Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

2. Principles of Data Processing

We only process personal data where permitted by law or where you have given your explicit consent. All processing is carried out in accordance with the GDPR and applicable national data protection law (Austrian DSG 2018).

3. Data We Collect

3.1 Data You Provide

• Contact data: Name, email address
• Account data: Username, password (hashed), profile picture
• Order data: Project descriptions, uploaded files, chat messages within orders
• Payment data: Billing address; payment details are handled exclusively by certified payment providers

3.2 Automatically Collected Data

• Server logs: IP address, date/time of access, requested URL, HTTP status code, data volume, referrer, browser and operating system
• Session data: Session cookies to maintain your login state

We use no Google Analytics, tracking pixels, or social media plugins. No profiling takes place.

4. Legal Bases for Processing

Every processing activity is based on one of the following legal bases under Art. 6 GDPR:

• Art. 6(1)(a) GDPR — Consent: e.g. when subscribing to marketing emails
• Art. 6(1)(b) GDPR — Contract performance: processing necessary to fulfil an order or respond to pre-contractual enquiries
• Art. 6(1)(c) GDPR — Legal obligation: e.g. statutory retention requirements under tax and commercial law
• Art. 6(1)(f) GDPR — Legitimate interests: server security, abuse prevention, and technical operation of the website

5. Retention Periods

• Server logs: 14 days, then automatically deleted
• Account data: Until account deletion by the user or upon request
• Order data & communications: 7 years from order completion (statutory retention obligation under § 132 Austrian BAO)
• Consent records: Until revocation, then retained as proof for a further 3 years

6. Hosting & Data Processors

This website is hosted on a dedicated VPS server provided by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). Hetzner processes data (in particular IP addresses) exclusively within the EU/EEA. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Hetzner.

No personal data is transferred to third countries (outside the EU/EEA).

7. Cookies

We use only technically necessary session cookies required for the operation of the website (e.g. maintaining your logged-in state). These cookies are deleted when you close your browser or when the session expires. We do not use tracking or marketing cookies.

For more information see our Cookie Policy.

8. Disclosure to Third Parties

We do not sell, rent, or trade your personal data. Disclosure only occurs in the following cases:

• To data processors (e.g. Hetzner) under a DPA pursuant to Art. 28 GDPR
• Where we are legally required to do so (e.g. by court or authority order)
• With your explicit consent

9. Your Rights (Art. 15–22 GDPR)

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request information about what data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or completion of incomplete data.
• Right to erasure (Art. 17): Request deletion of your data, unless statutory retention obligations apply.
• Right to restriction (Art. 18): Request that we restrict processing of your data under certain conditions.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests at any time.
• Right to withdraw consent (Art. 7(3)): Withdraw any given consent at any time with effect for the future.

To exercise your rights, contact us at contact@eonfluxtech.com. We will respond within 30 days.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority at any time (Art. 77 GDPR). The competent authority is:

11. Minors

Our website and services are not directed at persons under the age of 16. We do not knowingly collect personal data from minors under 16. If we become aware of such data, we will delete it immediately.

12. Data Security

We implement appropriate technical and organisational measures (TOMs) to protect your data against unauthorised access, loss or misuse, including:

• Encrypted data transmission via TLS/HTTPS
• Encrypted password storage (hashing)
• Restricted access to server data
• Regular security updates

13. Changes to This Policy

We reserve the right to update this Privacy Policy to reflect changes to our services or applicable law. The current version is always available on this page. Registered users will be notified of material changes by email.

14. Contact