Privacy Policy

Effective Date

August 2, 2026

Last Updated

August 8, 2026

1. Introduction

This Privacy Policy explains how Integrations IT-Solutions e. U. (“we,” “us,” “our,” or “Company”) processes personal data when you visit our website integrations.at (the “Website”) and when you contact us through it.

It describes what we actually do. Where a detail is still being confirmed, we say so rather than promise something the system does not deliver.

2. Responsible Party (Data Controller)

Company Name

Integrations IT-Solutions e. U.

Legal Form

Einzelunternehmen (sole proprietorship)

Registration

FN 374390 z, Handelsgericht Wien

VAT ID

ATU60335747

Owner

Alexander Kastil

Email

agent@integrations.at

Postal Address

Neuwaldegger Straße 50-54/1/6, 1170 Wien, Austria

This is the same entity and the same contact named in our Imprint. Write to the email address above for anything in this policy: no account on any platform is required, and we do not route data protection requests through a contact form.

2.1 Data Protection Officer

We have not appointed a data protection officer. An undertaking of this size does not meet the conditions of Art. 37 GDPR: we carry out no large-scale systematic monitoring and process no large-scale special-category data. Data protection matters are handled directly by the controller at the address above.

3. Purposes, Data and Legal Basis

Each purpose below rests on exactly one legal basis under Art. 6(1) GDPR.

We never sell your personal data. We do not share it with advertisers or marketing networks.

Providing your name, company, email address and message is voluntary. It is neither a statutory nor a contractual requirement; the only consequence of withholding it is that we cannot reply to you. If we ever intend to process data we hold for a purpose other than the one it was collected for, we will inform you about that purpose before doing so (Art. 13(3) GDPR).

4. The Inquiry Widget (“Customers Agent”)

The floating “Let’s talk” widget is the only place on this site where you can submit personal data.

• What it collects: your name, your company, your email address, the talk topics you selected, and your free-text message.
• What happens to it: the data is sent to our API, stored in a SQL Server database on a server we operate ourselves in the EU, and delivered to us as an internal notification email through Microsoft 365. Where each of these runs is set out in our Imprint.
• Purpose and basis: answering your request, on the basis of Art. 6(1)(b) GDPR.
• Recipients: Hetzner Online GmbH as the provider of the servers we operate, and Microsoft as our mail processor (Section 9). No one else receives it.
• Retention: inquiry records are kept for 24 months from receipt and are then deleted, unless a longer period is required by law or the inquiry has become part of a client relationship.

5. Website Logs

Serving a page produces technical log records on the server we operate at Hetzner, described here in full.

• At the edge: the Caddy reverse proxy that terminates TLS is configured without an access log and writes none, so no request line with your IP address is recorded there.
• Behind it: the web server container that serves the pages writes one line per request containing the IP address of the requesting device, the time, the requested URL, the status and the user agent. The container serving the inquiry API behaves the same way for submissions.
• How long these lines exist: they are held in the container log, which is capped by size rather than by age. Each container keeps up to three log files of 10 MB each, and the oldest is discarded when that limit is reached, so the records roll over continuously instead of accumulating. We do not state a fixed period here, because the system enforces a size limit and not a time limit.

We do not use these records to build a profile of you, and they are not combined with the analytics described in Section 8.

6. AI-Assisted Processing of Inquiries

If you switch on the optional AI research opt-in when you send an inquiry, we run an automated background research step on it. You can send an inquiry with this switch off; the switch is not a condition for contacting us.

• What runs: the inquiry data (name, company, email address, topics, message) is passed to an AI agent hosted on Microsoft Foundry.
• What it does: the agent performs a public web search to establish your likely professional role, your employer, the employer’s approximate size and sector, publicly reported business signals, and, where one is publicly published, a link to a profile picture.
• Additional data from public sources: this means we obtain information about you from publicly accessible web sources (Art. 14 GDPR). The categories are the ones just listed; the sources are the public web pages the agent cites.
• What we do with the result: the research summary is stored alongside your inquiry and included in the internal notification email so that a human can prepare a relevant answer.
• Legal basis: your consent under Art. 6(1)(a) GDPR, given at the widget and withdrawable at any time (Section 12).
• Retention: the research record is deleted together with the inquiry it belongs to.

No automated decisions. Nothing on this site makes a decision about you that produces legal effects or similarly significantly affects you. The research output is background material only: every reply to you is written and sent by a person, who reviews the AI output first. Art. 22 GDPR is therefore not engaged. AI outputs can be incomplete or wrong, which is one reason a human reviews them; you can ask us to correct or delete a research record at any time. Our transparency disclosure on AI use across the site is in our Terms, and this section is consistent with it.

Right to object: you can object to this processing at any time, and withdraw the opt-in in the same message. Section 12 sets out how.

Where this runs: the Microsoft Foundry project is provisioned in Sweden Central, and its model deployments use the EU Data Zone, so inference on your inquiry stays within the European Union. The web search the agent performs reaches public websites that may be hosted anywhere.

AI used to build this site, not to process you. The software of this website is written with AI assistance using Anthropic Claude under a Team licence. That is a development tool operating on source code on our own workstations. It is not part of the running website, it is not in the path of any request you make, and it receives no personal data about you. Anthropic is therefore not a recipient of your data and does not appear in Section 9.

7. Cookies and Local Storage

We use no advertising cookies, no tracking pixels and no cross-site identifiers. The complete list of what this site stores on your device is:

The first two items are strictly necessary: one records the choice you made, the other keeps the widget you opened working. The two Google Analytics cookies are not necessary and are never written unless you accept in the banner; choosing “Reject” leaves them unset. None of them is used to track you across websites. You can delete all of them at any time through your browser settings; deleting iat_consent brings the banner back so you can choose again.

8. Website Analytics

We use two analytics tools to understand which pages are read and where visitors come from. Both are loaded only after you choose “Accept” in the cookie banner and never before: the page ships no analytics code at all until you consent, and choosing “Reject” loads neither of them.

Your consent covers both tools together. Withdrawing it applies to both: choose “Reject” in the banner, or delete the iat_consent cookie and choose “Reject” when the banner reappears. Withdrawal takes effect immediately and does not affect the lawfulness of processing carried out before it. You can also email us and we will confirm.

8.1 Ahrefs Web Analytics

• Processor: Ahrefs Pte. Ltd., a company established in Singapore.
• What it collects: page views and referrer information. According to the vendor, the script sets no cookies and writes nothing to your device’s storage, and raw IP addresses are not stored: they are combined with the user agent into a hash using a salt that is rotated every 24 hours.
• Legal basis: your consent under Art. 6(1)(a) GDPR.

8.2 Google Analytics 4

• Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting for Google LLC.
• What it collects: page views and the pages you move between, referrer and campaign parameters, browser and device type, language, and an approximate location derived from your IP address. Google states that it does not store the IP address itself for Analytics and that the location derivation happens before the address is discarded. Enhanced measurement is enabled, so scrolls, outbound clicks, site search, form interactions and file downloads are recorded as events.
• Identifiers: the two first-party cookies listed in Section 7. Our property does not send user IDs, and we do not upload customer data to Google.
• What we switched off: Google signals is off, so your Analytics activity is not associated with a signed-in Google account and no demographic or interest data is collected. User-provided data collection is off. All four account-level data sharing options (Google products and services, modeling contributions and business insights, technical support, recommendations for your business) are switched off, so the data is not shared with Google for its own purposes beyond what the service itself requires.
• Retention in Google’s systems: event-level data is deleted after 2 months, and user-level data after 14 months, per the property configuration.
• Legal basis: your consent under Art. 6(1)(a) GDPR.
• Transfer: see Section 10.

9. Recipients and Processors

Where each of these components runs is set out in the infrastructure section of our Imprint, which is the single place we state processing locations. Transfers out of the EU are covered in Section 10.

10. International Data Transfers

The Website, the API and the database run on servers we operate ourselves, and both of their locations are inside the European Union (see the Imprint). Serving this site and storing an inquiry therefore involve no transfer to a third country.

The Microsoft services we use, the notification mail and the AI research agent, are provisioned in EU regions. Where Microsoft accesses data from outside the EU/EEA for support or operations, that access is governed by the transfer mechanisms in the Microsoft Data Protection Addendum (Standard Contractual Clauses under Art. 46(2)(c) GDPR, and the EU-US Data Privacy Framework where the recipient is certified under it).

Ahrefs Pte. Ltd. is established in Singapore. There is no European Commission adequacy decision for Singapore, so this transfer relies on Standard Contractual Clauses under Art. 46(2)(c) GDPR. It only takes place if you consent to analytics.

Our Google Analytics contract is with Google Ireland Limited, inside the EU. Google LLC in the United States processes Analytics data as a sub-processor. The United States is covered by the European Commission’s adequacy decision of 10 July 2023 for the EU-US Data Privacy Framework, and Google LLC is certified under it; Google additionally offers Standard Contractual Clauses under Art. 46(2)(c) GDPR. This transfer only takes place if you consent to analytics.

You may ask us for a copy of these safeguards; Section 12 sets out how.

11. Data Retention

12. Your Rights

You have the following rights in respect of your personal data:

• Access (Art. 15): a copy of the data we hold about you and the details of its processing.
• Rectification (Art. 16): correction of inaccurate or incomplete data.
• Erasure (Art. 17): deletion where there is no basis to keep the data.
• Restriction (Art. 18): processing frozen while a dispute is resolved.
• Data portability (Art. 20): your data in a structured, commonly used, machine-readable format.
• Objection (Art. 21): you can object at any time to processing based on our legitimate interests (Section 3), and to the AI research described in Section 6.
• Withdrawal of consent (Art. 7(3)): where processing is based on your consent (website analytics, AI research), you can withdraw it at any time. Withdrawal is as easy as giving consent and does not affect the lawfulness of processing carried out before it.

How to exercise them: send one email to agent@integrations.at. No account on any platform is required, no form has to be used, and we do not charge for it. We answer within one month of receiving your request (Art. 12(3) GDPR); if a request is exceptionally complex we will tell you within that month and may extend it by up to two further months.

Right to lodge a complaint (Art. 77): you can complain to the Austrian supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

13. Children’s Privacy

This Website is aimed at businesses and is not directed at children. Under § 4(4) of the Austrian Datenschutzgesetz (DSG), read with Art. 8 GDPR, a child in Austria can consent to information society services once it has completed its 14th year of life; below that age, consent must be given or authorised by the holder of parental responsibility. We do not knowingly collect personal data from children under 14, and if we learn that we have, we delete it promptly.

14. Security

We apply the following technical and organizational measures:

• Encryption in transit: the Website and the API are served exclusively over HTTPS/TLS, terminated by a Caddy reverse proxy with publicly trusted Let’s Encrypt certificates.
• Passwordless authentication between services: our services authenticate to Azure with managed identities (Azure Identity), so no service credentials are stored in the application.
• Access log at the edge: the reverse proxy that faces the internet is configured to write no access log (Section 5).
• No secrets in source control: credentials and keys are kept out of the repository and out of log output.
• Access control: access to the inquiry database and the operator mailbox is limited to the controller.

If a personal data breach occurs, we are required to notify the Datenschutzbehörde within 72 hours of becoming aware of it and, where the risk to you is high, to notify you directly (Arts. 33 and 34 GDPR).

No security measure is absolute. If you send us confidential information, consider whether email is the right channel for it.

15. Third-Party Links

The Website links to external sites (for example LinkedIn, GitHub and Microsoft documentation). We are not responsible for their privacy practices. Review their privacy policies before providing personal data to them.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in the law or in how the Website works. The current version is always published on this page with the effective date at the top. Material changes are announced here; we do not use inquiry email addresses to send policy notifications.

Questions about this policy, data-subject requests and complaints all go to the controller named in Section 2, by the route set out in Section 12. Our full company, registration and imprint details are in the Imprint; the terms governing use of this Website are in our Terms of Service.

Last Updated

August 8, 2026This policy is governed by Austrian and EU data protection law, in particular the General Data Protection Regulation (EU) 2016/679 and the Austrian Datenschutzgesetz (DSG).