Legal

Privacy Policy

This page describes what actually happens today — nothing more, nothing less.

Introduction and Overview

We have written this privacy policy in order to explain to you, in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable national laws, which personal data (data for short) we as the controller — and the processors commissioned by us (e.g. providers) — process, and what legal options you have. The terms used are to be considered gender-neutral.

In short: we provide you with comprehensive information about any personal data we process — and describe only what actually happens on this website, nothing more and nothing less.

If you still have questions, please contact the responsible party named below or the contact details in the Legal Notice (office@alimax.at).

Scope

This privacy policy applies to all personal data processed by our company and to all personal data processed by companies commissioned by us (processors). With the term personal data, we refer to information within the meaning of Article 4 No. 1 GDPR, such as the name, email address and postal address of a person.

The scope of this privacy policy covers this website (alimax.at) and email communication with us. Should we enter into legal relations with you outside of these channels, we will inform you separately if necessary.

Cookies and local storage

This website does not use analytics or tracking cookies. Aside from the forms described further below, it does not load any third-party content. The only information stored locally in your browser is your light/dark theme preference. It lives exclusively in your device's localStorage, never leaves it, and is never transmitted to us — it is not a cookie.

In the following privacy policy, we provide you with transparent information on the legal bases of the General Data Protection Regulation that enable us to process personal data. As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016, available online at EUR-Lex at eur-lex.europa.eu.

We only process your data if at least one of the following conditions applies:

  1. Consent (Article 6(1)(a) GDPR) — for example, by submitting a form.
  2. Contract (Article 6(1)(b) GDPR) — pre-contractual measures, such as handling your enquiry.
  3. Legal obligation (Article 6(1)(c) GDPR) — for example, retaining invoices for accounting purposes.
  4. Legitimate interests (Article 6(1)(f) GDPR) — for example, operating this website securely and efficiently.

In addition to the EU regulation, the Austrian Data Protection Act (Datenschutzgesetz, DSG) also applies to us.

Contact details of the controller

If you have any questions about data protection or the processing of personal data, you will find the contact details of the controller in accordance with Article 4(7) GDPR below:

Alimax FlexCo
Alina Sophie Taborsky, Maxim Dvoynishnikov
Friedlgasse 36/2, 1190 Wien, Österreich

Email: office@alimax.at
Phone: +43 681 81105429

Further details (company register number, VAT ID, supervisory authority) are in the Legal Notice.

Storage period

We store personal data only for as long as is absolutely necessary for the provision of our services. This means we delete personal data as soon as the reason for the data processing no longer exists. In some cases, we are legally obliged to keep certain data stored even after the original purpose no longer exists, such as for accounting purposes.

If you want your data deleted or wish to revoke your consent, the data will be deleted as soon as possible, provided there is no obligation to continue storing it.

Rights under the General Data Protection Regulation

In accordance with Articles 13, 14 GDPR, we inform you of the following rights, to ensure fair and transparent processing of data:

  • Right to access (Art. 15 GDPR) — whether and which data we process about you.
  • Right to rectification (Art. 16 GDPR).
  • Right to erasure, "right to be forgotten" (Art. 17 GDPR).
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR).
  • Right to object (Art. 21 GDPR).
  • Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR).
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

An informal message to office@alimax.at is enough to exercise these rights.

Austria Data Protection Authority

If you believe that the processing of your data violates data protection law, you can complain to the Austrian data protection authority:

Manager: Dr. Matthias Schmidl
Address: Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

Security of data processing

To protect personal data, we have implemented both technical and organisational measures. Wherever possible, we encrypt or pseudonymise personal data. Article 25 GDPR refers to "data protection by design and by default" — we consider security both in our own software (e.g. forms) and when choosing our service providers.

TLS encryption with https

We use HTTPS to transfer data securely over the internet — the entire transmission of data from your browser to our web server is secured, nobody can "listen in". You can recognise this by the lock icon in your browser and the use of https instead of http in our web address. This fulfils data protection by design under Article 25(1) GDPR.

Communications

If you contact us — by phone, email or online form — we process the data you provide solely to handle your enquiry and the related business transaction. The legal basis is Article 6(1)(a) GDPR (consent, e.g. by submitting a form), Article 6(1)(b) GDPR (pre-contractual measures) or Article 6(1)(f) GDPR (legitimate interest in answering your enquiry).

  • Phone: call data is stored pseudonymised by the telecommunications provider used.
  • Email: your message is stored on the respective device and on the email server.
  • Online forms: see the dedicated "Forms on this website" section below.

The data is deleted once the business case is concluded and legal requirements allow.

Web hosting

Every time you visit this website, certain information — including personal data such as IP address, time of visit and browser used — is automatically created and stored. The legal basis for this is Article 6(1)(f) GDPR (legitimate interest in the secure, stable operation of this website).

Scaleway (web hosting)

We host this website with Scaleway. The service provider is the French company Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France. You can find out more about the data processed through the use of Scaleway in their privacy policy at scaleway.com/en/privacy-policy.

Forms on this website

Where a page carries a form — for example the contact form at /contact, the partner form at /partners/become, the interest form for the Twin City EdTech Testbed, or the newsletter form in the footer of every page — we process the data you enter solely to handle your enquiry or sign-up. Every one of these forms uses the same two services, Formspark and Botpoison, described in detail below. Both only become active once you actually use a form — not merely on visiting the page.

Formspark (form delivery)

When you submit a form, the data you entered — depending on the form, e.g. name, email address and your message — is sent directly to Formspark, which forwards it to our email address. Formspark additionally processes technical data such as IP address, browser type and access time. The operator is Trampoline Software SRL, based in Belgium. Per Formspark, the data is stored in Ireland and Germany, i.e. within the European Economic Area (EEA). According to Formspark, some of the sub-processors it uses are based outside the EEA; Formspark lists them in its privacy policy (formspark.io/legal/privacy-policy). The legal basis is Article 6(1)(a) or (f) GDPR. Formspark, per its own privacy policy, stores the data only as long as necessary to process it, without naming a fixed period; we delete the copy that reaches our inbox once your enquiry is resolved. A data processing agreement is in place with Formspark (Formspark as processor, Alimax FlexCo as controller).

Botpoison (spam protection)

To prevent automated spam submissions, we use Botpoison — also a service of Trampoline Software SRL (Belgium), with data stored in Ireland; again, no transfer to a third country takes place. Botpoison processes technical data such as IP address, browser type and the referring page, as well as a short-lived session token that lives only in your browser's sessionStorage, allows no inference about your identity, and is deleted when the tab is closed. The content of your message is not transmitted to Botpoison. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in protecting the form and our inbox from automated abuse without a visible CAPTCHA. Botpoison, per its own policy, likewise stores data only as long as necessary, without naming a fixed period.

Fonts (self-hosted)

We use the DM Sans and Space Grotesk font families, originally published as Google Fonts. We serve them locally from our own server rather than from Google's servers — this means there is no connection to Google and no transfer of your IP address or other data to Google. This website does not load fonts from any external provider.

Explanation of terms used

We always try to make our privacy policy as clear and comprehensible as possible. Below is an alphabetical list of important terms used.

Processor
A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Consent
Any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of personal data relating to them.
Personal data
Any information relating to an identified or identifiable natural person.
Controller
The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processing
Any operation performed on personal data, whether or not by automated means, such as collection, storage, alteration, retrieval, use, disclosure, restriction, erasure or destruction.

Closing remarks

We take the protection of your personal data seriously, and wanted to tell you not only which data is processed, but why — and what deliberately does not happen on this website: no tracking, no analytics cookies, no sharing with advertising networks. If you have any questions about data protection on this website, please do not hesitate to contact us.