Privacy Policy

The protection of personal data is important to us. This privacy policy explains which personal data we process, for what purposes this is done, on which legal bases the processing is based, and which rights data subjects have.

Personal data means any information relating to an identified or identifiable natural person, such as name, email address, IP address, communication data, or contract data.

• when visiting our website and accessing individual pages
• when contacting us by email, phone, form, or other communication
• when preparing offers, concluding contracts, handling projects, invoicing, and providing customer support
• when hosting, technically maintaining, servicing, monitoring, and supporting customer websites
• when using analytics, security, storage, project management, and development services
• when optionally processing audio or media files on behalf of a client

The controller within the meaning of the GDPR for data processing on this website and in the context of our business operations is: Inan Software OG (general partnership), Wagramer Straße 155/3/26, 1220 Vienna — Email: [email protected] — Phone: +43 676 3249861 — Website: https://inansoftware.at — Company register: FN 677527 p, Commercial Court Vienna.

Data protection inquiries can be directed to the email address above. If we have justified doubts about the identity of the person making the request, we may request proof in order not to disclose personal data to unauthorized persons.

We only process personal data if there is a legal basis. Depending on the processing, the following legal bases in particular apply:

• Art. 6(1)(a) GDPR – consent, e.g. for non-essential cookies, analytics tools, external media, or certain optional processing activities.
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures, e.g. preparing offers, project implementation, support, or customer communication.
• Art. 6(1)(c) GDPR – legal obligations, e.g. tax and company law retention obligations.
• Art. 6(1)(f) GDPR – legitimate interests, e.g. secure operation of the website, IT security, prevention of misuse, efficient communication, and enforcement of legal claims.
• Art. 28 GDPR – processing on behalf of a controller, when we process personal data on behalf of our clients.

For cookies and comparable technologies, we also comply with the requirements of the Telecommunications Act (TKG), in particular information and consent obligations for technically non-essential storage or access operations.

Depending on the contact and use, the following categories of data may in particular be processed:

• Master data: name, company, role/function, contact person, customer number.
• Contact data: email address, phone number, business address, communication channels.
• Contract and project data: offers, orders, scope of services, project information, acceptances, support cases.
• Invoicing and payment data: billing address, VAT ID, payment status, bank details, accounting data.
• Communication data: content of emails, form inquiries, phone notes, support messages.
• Technical data: IP address, browser, operating system, referrer, access time, log data, error messages.
• Content data: texts, images, audio, videos, files, or other content provided by clients as part of a project.
• Usage and analytics data: page views, technical usage information, and aggregated statistics, where used.

When you access our website, the server automatically processes technical access data. This may include: IP address, date and time of access, requested URL, referrer URL, browser type and version, operating system, amount of data transferred, and status codes.

This data is technically required to deliver the website, ensure stability and security, analyze errors, and prevent misuse. It is not merged with other data sources unless a specific security review or legal enforcement is required.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). Server log files are generally deleted automatically after 14 days unless a security incident, error analysis, or legal enforcement requires longer retention.

We use Hosttech for hosting and infrastructure services. As part of hosting, technical data such as IP addresses, server log files, communication data, and, where applicable, content provided by users may be processed.

The use of a professional hosting provider serves the secure, stable, and efficient provision of our website and technical infrastructure. The legal basis is Art. 6(1)(f) GDPR and, insofar as hosting is necessary for contractual services, Art. 6(1)(b) GDPR.

We use Cloudflare services for technical delivery, performance, security, and analytics. Depending on the project, the following services may be used in particular:

• Cloudflare Pages: delivery of frontend websites and static content.
• Cloudflare Web Analytics: privacy-friendly analysis of website visits, where enabled.
• Cloudflare R2: storage and delivery of images, videos, and other assets.
• Cloudflare Zero Trust / Access: protection of restricted areas and access control.

Cloudflare may process technical data such as IP addresses, security events, access data, DNS/routing information, and log data. The processing serves delivery, security, performance optimization, and misuse prevention. The legal bases are Art. 6(1)(f) GDPR and, depending on use, Art. 6(1)(b) GDPR.

We may use Cloudflare Web Analytics to technically and statistically evaluate the use of our website. In particular, page views, referrer, country/region, browser information, and technical usage information are processed. Under our current setup, the use is data-minimizing, without our own tracking cookies and without creating individual user profiles.

Where no consent is required, we base the processing on Art. 6(1)(f) GDPR. Where the specific setup requires consent, processing takes place solely on the basis of Art. 6(1)(a) GDPR.

We may use Umami as a web analytics tool. Umami is used for privacy-friendly analysis of website usage. Under our current setup, Umami operates without cookies. Technical usage data such as page views, referrer, browser, device type, and approximate location information may be collected.

The legal basis is Art. 6(1)(f) GDPR, provided Umami is used in a privacy-friendly manner and without technologies requiring consent. In the case of a consent-required configuration, processing is based on Art. 6(1)(a) GDPR.

Where a client provides us with audio or video files for transcription, analysis, or editing, we may use Whisper or services from OpenAI. Audio content, voices, transcripts, metadata, and, where applicable, personal data contained therein may be processed.

Such processing takes place only if it is necessary for the specific assignment or has been commissioned by the client. The legal basis is Art. 6(1)(b) GDPR; for special categories of personal data, an additional legal basis under Art. 9 GDPR may apply. If we process data on behalf of the client in this context, this is done on the basis of a data processing agreement (DPA).

Clients are responsible for providing us only with audio or media data that they are entitled to process and for which all necessary consents or legal bases exist.

In many client projects, we do not act as an independent controller, but as a processor within the meaning of Art. 28 GDPR. This applies in particular to hosting, technical maintenance, monitoring, support, access to contact form inquiries, log data, CMS data, client files, or protected areas.

In these cases, the respective client remains the controller for data processing on their website or in their project. We process personal data only on documented instructions from the client and within the scope of a separate data processing agreement (DPA).

The client is in particular responsible for the legal bases of their data processing, informing data subjects, the content of their own privacy policy, and the lawfulness of contact forms, tracking, newsletter tools, embedded third-party providers, and other functions of their website.

Personal data may be transferred to service providers and technical vendors insofar as this is necessary for providing the website, fulfilling contracts, implementing projects, ensuring security, or meeting legal obligations. The categories of recipients used in particular include:

• Hosting and infrastructure providers, especially Hosttech and Cloudflare
• Analytics, marketing and consent providers, especially Google LLC (Google Analytics 4, Google Ads, Google Tag Manager), Cybot A/S (Cookiebot), Cloudflare Web Analytics, Umami, and UptimeRobot
• Development and project management tools, especially GitHub and Trello
• Storage and media services, especially Cloudflare R2
• Access protection and security services, especially Cloudflare Zero Trust / Access
• AI / transcription services, especially OpenAI / Whisper, where commissioned
• Tax advisory, accounting, payment service providers, legal advice, and authorities, where necessary

Some service providers may process personal data outside the European Union or European Economic Area, in particular in the United States. Such a transfer takes place only if an appropriate data protection basis exists.

This may be the case in particular if there is an adequacy decision by the European Commission, the provider is certified under a recognized data protection framework, or the EU Commission’s Standard Contractual Clauses have been concluded. Many US providers in the areas of hosting, development, project management, or cloud services may be certified under the EU-US Data Privacy Framework. In addition or alternatively, Standard Contractual Clauses, data processing agreements, and additional protective measures may be in place.

For services used only on the basis of consent, a third-country transfer takes place only if the corresponding consent has been given.

We store personal data only for as long as necessary for the respective purposes or as long as legal retention obligations exist. After that, the data is deleted or anonymized.

• Contact inquiries: until final processing and beyond, insofar as this is necessary for follow-up questions or evidence.
• Contract and invoicing data: according to statutory retention periods, in particular tax and company law obligations.
• Project and support data: for the duration of the project or customer relationship and as necessary for traceability, maintenance, or enforcement of legal claims.
• Server log files: generally 14 days, unless a security incident, error analysis, or legal enforcement requires longer retention.
• Data processed on behalf of a client: according to the DPA, client instructions, and agreed deletion or return rules.

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, or disclosure. These may include in particular: HTTPS/TLS encryption, access restrictions, role-based permissions, password protection, zero-trust access, technical monitoring, logging, regular updates, secure development processes, and careful selection of service providers.

Despite all measures, data transmission over the internet cannot be completely risk-free. We strive to ensure a level of security appropriate to the risk.

Under the GDPR, you have in particular the following rights:

• Right of access under Art. 15 GDPR
• Right to rectification under Art. 16 GDPR
• Right to erasure under Art. 17 GDPR
• Right to restriction of processing under Art. 18 GDPR
• Right to data portability under Art. 20 GDPR
• Right to object under Art. 21 GDPR
• Right to withdraw consent under Art. 7(3) GDPR
• Right not to be subject to a decision based solely on automated processing, where applicable

To exercise these rights, you can contact us at the contact address stated above. If we process personal data solely as a processor for a client, we will forward the relevant requests to the responsible client or support them in accordance with the DPA.

If personal data is processed for the purpose of direct marketing, data subjects have the right to object to this processing at any time. After an objection, the relevant data will no longer be used for direct marketing.

We object to the use of the contact details published in the legal notice for sending unsolicited advertising and informational materials. In the event of abusive sending, we reserve the right to take legal action.

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority.

In Austria: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna — Website: https://www.dsb.gv.at

We do not make decisions based solely on automated processing that have legal effects or similarly significant effects on data subjects, unless expressly stated otherwise.

If, in the course of a website project, we provide or technically integrate legal notice, privacy policy, cookie notices, or other legal texts as a template, this is provided as a service and not as legal advice. The legal review, completeness, timeliness, and approval of the legal texts are the responsibility of the respective client or their legal adviser.

The client is in particular responsible for ensuring that their website fulfills all applicable legal information obligations and that the tools, forms, tracking functions, cookies, and third-party providers used are correctly described in their privacy policy.

We reserve the right to adapt this privacy policy if legal requirements, technical implementations, services used, or our business processes change. The version currently published on our website applies.

As of: May 2026