Privacy Policy
Last updated:
The following provides information pursuant to Art. 13 and 14 of the General Data Protection Regulation (GDPR) regarding which personal data is processed in connection with visiting this website as well as during the initiation and execution of business relationships, for which purposes this occurs, and which rights you have.
1. Controller
The controller within the meaning of Art. 4(7) GDPR is:
2. Principles of processing
The processing of personal data solely takes place on the basis of the applicable law (GDPR, Austrian Data Protection Act, Telecommunications Act 2021). Only the data required for the respective purpose is collected. It is stored no longer than necessary and is not passed on to third parties without a legal basis.
This website can generally be used without providing personal data. Providing data is only required where this is expressly stated, for instance in the contact form.
A complete overview of the service providers used can be found in the section Recipients and service providers.
3. Processing when visiting the website
3.1 Website hosting and server log files
Each time the website is accessed, the web server automatically records technical access data in what are known as log files:
- IP address of the requesting device
- Date and time of access
- Accessed URL or filename
- Amount of data transferred and HTTP status code
- Referrer URL (previously visited page)
- Browser type, browser version, and operating system
- Purpose
Delivering the website, ensuring the stability and security of the system, detecting and preventing abusive access, and troubleshooting.
- Legal basis
Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and uninterrupted operation of the website.
- Retention period
30 days. After that, the log files are deleted automatically. Where there are concrete indications of unlawful access, the entries concerned are retained until the incident has been clarified conclusively.
This data is not merged with other data sources, nor is it evaluated for advertising purposes.
3.2 Cookies and LocalStorage
The website does not use cookies for analysis, marketing, or tracking purposes. Therefore, no consent banner is used.
When selecting a color scheme (light/dark), an entry is created locally in the visitor's browser (localStorage) so that the selection is preserved upon a return visit. The stored value is not transmitted to the server and does not allow for any inference regarding a person. Deleting it is possible at any time in the browser settings.
Consent under § 165(3) of the Austrian Telecommunications Act 2021, or the corresponding national provisions implementing Art. 5(3) of Directive 2002/58/EC, is not required for this, as the storage is strictly necessary for the requested function.
3.3 Audience measurement
The analytics software Umami is used for the statistical evaluation of website usage. The software is self-hosted. Thus, no data is transferred to the software manufacturer or an external analysis service. The infrastructure mentioned in the section Recipients and Service Providers is used.
Umami does not use cookies and refrains from the permanent recognition of individual persons. Only aggregated data is collected:
- Pages visited and time spent
- Referrer URL
- Campaign parameters within the address (UTM Parameters)
- Browser, operating system, and device type
- Screen resolution and language setting
- Country of origin (derived from the IP address)
- Predefined interactions (e.g., clicks on specific buttons or submitting the contact form)
For interactions, only the fact that the respective action took place is recorded. Entered content is not captured. Mouse and scroll movements, keyboard inputs, and the displayed page content are not recorded.
The IP address is not stored. It is used solely to generate a pseudonymous hash value that is rotated daily and does not allow for identification of an individual. No cross-device profiles are created. No data is stored on the visitor's device as part of the audience measurement process.
- Purpose
Understanding how the service is used, further development of the website, and to analyze which channels visitors use to access the website.
- Legal basis
Art. 6(1)(f) GDPR. The legitimate interest lies in the statistical analysis of usage behavior in order to improve the service. The processing is deliberately designed to require the smallest amount of data for this purpose.
- Retention period
12 months in aggregated form.
You may object to audience measurement at any time, effective for the future. To do so, use the button in the section Right to object.
4. Getting in touch and business relationships
4.1 Contact form
A contact form is available on the website. When using it, the following data is processed:
- Name
- Email address
- Company
- Reason for inquiry
- Services
- Content of the message
- IP address of the visitor's device
- Time of submission
Providing the data is voluntary. Without the entries marked as mandatory, processing of the inquiry cannot take place.
- Purpose
Processing and responding to inquiries and, if applicable, the initiation of a contractual relationship.
- Legal basis
Art. 6(1)(b) GDPR for inquiries in connection with a possible engagement (pre-contractual measures), Art. 6(1)(f) GDPR on the basis of legitimate interest in responding to inquiries and in the secure operation of the contact form.
- Processing
Data submitted through the form is stored in a database on the infrastructure mentioned in the section Recipients and Service Providers. Additionally, an e-mail notification is generated. The notification is sent using the service provider mentioned in the same section.
To prevent abuse, the number of transmissions per IP address is limited, and the message text is analyzed for characteristics of unwanted mass mailings. The analysis takes place on the same infrastructure that is used for the remaining processing of form data. No transfer to additional recipients takes place. Submitted contents are not used to train models. Further handling of a message classified as spam is decided after manual review. No decisions are made solely by automated means.
- Retention period
The inquiry is stored until it has been fully processed and no further questions are to be expected. If a contractual relationship arises, the statutory retention periods specified in the section Contract and Customer Data apply. IP addresses processed to limit the number of transmissions are deleted after 24 hours. Messages classified as spam are deleted after 7 days (to allow for the processing of inquiries that were erroneously filtered out). Deleted data may be retained in backups for an additional 30 days. An objection may be lodged or deletion requested at any time, provided there is no statutory obligation to retain the data.
4.2 Contact by email or telephone
When contacting via e-mail or telephone, the transmitted data (in particular name, contact details, and the content of the communication) is processed in order to handle the request.
- Legal basis
Art. 6(1)(b) GDPR (pre-contractual measures or contract performance) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).
4.3 Contract and customer data
In the course of initiating, concluding, and carrying out consulting and development services, the necessary data of the customers as well as their contact persons are processed, in particular master data, contact data, contract and billing data, as well as project-related communication.
- Legal basis
Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (fulfillment of legal obligations, in particular record-keeping and retention obligations under tax and company law).
- Retention period
After the contractual relationship ends, the data is deleted as soon as it is no longer required for the purpose of processing. Statutory retention periods remain unaffected, in particular the seven-year retention obligation under § 132 of the Austrian Federal Fiscal Code and § 212 of the Austrian Commercial Code. Processing is restricted for the duration of the retention period.
4.4 Invoicing and payment processing
Invoices are created using self-operated software. They are transmitted via e-mail. In doing so, the name and address of the invoice recipient, the description of services, the amount, the invoice number, and the payment deadline are processed.
Payment is made via bank transfer. From the incoming payment, the name of the account holder, the IBAN, the reason for payment, the amount, and the booking date are processed. A commissioned credit institution is involved in the processing, which acts as an independent controller and is subject to its own supervisory obligations.
To fulfill tax and corporate law obligations, invoice and payment data are transferred to the accounting software mentioned in the section Recipients and Service Providers.
- Legal basis
Art. 6(1)(b) GDPR for carrying out the contractual relationship; Art. 6(1)(c) GDPR for meeting statutory record-keeping and retention obligations.
- Retention period
The statutory retention periods mentioned above apply.
4.5 Boundary: Acting as a processor
Within the scope of providing services, access to personal data controlled by customers is carried out exclusively as a processor under Art. 28 GDPR, on the basis of corresponding data processing agreements.
This privacy policy does not apply to such activities.
5. Recipients and service providers
Your data is passed on only if it is necessary to fulfill the purposes stated above or if a legal obligation exists.
The following service providers are used to operate the website and to conduct business. Data processing agreements under Art. 28 GDPR are in place with all of them.
| Service provider | Data categories | Purpose and legal basis | Place of processing |
|---|---|---|---|
| Hetzner Online GmbHIndustriestr. 25, 91710 Gunzenhausen, Germany | Access data (server log files), contents of contact inquiries, pseudonymous usage data, invoice and contract data, backups | Provision and security of the website, handling of inquiries, abuse prevention, audience measurement, carrying out contractual relationships, resilience, and recoverabilityArt. 6(1)(b), (c), and (f) GDPR | EU/EEA |
| Scaleway SAS8, Rue de la Ville-l'Évêque, 75008 Paris, France | Contents of contact inquiries | Delivery of notifications for inquiriesArt. 6(1)(b) or (f) GDPR | EU/EEA |
| Proton AGRoute de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland | Contact data, contents of correspondence, business documents transmitted via email (including offers, order confirmations, and invoices) | Communication with prospects, initiation and handling of contractual relationshipsArt. 6(1)(b), (c), and (f) GDPR | Switzerland |
| manubu gmbhAm Concorde Business Park F, 2320 Schwechat, Austria | Invoice and receipt data, customer master data, payment data | Bookkeeping, fulfillment of tax and corporate law record-keeping obligationsArt. 6(1)(c) GDPR | Austria |
Data also reaches the following recipients who are controllers in their own right. Processing is subject to their own privacy policies. There is no data processing agreement covering it. These recipients are named by category. Their specific identity will be provided upon request.
| Recipient | Data categories | Reason for the transfer |
|---|---|---|
| Credit institution | Payment data (particularly name and IBAN) | Payment processing |
| Tax advisor | Invoice and receipt data | Preparing tax returns and annual financial statements |
Data is transferred to Switzerland in the course of email communication. The European Commission has issued an adequacy decision for Switzerland pursuant to Article 45 of the GDPR. In doing so, the Commission has determined that an adequate level of protection for personal data is ensured there. No further transfers take place to countries outside the EU or the EEA.
6. Your rights
Data subjects have the following rights against the controller, in accordance with applicable legal provisions:
- Access (Art. 15 GDPR) to the processed data
- Rectification (Art. 16 GDPR) of inaccurate or incomplete data
- Erasure (Art. 17 GDPR) provided there is no statutory obligation to retain the data
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR) for data that is processed by automated means on the basis of consent or of a contract
- Objection (Art. 21 GDPR) to processing based on Art. 6(1)(f) GDPR
- Withdrawal of consent (Art. 7(3) GDPR) with effect for the future
An informal message to the contact address listed at the beginning of this document is sufficient to exercise these rights.
6.1 Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data carried out pursuant to Art. 6(1)(f) GDPR. The data in question will then no longer be processed, unless compelling legitimate grounds can be demonstrated that override your interests, rights, and freedoms, or the processing is necessary to establish, exercise or defend legal claims.
Objection to audience measurement: You can use the following button to object to audience measurement with effect for the future. An entry will be created in your browser's local storage that prevents any further data collection. This entry contains no personal data and serves exclusively to implement your objection. It is stored at your express request. You can revoke your objection at any time using the same button. Please note that the objection is technically tied to the respective browser. If you change your browser or device, or after deleting the website data, you need to exercise the objection again.
6.2 Right to lodge a complaint
If you believe that the processing of data violates data protection law, you have the right to lodge a complaint with a supervisory authority. In Austria, this is:
In accordance with Art. 77(1) GDPR, complaints may also be lodged with the supervisory authority of the data subject’s usual place of residence, place of work, or the location of the alleged infringement.
7. Data security
The website uses TLS encryption to protect the transmission of content between your device and the server against unauthorized access. Furthermore, technical and organizational measures in accordance with state-of-the-art technology pursuant to Art. 32 GDPR are used to protect your data against loss, manipulation, and unauthorized access.
8. No automated decision-making
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
9. Changes to this privacy policy
This privacy policy will be updated whenever changes to the services, the technology used, or the legal situation make it necessary. For your visit to the website, the version available at the time of access shall apply.