Privacy policy

SAVVATA IT Services e.U.
Kohlagasse 43, 9020 Klagenfurt am Wörthersee, Austria
DI Alexander Steinwender, MBA
Alexander.Steinwender@savvata.com
savvata.com

Technically necessary connection data is processed when you access this website. This may include the IP address, date and time, requested address, amount of data transferred, referrer, browser and operating system. Processing is necessary to provide the website securely and reliably and to defend against attacks. It is based on legitimate interests under Article 6(1)(f) GDPR. The website, database and form API are hosted by Infomaniak Network SA in Switzerland. The European Commission has adopted an adequacy decision for Switzerland.

Your selected language is stored only in your browser's local storage under the key savvata_language. On your first visit, the browser language may be read to select the appropriate language version. This information is not transmitted to Savvata and can be removed through your browser's website data settings.

When you use the contact form, Savvata processes your name, email address, subject, message, language, delivery status and necessary timestamps. The request is stored in a MariaDB/MySQL database and forwarded through an authenticated SMTP service to a recipient address configured exclusively on the server. Processing is based on Article 6(1)(b) GDPR where the request relates to contractual or pre-contractual matters, and otherwise on the legitimate interest in communication under Article 6(1)(f) GDPR. Providing the data is voluntary but necessary for a response.

The form is protected by an invisible honeypot field, a self-hosted ALTCHA CAPTCHA and rate limiting. For rate limiting, the IP address is processed only temporarily and converted together with the endpoint into a non-reversible HMAC key. Only this key, a counter and the time window are stored for no more than one hour. A hash of an already used CAPTCHA solution is stored for no more than 15 minutes to prevent reuse. Processing is based on the legitimate interest in website security and abuse prevention under Article 6(1)(f) GDPR.

Access is limited to authorised persons and Infomaniak Network SA as the processor required for hosting, database operation and SMTP delivery, and only to the extent necessary. Form data is not sold or used for advertising or profiling.

Contact requests are deleted after they have been fully handled as soon as they are no longer needed for communication, potential legal claims or statutory obligations. Expired rate-limit and CAPTCHA records are removed regularly.

The website uses no analytics, advertising or tracking services and no cookies for such purposes. No profiling or solely automated decision-making producing legal or similarly significant effects takes place.

Subject to the GDPR, you have rights including information, access, correction, deletion, restriction, portability and objection. To exercise your rights, contact the email address stated above. You also have the right to complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, at dsb.gv.at.