Legal
PRIVACY POLICY
The Leading Space
a brand of Expand Future GmbH
Last updated: September 2026
1. CONTROLLER
The controller responsible for the processing of personal data described in this Privacy Policy is:
Expand Future GmbH
Seitenstettengasse 5/37
1010 Vienna
Austria
Email:
hello@theleadingspace.eu
Alternative company contact:
hello@expand-future.com
Website:
https://www.theleadingspace.eu
The Leading Space is operated as a brand and business unit of Expand Future GmbH.
2. SCOPE OF THIS PRIVACY POLICY
This Privacy Policy explains how personal data may be processed in connection with The Leading Space, including:
- the website and landing pages;
- the AI Opportunity Check;
- report requests;
- contact and application forms;
- entrepreneur and company enquiries;
- Client Growth System;
- AI Systems Lab;
- AI Systems Build;
- Enterprise AI Systems;
- workshops, live programmes, implementation formats and digital resources;
- Systeme.io CRM, email and workflow functionality where activated;
- optional marketing emails and nurture sequences where activated;
- checkout, payment and resource-access flows where activated;
- AI-supported business-system design and implementation projects;
- B2B relationship management;
- contractual and pre-contractual communication.
The Leading Space provides B2B services.
The GDPR nevertheless applies whenever information relates to an identified or identifiable natural person, including founders, directors, employees, representatives, professional contacts, participants and other individuals.
3. CATEGORIES OF PERSONAL DATA
3.1 CONTACT AND IDENTIFICATION DATA
Depending on your interaction with us, we may process:
- first and last name;
- business email address;
- telephone number;
- job title or professional role;
- company or organisation;
- country or region;
- preferred language;
- professional profile information;
- information voluntarily supplied by you.
3.2 COMPANY AND BUSINESS INFORMATION
We may process business-related information including:
- company name;
- website;
- business segment;
- industry or sector;
- company stage;
- business model;
- team or organisation size;
- current business challenges;
- business objectives;
- Marketing, Sales or Operations priorities;
- existing workflows;
- AI or automation interests;
- implementation readiness;
- budget or indicative budget range where voluntarily provided;
- timing;
- relevant internal stakeholders;
- other professional information relevant to the requested service.
3.3 AI OPPORTUNITY CHECK DATA
When you use the AI Opportunity Check, we may process information such as:
- business segment: entrepreneur or company;
- selected opportunity area: Marketing, Sales, Operations or multiple areas;
- primary and secondary business outcomes;
- estimated weekly hours;
- repetition frequency;
- people involved;
- outcome clarity;
- implementation readiness;
- availability of usable inputs;
- human-judgement requirement;
- offer or business maturity for entrepreneurs;
- workflow scope for companies;
- team availability;
- cross-functional scope;
- indication of sensitive-data involvement;
- delivery preference;
- result route;
- recommended next step;
- request timestamp and version information.
The AI Opportunity Check may calculate locally:
- opportunity score;
- outcome-clarity score;
- readiness score or band;
- estimated monthly and annual capacity potential;
- recommended offer route;
- suggested next actions.
The AI Opportunity Check is a non-binding diagnostic and recommendation tool. It does not make decisions that produce legal effects concerning you or similarly significantly affect you.
3.4 REPORT REQUESTS
If you request a report after completing the AI Opportunity Check, we may process:
- optional first name;
- required email address;
- result categories;
- scores and bands generated by the Opportunity Check;
- recommended offer route;
- delivery preference;
- selected business area;
- next actions;
- marketing-consent status if separately selected.
This information may be sent to Systeme.io where the report and CRM workflow are activated.
3.5 ENQUIRIES, APPLICATIONS AND CONTACT FORMS
If you contact us or apply for a programme or service, we may process:
- name;
- business email;
- company;
- role;
- selected offer or area of interest;
- message content;
- Opportunity Check route or score where submitted;
- enquiry source;
- correspondence;
- internal notes relating to the enquiry or requested service.
3.6 CHECKOUT, PAYMENT AND PROGRAMME ACCESS DATA
Where online checkout, payment or resource access is activated for a specific offer, we may process:
- name;
- email address;
- billing details;
- company information;
- selected product or programme;
- participant count;
- payment status;
- invoice and transaction information;
- VAT or tax information;
- access status;
- onboarding information;
- resource-access information.
Where online checkout is not activated, services may be handled through application, enquiry, invoice or individual agreement.
3.7 CLIENT PROJECT AND IMPLEMENTATION DATA
In connection with AI systems, business-system implementation or Enterprise AI Systems engagements, we may process information supplied by clients, including:
- business-process descriptions;
- workflow information;
- operational data;
- CRM or sales-process information;
- marketing-process information;
- client-delivery or operations information;
- documents;
- system requirements;
- implementation notes;
- user roles;
- technical requirements;
- information necessary to design or implement the agreed business system.
Where client data includes personal data, the applicable controller/processor roles and data-processing arrangements may be defined in the relevant project agreement or Data Processing Agreement.
3.8 CONTRACTUAL AND BILLING DATA
Where a contractual relationship exists, we may process:
- contracts;
- proposals;
- statements of work;
- order confirmations;
- purchased services;
- programme participation;
- invoices;
- billing information;
- payment status;
- tax-relevant documentation;
- contractual correspondence;
- project documentation.
3.9 TECHNICAL WEBSITE DATA
When our website is accessed, technical systems may process:
- IP address;
- date and time of access;
- requested URL;
- referrer;
- browser type and version;
- operating system;
- device information;
- server response and error codes;
- technical logs;
- security-related information.
Such information is generally necessary for website delivery, security and troubleshooting.
4. PURPOSES AND LEGAL BASES
4.1 WEBSITE OPERATION AND SECURITY
We process technical data to provide the website, maintain technical stability, protect against misuse, troubleshoot errors and keep the website secure.
Legal basis:
Article 6(1)(f) GDPR — legitimate interest in operating a secure and reliable website.
4.2 ENQUIRIES AND PRE-CONTRACTUAL COMMUNICATION
We process information to respond to enquiries, evaluate requested services, arrange communication, assess project or programme fit and prepare offers.
Legal basis:
Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract.
Where Article 6(1)(b) GDPR does not apply, processing may be based on Article 6(1)(f) GDPR and our legitimate interest in responding to professional B2B enquiries.
4.3 AI OPPORTUNITY CHECK AND REQUESTED REPORTS
Where you complete the AI Opportunity Check and request a report, we process the relevant information to:
- calculate or prepare the result;
- show the immediate result;
- create or update a CRM record where activated;
- store relevant report fields and routing information where activated;
- send the specifically requested report email where activated;
- recommend a relevant next step.
Receiving the specifically requested report is separate from optional marketing consent.
Legal basis:
Depending on the context, Article 6(1)(b) GDPR where the report is requested as a pre-contractual step and/or Article 6(1)(f) GDPR based on our legitimate interest in providing the requested professional information.
4.4 OPTIONAL EMAIL MARKETING
Where you expressly opt in, we may send communications including:
- AI business-system insights;
- business-growth and implementation insights;
- invitations;
- programme information;
- professional content;
- information concerning The Leading Space services.
Marketing consent is separate from:
- using the AI Opportunity Check;
- receiving a specifically requested report;
- sending a normal enquiry;
- applying for a programme.
The marketing checkbox is not preselected.
Legal basis for personal-data processing:
Article 6(1)(a) GDPR.
Electronic marketing communications are additionally sent only in accordance with applicable requirements of § 174 Austrian Telecommunications Act 2021 (TKG 2021), including any statutory exceptions that may apply.
You may withdraw consent at any time with effect for the future, including through the unsubscribe function contained in marketing emails.
After withdrawal, minimal suppression information may be retained where necessary to ensure that your opt-out continues to be respected.
4.5 CONTRACTUAL PERFORMANCE
Where a contract exists, we process information necessary to provide the agreed services, including programmes, workshops, AI systems, implementation formats, resource access, client communication, invoicing and project administration.
Legal basis:
Article 6(1)(b) GDPR.
4.6 LEGAL OBLIGATIONS
We may process and retain information where required by tax law, accounting law, company law, regulatory obligations, statutory documentation obligations or lawful authority requests.
Legal basis:
Article 6(1)(c) GDPR.
4.7 PROFESSIONAL B2B RELATIONSHIP MANAGEMENT
We may process proportionate professional information to manage existing business relationships, identify relevant professional contacts, evaluate possible collaboration, maintain CRM records and organise professional business-development activity.
Depending on the circumstances, processing may be based on Article 6(1)(f) GDPR.
This does not override separate requirements applicable to electronic marketing under the TKG 2021.
5. REQUIRED DATA PROCESSING AND OPTIONAL CONSENT
Where a form requires confirmation that the Privacy Policy has been read, this does not mean that all underlying processing is based on consent.
Processing that is necessary to:
- respond to an enquiry;
- provide a specifically requested report;
- take pre-contractual steps;
- perform a contract;
is processed on the applicable GDPR legal basis.
Optional marketing consent remains separate and voluntary.
6. CRM ROUTING AND RECOMMENDATION LOGIC
The Leading Space may use information submitted through forms and the AI Opportunity Check to organise enquiries internally, including by:
- source;
- business segment;
- offer interest;
- Marketing, Sales or Operations area;
- readiness;
- recommendation route;
- delivery preference;
- follow-up status.
Recommended routes may include:
- Client Growth System;
- AI Systems Lab;
- AI Systems Build;
- Enterprise AI Systems;
- General Contact.
These classifications are used for internal organisation, routing, report delivery, CRM visibility and human business review.
They are not investment scoring, credit scoring or regulated financial assessment.
Unless expressly disclosed otherwise, these classifications are not used to make solely automated decisions producing legal effects concerning an individual or similarly significantly affecting an individual within the meaning of Article 22 GDPR.
Material business decisions remain subject to human review.
7. SYSTEME.IO
Where activated, we use Systeme.io for functions that may include:
- CRM and contact management;
- custom fields;
- tags and segmentation;
- forms and funnels;
- requested report emails;
- email marketing;
- double opt-in;
- workflow automations;
- programme administration;
- product and checkout functionality;
- payment-related workflow functionality;
- resource or access management.
Systeme.io may process data submitted through our forms and related CRM, email, checkout and workflow interaction information.
Where Systeme.io processes data on behalf of Expand Future GmbH, the applicable contractual and data-protection arrangements apply.
The exact Systeme.io configuration may vary depending on which functions are activated for The Leading Space at the relevant time.
Further information is available in Systeme.io's own privacy information.
8. HOSTINGER
The website and associated server infrastructure are intended to be hosted using Hostinger services.
Depending on the services used, Hostinger may process data necessary for:
- website hosting;
- server requests;
- storage;
- security;
- technical logs;
- backups;
- domain and infrastructure administration;
- email services where used.
Where Hostinger acts as processor, its applicable data-processing terms and contractual terms govern the processing.
Further information is available in Hostinger's own privacy information.
9. EMAIL COMMUNICATION
Email communication may be used for:
- contact-form notifications;
- requested report delivery;
- service communication;
- programme communication;
- contractual communication;
- marketing communication where permitted.
Contact-form notifications may use the website hosting and server-side mail functionality where configured.
Requested reports, double opt-in and marketing emails may be sent through Systeme.io where activated.
Marketing emails are only sent where the required opt-in exists or another applicable legal basis under electronic-communications law applies.
10. PAYMENT PROVIDERS
Where online payment functionality is activated for a particular offer, external payment providers such as Stripe may process payment-related information.
Depending on the transaction, this may include:
- name;
- email address;
- billing details;
- payment details;
- authentication information;
- transaction information;
- fraud-prevention information.
Expand Future GmbH generally does not receive complete payment-card credentials.
Some services, especially Enterprise AI Systems or individually scoped engagements, may be handled through enquiry, proposal, individual agreement, invoice, bank transfer, direct debit or another agreed payment method instead of public online checkout.
SCHEDULING PROVIDERS / CALENDLY
The Leading Space uses Calendly for selected assessment calls where a scheduling link is made available, including Enterprise AI Systems assessment calls.
Calendly is not used as a universal booking route for all offers.
When you use Calendly, Calendly may process information such as:
- name;
- email address;
- company information;
- selected appointment date and time;
- timezone;
- information entered in booking questions;
- technical information required to provide the booking service.
Calendly processes such information under its own privacy terms and data-processing arrangements.
Calendly may process personal data in the United States and other jurisdictions. Where required, appropriate transfer mechanisms are used according to Calendly's applicable privacy and transfer framework.
If a scheduling provider changes or additional scheduling tools are introduced, the Privacy Policy will be updated where required.
12. ARTIFICIAL INTELLIGENCE AND AUTOMATED SYSTEMS
Expand Future GmbH / The Leading Space may use AI-supported and automated systems internally and in connection with professional services.
Such systems may support activities including:
- research;
- information organisation;
- drafting;
- summarisation;
- classification;
- data analysis;
- CRM organisation;
- workflow automation;
- reporting;
- content assistance;
- business-process support;
- technical implementation.
The public AI Opportunity Check currently uses local scoring and routing logic in the browser and does not call an external AI API.
Where personal data is processed by an external AI or technology provider in another context, we assess the processing relationship and use appropriate contractual and data-protection safeguards where required.
We do not intentionally provide confidential client information or personal data to third-party AI services where doing so would conflict with contractual, confidentiality or data-protection obligations.
Where The Leading Space processes personal data through AI or IT systems on behalf of a Client, controller/processor roles and an Article 28 GDPR Data Processing Agreement are established where required.
Unless expressly disclosed otherwise, AI-assisted or automated systems are not used to make solely automated decisions producing legal effects concerning an individual or similarly significantly affecting an individual within the meaning of Article 22 GDPR.
Human review is used where appropriate taking into account the purpose, nature and risk of the processing.
13. EU ARTIFICIAL INTELLIGENCE ACT TRANSPARENCY
Where an AI system used by Expand Future GmbH / The Leading Space directly interacts with a natural person and applicable law requires disclosure, users will be informed that they are interacting with an AI system unless this is obvious from the circumstances and context.
Where applicable law requires AI-generated or AI-manipulated content to be labelled, disclosed or technically marked, measures required for the legal role actually performed by Expand Future GmbH / The Leading Space will be taken.
The precise requirements applicable to an individual client implementation depend on the relevant AI system, intended purpose and regulatory roles of the parties.
14. COOKIES, LOCAL STORAGE AND SIMILAR TECHNOLOGIES
The website may use cookies, local storage or similar technologies.
Technically necessary technologies may be used for:
- website operation;
- security;
- forms;
- session functionality;
- consent management;
- functionality specifically requested by the user.
Where storage of or access to information on a user's terminal equipment requires consent under applicable law, including § 165(3) Austrian Telecommunications Act 2021, the relevant technology will not be activated before the necessary consent has been obtained.
Optional analytics, advertising or marketing technologies requiring consent therefore remain blocked until the relevant consent has been given.
Rejecting optional technologies does not prevent the operation of strictly necessary website functionality.
Where a consent-management function is provided, users may subsequently change or withdraw their choices.
At the current implementation stage, the website stores the user's privacy choice locally under a consent key and does not activate external analytics or marketing providers unless such providers are later configured.
15. ANALYTICS AND MARKETING TRACKING
At the date of this Privacy Policy, no external analytics, advertising pixel or marketing tracking provider is intentionally activated on the public The Leading Space website.
The website may contain internal browser-event helpers that do not send data to an external provider.
If optional analytics, advertising pixels or comparable non-essential tracking technologies are introduced in the future:
- this Privacy Policy will be updated where required;
- technologies requiring consent will remain blocked before consent;
- the relevant provider and purpose will be identified.
16. SOCIAL MEDIA AND PROFESSIONAL NETWORKING
We may maintain professional profiles on platforms such as:
- LinkedIn;
- Instagram;
- Xiaohongshu / RED;
- YouTube;
- other professional platforms.
When you use an external platform, that platform processes information under its own privacy terms.
We may separately process publicly available professional information for legitimate B2B relationship-management purposes, including:
- name;
- professional role;
- company;
- business profile URL;
- publicly available professional information;
- relevant professional interaction history.
Possible sources include:
- company websites;
- public professional profiles;
- public business registers;
- professional directories;
- conferences and events;
- professional introductions;
- lawfully used business data providers.
Where Article 14 GDPR requires individual information, the relevant information will be provided within the applicable legal period or at the relevant first communication, subject to statutory exceptions.
Electronic promotional outreach remains separately subject to applicable electronic-communications and direct-marketing law.
17. CLIENT PROJECT DATA AND DATA PROCESSING AGREEMENTS
Certain AI, IT, automation or Enterprise AI Systems projects may involve personal data supplied by a Client.
The applicable legal roles are determined by the actual processing activity.
Where Expand Future GmbH acts as processor under Article 28 GDPR, a Data Processing Agreement will be entered into where required.
Clients are responsible for ensuring that:
- data supplied to Expand Future GmbH / The Leading Space was obtained lawfully;
- required transparency obligations have been fulfilled;
- a lawful basis exists for the intended processing;
- required consents or permissions have been obtained;
- their processing instructions are lawful.
18. RECIPIENTS AND SERVICE PROVIDERS
Where necessary and lawful, personal data may be processed by or disclosed to categories of recipients including:
- hosting and infrastructure providers;
- CRM and email providers;
- payment providers;
- IT and software providers;
- AI and automation providers;
- contractors involved in agreed service delivery;
- professional implementation partners;
- accountants;
- legal and professional advisers;
- banks;
- competent authorities where required by law;
- professional counterparties where an introduction has been requested or appropriately authorised.
We do not sell personal data to advertisers.
19. INTERNATIONAL DATA TRANSFERS
Some technology providers and subprocessors may process data outside the European Economic Area.
Where Chapter V GDPR applies, an appropriate transfer mechanism is used where required, such as:
- an adequacy decision;
- the EU-U.S. Data Privacy Framework where applicable;
- Standard Contractual Clauses;
- another legally recognised safeguard.
Where appropriate, supplementary technical or organisational safeguards may also be used.
20. RETENTION
Personal data is retained only for as long as necessary for the respective purpose, contractual relationship, legal obligation or legitimate legal interest.
20.1 WEBSITE AND SECURITY LOGS
Technical logs are retained according to the relevant hosting and security configuration only for as long as reasonably necessary for website operation, security, troubleshooting and incident investigation.
20.2 OPPORTUNITY CHECK RESULTS AND ORDINARY ENQUIRIES
Where an enquiry or Opportunity Check report request does not result in a contractual relationship, relevant CRM and enquiry information is generally retained for up to three years after the last substantive interaction, unless:
- earlier deletion is appropriate;
- continued professional interaction justifies retention;
- a legal claim requires longer retention;
- another lawful basis applies.
20.3 MARKETING DATA
Marketing information is retained until:
- consent is withdrawn;
- the individual unsubscribes;
- the marketing purpose ends.
Minimal suppression information may subsequently be retained where necessary to ensure that the opt-out continues to be respected.
20.4 CLIENT AND CONTRACT DATA
Contractual and project information is retained during the relationship and thereafter for applicable statutory limitation, defence, documentation, accounting and tax periods.
20.5 ACCOUNTING AND TAX INFORMATION
Accounting records, invoices and tax-relevant business documents are generally retained for seven years in accordance with applicable Austrian accounting and tax law, and longer where required in an individual case.
20.6 PROGRAMME AND RESOURCE-ACCESS DATA
Programme participation, access information, onboarding records and support history may be retained for the duration of the programme or access period and thereafter as necessary for contractual documentation, support, defence or statutory retention purposes.
20.7 CLIENT PROJECT DATA
Client project data is retained according to the applicable project agreement, legal obligations, documentation requirements and legitimate defence interests.
Where personal data is processed on behalf of a Client, retention and deletion may also be governed by the relevant Data Processing Agreement.
20.8 CRM RELATIONSHIP INFORMATION
Professional CRM information is periodically reviewed and retained only while a documented lawful business purpose or another legal basis exists.
21. DATA SECURITY
We implement appropriate technical and organisational measures designed to protect personal data against:
- unauthorised access;
- unlawful disclosure;
- alteration;
- accidental loss;
- destruction;
- misuse.
Measures may include, depending on the system:
- access restrictions;
- authentication;
- secure server-side credential storage;
- encrypted transmission where appropriate;
- backups;
- confidentiality obligations;
- processor agreements;
- security procedures.
No electronic system can be guaranteed to be completely secure.
22. YOUR RIGHTS
Subject to applicable legal conditions, you may have the right to:
- information regarding processing;
- access to your personal data;
- rectification of inaccurate data;
- erasure;
- restriction of processing;
- data portability;
- objection to certain processing;
- objection to direct marketing;
- withdrawal of consent;
- complaint to a supervisory authority.
Requests may be sent to:
23. RIGHT TO OBJECT
Where processing is based on Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation.
Where personal data is processed for direct marketing, you have the right to object at any time to processing for that purpose.
24. WITHDRAWAL OF CONSENT
Where processing is based on consent, consent may be withdrawn at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing undertaken before withdrawal.
25. AUSTRIAN DATA PROTECTION AUTHORITY
You have the right to lodge a complaint with a competent supervisory authority.
In Austria:
Österreichische Datenschutzbehörde
Austrian Data Protection Authority
Website:
https://www.dsb.gv.at
26. NO SALE OF PERSONAL DATA
Expand Future GmbH / The Leading Space does not sell personal data to advertisers.
27. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy where necessary due to:
- changes to services;
- new or changed technology providers;
- changes to processing;
- legal or regulatory developments;
- activation of new checkout, email, analytics or automation functionality.
The current version will be published on the website.
28. DATA PROTECTION CONTACT
The Leading Space
a brand of Expand Future GmbH
Expand Future GmbH
Seitenstettengasse 5/37
1010 Vienna
Austria