content is integrated in the future, personal data may be transferred to the respective provider. In that case, this Privacy Policy will be updated accordingly.

14. Recipients of Personal Data

We generally disclose personal data only where this is necessary for the provision of our website and Waitlist or where a legal basis exists.

Recipients may include in particular:

• hosting and infrastructure providers,
• IT service providers,
• providers used to store and manage the Waitlist,
• future email and newsletter service providers.

Where service providers process personal data on our behalf, such processing is based on a data processing agreement pursuant to Art. 28 GDPR, where legally required.

We do not disclose or sell your Waitlist data to third parties for their own advertising purposes.

15. Data Relating to Minors

ExpatsFirst is primarily intended for adult users, in particular persons planning to move to Austria or who have already moved to Austria.

Technically, younger persons may also be able to register for the Waitlist. However, ExpatsFirst is not specifically directed at children.

Where special legal requirements apply to the processing of minors’ personal data, these requirements will be observed.

16. Data Security

We take appropriate technical and organisational measures to protect personal data in particular against:

• loss,
• misuse,
• unauthorised access,
• unauthorised alteration,
• unauthorised disclosure.

In doing so, we take into account the state of the art, the nature and scope of the processing and the associated risks.

17. Your Rights under the GDPR

Subject to the applicable legal requirements, you have in particular the following rights:

Right of Access

Pursuant to Art. 15 GDPR, you have the right to request information as to whether and which personal data we process about you.

Right to Rectification

Pursuant to Art. 16 GDPR, you may request the correction of inaccurate personal data or the completion of incomplete personal data.

Right to Erasure

Under the conditions of Art. 17 GDPR, you may request the deletion of your personal data.

Right to Restriction of Processing

Under the conditions of Art. 18 GDPR, you may request the restriction of processing.

Right to Data Portability

Where the legal requirements are met, you have the right pursuant to Art. 20 GDPR to receive the personal data you have provided in a structured, commonly used and machine-readable format.

Right to Object

Where processing is based on Art. 6(1)(e) or (f) GDPR, you may object to the processing pursuant to Art. 21 GDPR on grounds relating to your particular situation.

Withdrawal of Consent

You may withdraw any consent given at any time with effect for the future pursuant to Art. 7(3) GDPR.

To exercise your rights, you can contact us at:

support@leontalents.com

18. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the GDPR or other data protection laws, you have the right to lodge a complaint with a data protection supervisory authority.

The competent authority in Austria is in particular:

Austrian Data Protection Authority Barichgasse 40–42 1030 Vienna Austria

19. Automated Decision-Making and Profiling

No automated decision-making within the meaning of Art. 22 GDPR takes place in connection with the current ExpatsFirst landing page and Waitlist.

The data collected for the Waitlist is currently not used for profiling.

20. Changes to This Privacy Policy

We may update this Privacy Policy if our website, the services used, the scope of data processing or applicable legal requirements change.

The current version is available at www.expatsfirst.com.

Last updated: September 2026.