Privacy Policy

When you visit our website, the server automatically collects the following information: browser type and version, operating system used, referrer URL, time of the server request and the IP address (stored in shortened or anonymised form).

This data serves technical operation, security, error analysis and optimisation. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

We only use technically necessary cookies that are required to operate the website. We do not use tracking or analytics cookies and no web tracking. A cookie consent banner is therefore not required. Only the spam protection used (see reCAPTCHA) may set cookies from Google.

To protect our contact form against spam and automated access, we use Google reCAPTCHA v3 (Google Ireland Limited / Google LLC). reCAPTCHA analyses user behaviour based on various characteristics (including IP address, time spent, mouse and keyboard input) to distinguish whether input originates from humans or automated programs.

In doing so, data is transmitted to Google (including to the USA). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against spam). For more information see the Google Privacy Policy.

If you contact us via the contact form or by email, we process the data you provide (name, email address, optional phone number and your message) to handle your request and any follow-up questions. The data is stored for a maximum of six months, unless statutory retention obligations apply. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or (f) (legitimate interest in communication).

To send the form message we use the service Resend (Resend, Inc., USA) as a processor. The data entered in the form is transmitted to Resend and processed on our behalf. The transfer to the USA is safeguarded by the EU Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework. Details: Resend Privacy Policy.

If you request the checklist in the EU AI Act quick check, we process your email address, the result of the check (risk class) and the selected language to send you the checklist as a PDF by email and to handle any follow-up questions. Your answers to the individual questions stay in your browser; only the result is transmitted to us. We receive an email notification with the same details for each request. The data is stored for a maximum of six months, unless statutory retention obligations apply. The legal basis is Art. 6(1)(b) GDPR (handling your request) or (f) (legitimate interest in communication).

We send the emails via Resend (Resend, Inc., USA) as a processor. For the transfer to the USA, see the section "Contact Form & Email".

To protect against automated requests we use Google reCAPTCHA (see above). We use your shortened IP address to limit requests to three per hour. It is held in memory only and deleted automatically once the hour has passed.

We offer a chatbot (AI chat assistant) on our website that answers questions based on our website content. When you use the chat, we process the messages you enter and your (shortened) IP address in order to generate answers, to limit the number of requests per user, and to prevent abuse. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in operating a helpful, abuse-resistant assistant).

To generate the answers, we transmit your message to our processor Anthropic PBC (USA), which provides the language model. Anthropic is certified under the EU-US Data Privacy Framework; in addition, the transfer is safeguarded by the EU Standard Contractual Clauses (SCC) in the data processing agreement. Anthropic does not use the inputs to train its models. In normal operation, Anthropic automatically deletes the transmitted inputs and the generated outputs within 30 days. Content that triggers automated safety and abuse checks may be retained longer by Anthropic for abuse prevention (up to 2 years). See the Anthropic Privacy Policy for details.

We store the questions asked in the chat and the answers to them in order to improve our website content and the assistant's answers. We store the date and time, the language, the text of the question and of the answer, and information on whether the assistant answered the question. We do not store your IP address, cookies or information about your device, browser or the page you were on, nor any identifier that links several questions from the same person. Email addresses, phone numbers, IBANs and long sequences of digits are automatically replaced with a placeholder before storage. The questions and answers are kept on a server operated by us at netcup in Vienna (see "Hosting in the EU") and are deleted there after 90 days at the latest. They may remain in the encrypted backup copies of this server for up to six further months. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in improving our content and the assistant).

You can object to this storage at any time (Art. 21 GDPR). As we cannot link the questions to a person, please tell us when you asked your question and how it was worded in a message to info@webse.at. We will then delete the entry.

So that your conversation is still there when you reload the page, the chat window keeps questions and answers in your browser's session storage. They stay on your device and are deleted when you close the tab.

We keep your shortened IP address and the counters needed for rate limiting only for a maximum of one day (in memory only, then automatically reset) and delete them afterwards. Please do not enter sensitive personal data in the chat (e.g. health, financial or special categories of personal data). For protection against automated access, we additionally use Google reCAPTCHA (see above).

Our website is operated by netcup GmbH (Karlsruhe, Germany) on servers in Vienna (Austria). A data processing agreement pursuant to Art. 28 GDPR is in place with netcup. Backup copies of the server are stored in encrypted form with Hetzner Online GmbH (Gunzenhausen, Germany) in data centres in Germany; a data processing agreement pursuant to Art. 28 GDPR is also in place with Hetzner. Hosting takes place exclusively in data centres within the EU; no data is transferred to third countries for hosting. Separately, some of the services described above transfer data to the USA, in particular the chatbot to Anthropic (see "Chatbot (AI chat assistant)").

We use the "Roboto Flex" (text) and "Geist Mono" (code) fonts, which are served locally from our own server (self-hosted). No connections to Google servers are established and no personal data is transmitted to Google.

Our blog content is managed via a headless CMS (Strapi, hosted at strapi.webse.at within the EU). Simply reading blog content does not collect any additional personal data from you.

With regard to your personal data, you have the following rights:

• Access to the stored data
• Rectification of inaccurate data
• Erasure (unless a retention obligation exists)
• Restriction of processing
• Data portability
• Objection to processing
• Withdrawal of consent given

To exercise your rights, a message to info@webse.at is sufficient.

You have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority, www.dsb.gv.at.