Privacy Policy

Last updated: October 20, 2026

This policy explains what personal data StrategyCase.com collects, why we collect it, who else handles it, how long we keep it, and what rights you have. It covers this website, our shop, online courses and practice tests, coaching, application reviews, and our newsletter.

Questions about your data? Email info@strategycase.com.

1. Who is responsible for your data

The controller under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) is:

Dr. Florian Smeritschnig StrategyCase.com Baumeistergasse 69 1160 Vienna, Austria Email: info@strategycase.com

StrategyCase.com is a sole proprietorship. We are not required to appoint a data protection officer and have not appointed one. Please send any privacy question or request to the email address above.

“We”, “us” and “our” in this policy mean StrategyCase.com and Dr. Florian Smeritschnig.

2. The short version

• We collect the data we need to run the site, deliver what you buy, and answer your messages.
• Stripe and PayPal handle all payments. We never see or store your full card number.
• If you visit from the EU, EEA, UK or Switzerland, analytics cookies are only set after you accept them in our cookie banner.
• We do not use advertising pixels (such as Meta, LinkedIn or TikTok pixels) on this site.
• We do not sell your data, and we do not make automated decisions about you.

3. What we process and why

3.1 When you visit the website

Each time you open a page, your browser sends technical data: your IP address, the date and time, the page requested, the referring page, your browser and operating system, and the amount of data transferred. Our providers need this data to deliver the page and keep the site secure.

• Hosting: FastComet Inc. (USA). Our website runs on its servers in Frankfurt, Germany.
• Content delivery and caching: QUIC.cloud (QUIC Cloud Inc., USA). Pages are delivered through its server network, which also filters out bots and malicious traffic.
• Security: Wordfence (Defiant, Inc., USA) is a firewall and malware scanner on our server. It logs IP addresses and requests to detect and block attacks, and it checks IP addresses against Defiant’s threat data.

Legal basis: our legitimate interest in a stable and secure website (Art. 6(1)(f) GDPR). Log data is deleted automatically after a short period unless we need it to investigate a specific attack.

3.2 Cookies and consent

Cookies are small text files stored in your browser. Some are strictly necessary, for example to keep your cart, log you in, or secure the checkout. We set those without asking, as § 165(3) of the Austrian Telecommunications Act (TKG 2021) allows. All other cookies need your consent.

We use CookieYes (CookieYes Limited, UK) to ask for and record your consent. It stores your choice in a cookie and keeps a consent record (consent ID, date and time, and the categories you accepted) so we can show what you agreed to. You can change or withdraw your consent at any time through the cookie settings button on the site. Withdrawing consent does not affect processing that happened before.

Legal basis: consent for optional cookies (Art. 6(1)(a) GDPR and § 165(3) TKG 2021). Necessary cookies are based on our contract with you (Art. 6(1)(b) GDPR) or our legitimate interest in a working website (Art. 6(1)(f) GDPR).

3.3 Analytics

Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its parent company is Google LLC (USA). We use Google Analytics to see which pages people read, how they find us, and which pages lead to purchases. That includes shop events such as product views, add-to-cart and purchases.

• If you visit from the EU, EEA, UK or Switzerland, Google Analytics runs in “Consent Mode”. Until you accept analytics cookies, no analytics cookies are set or read. Google’s tag then sends only cookieless signals (for example, that a page was viewed and what your consent status is). Google uses these signals for aggregated, modeled statistics. Once you accept, Google Analytics sets cookies to recognize repeat visits.
• If you visit from anywhere else, analytics cookies are set by default. You can switch them off in the cookie settings.
• Google Analytics 4 does not log or store IP addresses. We keep analytics data for a maximum of 14 months.
• Google Signals is switched on. If you have accepted analytics cookies and are signed in to a Google account with ad personalization turned on, Google may link your visit to that account to produce cross-device reports. We only see aggregated reports, never individual Google accounts.
• Legal basis: your consent (Art. 6(1)(a) GDPR). For the cookieless signals sent before you decide, our legitimate interest in basic, aggregated measurement (Art. 6(1)(f) GDPR).
• You can also block Google Analytics with Google’s browser add-on. Google’s privacy policy: policies.google.com/privacy.

Koko Analytics. We also count page views with Koko Analytics, which runs on our own server. It sets no cookies, stores no IP addresses, and shares no data with anyone. It only produces totals, such as page views and referring websites. Legal basis: our legitimate interest in simple, privacy-friendly statistics (Art. 6(1)(f) GDPR).

3.4 Fonts

Our website loads its fonts from Google Fonts (Google Ireland Limited). To show them, your browser connects to Google’s servers, which receive your IP address. Legal basis: our legitimate interest in displaying the site consistently on all devices (Art. 6(1)(f) GDPR).

3.5 Buying from us and your customer account

Our shop runs on WooCommerce and our courses and practice tests run on LearnDash. Both are installed on our own server, so your order and account data are stored in our database.

When you order, we process your name, email address, billing address and country, the products you bought, the price, the payment method, and the date. WooCommerce also stores your IP address and browser type with the order to help prevent fraud. If you have an account, we also store your username and password (encrypted), your downloads, and your progress and results in courses and practice tests, so you can pick up where you left off. Signing up for the free Case Interview Foundations course also creates an account.

If you have accepted analytics cookies, WooCommerce saves the source of your visit (for example a Google search or a newsletter link) with your order. This shows us which channels lead to sales.

What you have to provide: we need your name, email address and billing details to complete an order and issue an invoice. Without them we can’t sell to you.

Legal basis: performing our contract with you (Art. 6(1)(b) GDPR); keeping invoices and accounting records as tax law requires (Art. 6(1)(c) GDPR, § 132 BAO, § 212 UGB); preventing fraud (Art. 6(1)(f) GDPR); and your consent for the order-source data (Art. 6(1)(a) GDPR).

3.6 Payments

• Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland) handles card payments and Apple Pay. You enter your card details directly into Stripe’s secure fields. We only receive the payment status and limited details, such as the card brand and the last four digits. Stripe also uses payment and device data to prevent fraud. Stripe’s privacy policy
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) handles PayPal payments. You log in to PayPal and pay there. We receive the payment confirmation and the name, email and address linked to the payment. PayPal’s privacy statement

Both providers are also responsible in their own right for some of this processing, for example to meet financial regulations and to prevent fraud. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR) and preventing fraud (Art. 6(1)(f) GDPR).

3.7 Coaching and application reviews

Coaching enquiries. The form on our coaching pages asks for your name, email address, background and case experience, goals (target firms, role, timeline), and how we can help. We use this to judge whether coaching is a fit, reply to you, and plan your sessions.

Coaching sessions. During coaching we process what you share about your background, applications and interview performance, plus our session notes. Sessions take place over Google Meet (Google Ireland Limited) or Zoom (Zoom Communications, Inc., USA). The provider processes your name, email address, connection data and the live audio and video of the call. We never record coaching sessions.

Resume and cover letter reviews. You send us your resume and/or cover letter, which usually contain your education, work history and contact details. We use your documents only to review and edit them. You decide what they contain. We don’t need sensitive details such as a photo, date of birth or health information.

Legal basis: steps before a contract and performing the contract (Art. 6(1)(b) GDPR).

3.8 McKinsey Solve simulations (partner access)

The simulation access included with “McKinsey Solve Game Guide and Simulations” is provided by our partner PSG Cracked. When your order is completed, we automatically send the partner your first and last name, email address, order number and status, customer ID, and the products in that order, so they can set up your access automatically. The partner processes this data as a separate controller.

Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).

3.9 Contact forms, free downloads and the readiness diagnostic

• Contact forms (coaching, free consultation, universities and clubs): name, email address, subject and message. We use them to answer you.
• Book bonus form: your name and email address. We use them to send readers of our book the bonus materials and, with your consent, add you to our email list (see 3.10).
• Case interview readiness diagnostic: your answers (recruiting stage, target firms, time until your interview, how many cases you have practiced, where you feel least confident, and who has given you feedback), your first name and your email address. We use them to send you your result and recommendations and, with your consent, add you to our email list (see 3.10). The diagnostic scores your answers automatically to suggest next steps. This has no legal or similarly significant effect on you, so it is not an automated decision under Art. 22 GDPR.

The contact forms do not sign you up for our email list. All forms block spam with a simple math question or a hidden field, without any third-party service. If you email us directly, we process your email address and whatever your message contains.

Legal basis: steps before a contract if your message is about a purchase or booking (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering you and delivering what you asked for (Art. 6(1)(f) GDPR). Adding you to our email list is based on your consent (Art. 6(1)(a) GDPR).

3.10 Newsletter and email list

You join our email list when you sign up for the newsletter, or when you agree to it while requesting the book bonus materials or your readiness diagnostic result. We then send you emails with case interview tips, guides and offers for our products and coaching. We use MailerLite (MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland), which stores data in the EU. We process your email address and, if you give it, your name. MailerLite records the date and time of your sign-up, your IP address and the form you used, so we can prove your consent. Our emails contain tracking pixels and tracked links that show us whether emails are opened and which links are clicked. We use this to improve our emails.

You can unsubscribe at any time with the link in every email or by writing to us. After you unsubscribe, we keep your email address on a block list so we don’t email you again.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). The block list is based on our legitimate interest in respecting your choice (Art. 6(1)(f) GDPR).

3.11 Reviews

Product and course pages show customer reviews. If you write one, we publish your review, your rating and the name you choose.

After a purchase, we send you an email asking you to review what you bought. For this we use your name, email address and the products in your order. You can refuse these emails at checkout, and every review request includes a link to stop them.

Legal basis: your consent when you submit a review (Art. 6(1)(a) GDPR). Review requests are based on our legitimate interest in customer feedback (Art. 6(1)(f) GDPR) and § 174(4) TKG 2021, which allows us to contact customers about products they have bought from us.

3.12 Login protection

Our account login and registration page uses Google reCAPTCHA (Google Ireland Limited) to tell humans from bots. reCAPTCHA analyzes your IP address, browser data and how you interact with the page. Legal basis: our legitimate interest in protecting customer accounts from automated attacks (Art. 6(1)(f) GDPR). Google’s privacy policy and terms apply.

3.13 Emails from our website

Order confirmations, account and password emails, and course notifications are sent through our host’s mail server. We keep a log of these emails for a limited time so we can fix delivery problems. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in reliable delivery (Art. 6(1)(f) GDPR).

3.14 Links to other websites

We link to LinkedIn, Instagram, X, Amazon (for our books) and other websites. These are plain links: no data goes to those services until you click one. After that, their privacy policies apply.

4. Who receives your data

We only share your data with the providers named in this policy, and only as far as they need it to do their job. Most of them process data on our behalf under a data processing agreement (Art. 28 GDPR). Stripe, PayPal and our Solve simulation partner are also responsible for their own processing.

Where the law requires it, we also pass invoice data to our tax advisors and to the tax authorities.

5. Transfers outside the EU

Some providers are based in, or use servers in, the USA or the UK.

• UK: the European Commission has recognized that the UK protects personal data adequately (Art. 45 GDPR).
• USA: where a provider is certified under the EU-U.S. Data Privacy Framework (for example Google, Zoom, Stripe and PayPal’s US group companies), the transfer relies on the European Commission’s adequacy decision for that framework. Otherwise we rely on the Commission’s Standard Contractual Clauses (Art. 46 GDPR).

You can ask us for a copy of the safeguards that apply.

6. How long we keep your data

7. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• correct inaccurate data (Art. 16)
• delete your data (Art. 17)
• restrict how we process it (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on our legitimate interests, and to direct marketing at any time (Art. 21)
• withdraw your consent at any time, without affecting processing that happened before (Art. 7(3))

To use any of these rights, email info@strategycase.com. We answer within one month. We may ask you to confirm your identity before we release or delete data.

8. Complaints

If you think we have mishandled your data, please contact us first so we can fix it. You also have the right to complain to a data protection authority, either in the EU country where you live or work, or to ours:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40-42, 1030 Vienna, Austria Phone: +43 1 52 152-0 Email: dsb@dsb.gv.at Website: www.dsb.gv.at

9. How we protect your data

The whole site is served over encrypted HTTPS connections. Our server is protected by a firewall, malware scanning and bot filtering. Admin access requires two-factor authentication, and we keep the software up to date. Only we and the providers listed above can access your data, and only as far as they need to. No system is perfectly secure. If a data breach puts your rights at risk, we will notify the authority and, where required, you (Art. 33 and 34 GDPR).

If you have an account, please keep your password to yourself.

10. Age

Our website and services are intended for adults, as set out in our Terms & Conditions. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, please contact us and we will delete it.

11. Changes to this policy

We update this policy when our services or the tools we use change. The date at the top shows when it was last updated.