Privacy policy

This is a translation for convenience. The German version of this policy is the binding one.

Controller

Name

Michael Steinmötzger

Address

Erzherzog-Karl-Straße 84–88/8/8, 1220 Vienna, Austria

Email

info@ionvo.at

Questions about data protection go to the same address. We are currently not required to appoint a data protection officer under Art. 37 GDPR.

Hosting

The site runs as a container on a server we operate ourselves. The server is located at [hosting provider, location]. The provider supplies the machine and the network connection and may process connection data such as your IP address to run its network and fend off attacks.

Processor

[hosting provider, address]

Location

[data centre location]

Legal basis

Art. 6(1)(f) GDPR, legitimate interest in secure and stable operation

Contract

Data processing agreement under Art. 28 GDPR

The connection between your browser and the server is encrypted with TLS.

Server log files

On every request the server writes one line to a log file: IP address, time, the address requested, status code, amount of data transferred, the page you came from if your browser sends it, and browser and operating system. We use these lines to find faults and fend off attacks. We do not combine them with other data and do not evaluate them by person.

Purpose

Operating the site, security, fault finding

Legal basis

Art. 6(1)(f) GDPR, legitimate interest in secure and stable operation

Retention

As long as needed for these purposes, after which the log files are deleted. While an attack is being investigated, we keep the lines concerned until it is closed.

Waitlist and newsletter

When you join the waitlist or subscribe to the newsletter, we store your email address and the time you signed up. We then send you an email with a confirmation link. Your entry only becomes valid once you click it; we also store the time of confirmation as evidence of your consent. The waitlist and the newsletter are two separate lists: leaving the newsletter keeps you on the waitlist.

After joining the waitlist you can answer three questions: which trade, how many employees, how you write your invoices today. The answers are optional. We store them, together with the language of the site and the place where you signed up, as attributes of your address. They help us finish IONVO first for the businesses that need it most, and to write to you only about what concerns you.

We keep the lists with the software Listmonk on our own server. The emails themselves, the confirmation mail and every newsletter, are sent through Amazon Simple Email Service (SES). Amazon receives your email address and the content of the message for that and processes both on our behalf.

Purpose

Waitlist: a message when IONVO launches. Newsletter: a few times a year, what is happening in e-invoicing and construction billing and what is new in IONVO.

Legal basis

Art. 6(1)(a) GDPR, your consent

Retention

Until you unsubscribe or withdraw your consent. After that we delete your address and the attributes stored with it.

Processor

Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, for sending the emails through Amazon SES

Contract

Data processing agreement under Art. 28 GDPR (AWS GDPR Data Processing Addendum). Where Amazon Web Services, Inc., based in the USA, accesses data, the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR apply; Amazon Web Services, Inc. is also certified under the EU-US Data Privacy Framework.

When you submit the form, we process your IP address briefly in the server’s memory to limit mass sign-ups. It is not written to a log file and is discarded after one hour at most. The legal basis is Art. 6(1)(f) GDPR, legitimate interest in protecting the form from abuse.

You can unsubscribe through the link at the end of every email or with a message to info@ionvo.at. It takes effect at once.

More on how Amazon handles data is in the AWS privacy notice.

Audience measurement with PostHog

We want to know which pages are read, whether the site works and whether visitors come back. For that we use PostHog, audience measurement software. It does not run on our server but in the provider's European cloud in Frankfurt am Main; the provider processes the data on our behalf.

Without your consent PostHog sets no cookie and stores nothing on your device. On a page view PostHog receives the page viewed, the referring page, browser, operating system, device type, screen size, language and your IP address. From the IP address the server derives country and region and then discards it; it is not stored. To attribute one day's views to the same browser, PostHog builds a hash from the IP address, browser data and a random value that changes daily, from which neither the address nor the person can be recovered. The next day the same browser is a new visitor.

If you click “Allow the cookie” in the notice at the bottom of the page, PostHog additionally sets two cookies whose names begin with ph_, and entries with the same prefix in your browser's local storage. They hold a random identifier and are valid for one year. With them PostHog recognises your browser when you return on another day, and we can see whether a page keeps its visitors or is read once. Your name, your email address or any other detail about you are not added; the identifier stays a random number.

In both cases we count individual actions: that a form was submitted, that the booking calendar was opened, that the price calculator was used, that the language was switched. What you entered is not transmitted, nor is an email address.

Purpose

Counting views and actions and, with consent, returning visits, in order to improve the site

Legal basis

Without a cookie: Art. 6(1)(f) GDPR, legitimate interest in statistics that do not touch your device. With a cookie: your consent under § 165(3) TKG 2021 and Art. 6(1)(a) GDPR.

Retention

IP address: none. Cookies and local storage entries: one year from consent. Raw data with the random identifier: [12 months], after that only figures without an identifier.

Processor

PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. The data is held in the provider's EU cloud at Amazon Web Services in Frankfurt am Main.

Contract

Data processing agreement under Art. 28 GDPR (PostHog Data Processing Agreement). Where PostHog, Inc. accesses data from the United States, the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR apply.

The notice appears once. Until you have chosen, and if you click “Decline”, counting stays cookie-free. The site remembers your choice in the ionvo_consent cookie so the question does not return on every visit. You can change it at any time via “Cookie settings” in the footer; a withdrawal applies from then on, and the ph_ cookies together with the local storage entries are deleted immediately.

You can object to the cookie-free counting at any time by email to info@ionvo.at. Because no IP address is stored, a past visit can no longer be attributed to anyone; these statistics contain nothing that leads back to you.

More in the PostHog privacy policy.

Spam protection with Cloudflare Turnstile

So that the waitlist and the newsletter are not flooded by automated programs, Cloudflare Turnstile checks when a form is submitted whether a person is at the device. For that your browser loads a script from Cloudflare. Cloudflare receives your IP address and technical characteristics of your browser and device, and observes how you interact with the form. The result is a verification token that our server checks with Cloudflare. Cloudflare does not see what you entered in the form.

Provider

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany

Legal basis

Art. 6(1)(f) GDPR, legitimate interest in protecting the forms from abuse. The check is strictly necessary for the security of the service.

Third country

Transfer to the USA on the basis of the EU-US Data Privacy Framework, under which Cloudflare, Inc. is certified, and the European Commission’s standard contractual clauses

More in Cloudflare’s privacy policy.

Appointment booking with Microsoft Bookings

On the contact page and after joining the waitlist you can book a 20-minute call. The calendar comes from Microsoft Bookings, a service in our Microsoft 365 account. It does not load by itself: at first you see only a note and a button. Only when you click “Pick a time” does your browser load the booking page from outlook.office365.com in an embedded frame. On a phone it opens in a new tab.

On loading, Microsoft receives your IP address and technical details about your browser, and the booking page may set its own cookies and storage inside its frame. What you enter there, that is name, email address, phone number and trade where asked, and the chosen time, lands in our calendar and is processed by Microsoft on our behalf.

Processor

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

Legal basis

Loading the calendar: your consent given by the click, Art. 6(1)(a) GDPR. Booking and call: Art. 6(1)(b) GDPR, steps prior to entering into a contract.

Contract

Microsoft Products and Services Data Protection Addendum (processing under Art. 28 GDPR) with the European Commission’s standard contractual clauses for any processing outside the EU; Microsoft Corporation is also certified under the EU-US Data Privacy Framework

Retention

Until the call has taken place and is settled, unless a business relationship follows from it

More in Microsoft’s privacy statement.

Fonts

The typefaces Archivo and JetBrains Mono are stored on our own server and delivered together with the site. Your browser opens no connection to Google Fonts or any other outside server for them.

Contact by email

When you write to us, we process your email address and the content of your message in order to answer it. The legal basis is Art. 6(1)(b) GDPR for pre-contractual enquiries and otherwise Art. 6(1)(f) GDPR.

We delete the message once the enquiry is settled and no retention obligation stands in the way. We do not pass your address on and do not use it for advertising.

Cookies

This site sets two cookies that are strictly necessary for its operation and need no consent under § 165(3) TKG 2021: ionvo_lang remembers, when you switch the language by hand, whether you chose German or English, so that you land on the right home page next time; ionvo_consent remembers how you answered the cookie notice, so it does not come back. Both hold only that one value and are valid for one year. PostHog's cookies, whose names begin with ph_, together with the local storage entries, are set only if you allowed it in the notice, see above. Otherwise the site stores nothing on your device.

The embedded Microsoft Bookings calendar may set its own cookies inside its frame after you click “Pick a time”, see above.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7(3)). Write to info@ionvo.at for any of these.

Supervisory authority

If you believe we are not processing your data lawfully, you can complain to the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at.

Changes

If something is added to the site that processes data, we update this policy. The date below says when that last happened.