Privacy policy

Controller

Marc Lenhof de la Gardelle
Postgasse 8b, 1010 Vienna, Austria
Data protection questions: privacy@exvais.com

In this policy, “we” refers to the controller.

Visiting the site

The site is provided by Netlify, Inc. (USA). When you open it, Netlify processes the data every browser transmits: IP address, time, requested address and browser details. This is necessary to deliver the site and protect it against misuse. The legal basis is our legitimate interest in a secure and stable site (Art. 6(1)(f) GDPR). Under its data processing agreement, Netlify keeps logs available for 90 days and archived for one year.

From these logs, Netlify compiles visitor statistics for us (Netlify Web Analytics), including page views, number of visitors, most visited pages, referring sources and visitor locations. It works without cookies and without any script on the site; we see only aggregated figures, not individual visitors. The legal basis is our legitimate interest in understanding how the site is used and improving it (Art. 6(1)(f) GDPR).

The site sets no cookies and loads no content from other providers. The fonts are delivered with the site.

Contact form

When you write to us through the form, we process your name, your email address, your “I am” selection, your message and, if you give it, your organisation, together with technical details of the submission such as the time, IP address and browser details. We use these details to answer your enquiry.

If your enquiry concerns an investment or a collaboration to which you yourself are to become a party, the legal basis is steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Otherwise, for example if you write on behalf of an organisation, it is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Your details are voluntary. Without your name, email address, “I am” selection and message we cannot handle the enquiry.

Netlify receives the enquiry, stores it and checks it for spam with the Akismet service of Automattic Inc. in the USA. Netlify then sends it by email to our mailbox at IONOS; IONOS processes emails in the EU or the EEA.

After receipt, we send an automatic confirmation to the email address you gave. For this, we pass your email address to the email delivery service Mailgun of the Sinch group, which we use in its EU region. The confirmation does not contain your message. Under our plan, Mailgun keeps delivery logs for one day. If delivery fails, Mailgun keeps your address on a suppression list until we remove it.

At Netlify, the enquiry is deleted automatically no later than 31 days after it arrives. In our mailbox we delete it twelve months after the last message. If the enquiry leads to talks about an investment or a collaboration, we keep it for as long as those talks and the legal obligations arising from them require.

Recipients

Netlify, Inc. (hosting and form), Sinch Email with its Mailgun service (confirmation) and IONOS (email) process the data on our behalf under data processing agreements (Art. 28 GDPR). Netlify uses its own sub-processors for this, including Automattic Inc. for the spam check.

Transfer to the USA

Netlify is certified under the EU-US Data Privacy Framework. The transfer is based on the adequacy decision of the European Commission (Implementing Decision (EU) 2023/1795). As a fallback, the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914), which form part of the contract with Netlify, apply. For Mailgun, the contract with Sinch provides for the EU-US Data Privacy Framework and likewise the standard contractual clauses.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 18 and 20 GDPR). To exercise them, write to privacy@exvais.com.

Right to object

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). To do so, write to privacy@exvais.com.

Complaints

You may lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at.

No automated decisions

There is no automated decision-making and no profiling within the meaning of Art. 22 GDPR.