Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Controller

Bleier Solutions – Raphael Bleier, Robatschgasse 11, 9020 Klagenfurt am Wörthersee, Austria

Email

office@bleier-solutions.com

Phone

+43 677 61817457

No data protection officer has been appointed; the conditions of Art 37 GDPR are not met.

2. Hosting and delivery (Cloudflare)

This website runs on the platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers). When a page is called, Cloudflare processes technically necessary connection data: IP address, time, address called, volume of data transferred, browser identifier and referring page.

The legal basis is Art 6 para 1 lit f GDPR. The legitimate interest lies in the secure and efficient operation of the website and in fending off attacks. A data processing agreement pursuant to Art 28 GDPR is in place with Cloudflare; the transfer to the USA is based on the standard contractual clauses and the EU-US Data Privacy Framework.

Cloudflare additionally uses its own security mechanisms, among them a JavaScript check for bot detection. This check sets no cookies for advertising purposes.

Cloudflare Web Analytics runs alongside. That service works without cookies, without recognition across sessions and without profiling; it therefore requires no consent.

3. Contact form, Turnstile and Resend

When you submit the contact form, we process the details you entered: name, optionally company, email address, optionally phone number and your message. We additionally store the time, the origin of the inquiry and the language.

The legal basis is Art 6 para 1 lit b GDPR insofar as the inquiry is directed at a contract, otherwise Art 6 para 1 lit f GDPR for answering inquiries.

Spam protection with Cloudflare Turnstile

To protect against automated inquiries we use Cloudflare Turnstile. Turnstile checks whether the request comes from a human and processes the IP address, the browser identifier and technical characteristics of the device. Turnstile creates no advertising profiles and sets no cookies for advertising purposes. The legal basis is Art 6 para 1 lit f GDPR; the legitimate interest lies in fending off spam and misuse.

The call to Cloudflare does not happen when the page opens: Turnstile is loaded only once you select the first field of the form. The same check also protects the input field of the Website Check.

Delivery with Resend

The form message is sent to our mailbox through Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA) as a processor. The content of your inquiry and your email address are transferred in the process. A data processing agreement is in place with Resend; the transfer to the USA is based on the standard contractual clauses.

Misuse protection without a plain text IP address

To limit the number of inquiries per sender we do not store your IP address in plain text but only as a salted hash value. The IP address cannot be calculated back from that value.

4. Storage in Cloudflare D1 and deletion periods

Inquiries are stored in a database based on Cloudflare D1 so that no inquiry is lost if sending the mail fails once. What is stored are the details submitted in the form, the time, the sending status and the salted hash value of the IP address.

If you send an inquiry from the Website Check, the result of that check (the address checked, the overall grade, the findings and the metrics) is stored together with the inquiry so that I can answer it. The legal basis is Art 6 para 1 lit b GDPR, otherwise Art 6 para 1 lit f GDPR. The same deletion period applies as for the inquiry itself, and it is deleted together with it. Without an inquiry actually sent, no result is stored.

Inquiries are deleted 24 months after receipt unless a contractual relationship has arisen from them. If an inquiry leads to an order, the tax and commercial retention periods of seven years pursuant to § 132 BAO (Austrian Federal Fiscal Code) apply.

5. Audience measurement (Google Analytics 4)

Only with your express consent do we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand which content is read and where visitors drop off.

What is measured are page views and individual usage events: clicks on the contact action in the header and navigation, opening the contact form from the price calculator or the Website Check, the first input focus in the contact form, and a successfully submitted form. All that is transmitted is where on the website the event was triggered and in which language version. The content of your message, your name, your email address, your phone number and the address checked in the Website Check are not transmitted to Google.

Without your consent no script from Google is loaded and no connection to a Google server is established. We use Google Consent Mode v2; every consent type is set to denied when the page is called. The IP address is processed in truncated form.

The legal basis is your consent pursuant to Art 6 para 1 lit a GDPR in conjunction with § 165 para 3 TKG 2021 (Austrian Telecommunications Act). Data is also transferred to Google LLC in the USA; the transfer is based on the standard contractual clauses and the EU-US Data Privacy Framework.

Once consent has been given, Google Analytics sets two cookies on this domain: _ga distinguishes visitors, _ga_G-B7MHB00VDV holds the session. Their lifetime is up to two years; common browsers shorten it to 400 days. Without consent neither is set.

You can withdraw your consent at any time with effect for the future, through the entry Change consent in the footer of every page. The withdrawal takes effect immediately: measurement is switched off on the same page, and from the next page call no script from Google is loaded any more. Cookies already set remain in your browser until they expire; you can delete them there at any time. The withdrawal does not affect the lawfulness of the processing carried out up to that point.

6. Website Check and Google PageSpeed Insights

This website offers a free Website Check. If you enter an address there, we retrieve that address and additionally pass it to the programming interface of Google PageSpeed Insights (Google Ireland Limited) in order to obtain measured values for loading speed. The address you entered is transferred to Google in the process.

A note to that effect stands directly at the input field. The legal basis is Art 6 para 1 lit b GDPR, because the transfer is necessary to provide the check you requested. Only check addresses you are entitled to check. This form is also protected against automated calls with Cloudflare Turnstile, see section 3; in addition we limit the number of checks per sender.

The address checked and its result stay in a cache for 24 hours so that the same check does not run repeatedly. After that they expire by themselves. We do not store who checked which address.

7. Client area

Clients with a current or completed order have a protected area at /kundenbereich/. There you can see the status of your order, news about it, your quotes and invoices, and a place to store files. The purpose is carrying out the order; the legal basis is Art 6 para 1 lit b GDPR. The area is not public and is not indexed by search engines.

Signing in with a one-time link

There is no password. You enter your email address and receive a sign-in link that is valid for 15 minutes and can be used exactly once. That message is sent through Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA) as a processor, as described in section 3; the transfer to the USA is based on the standard contractual clauses.

Session cookie

Once you have signed in we set a cookie named sitzung. It contains a random identifier that lets us recognise you on the following requests and it expires after 30 days. The cookie is strictly necessary for operating the protected area, it serves no audience measurement and no profiling. It therefore requires no consent pursuant to § 165 para 3 TKG 2021 (Austrian Telecommunications Act). If you sign out, it is deleted immediately.

Data stored

In the client area we process your name, your company, your email address, your quotes and invoices with number, amount, date and payment status, our notes on the progress of the order, and the files that you or we place in the storage area. This data is held by Cloudflare, Inc. as a processor: the master data in Cloudflare D1, the sessions in Cloudflare KV, the files and PDF documents in Cloudflare R2. What is described in section 2 applies to Cloudflare.

Name, company, quotes and invoices do not originate in the client area itself but in our own accounting, where your order is kept anyway. They are taken over from there regularly so that you see the same status in the client area as we do.

Retention

For quotes and invoices the tax and commercial retention periods of seven years pursuant to § 132 BAO (Austrian Federal Fiscal Code) apply; the associated client data is kept for the same length of time. Files in the storage area are deleted twelve months after the order ends. A session ends after 30 days at the latest, an unused sign-in link after 15 minutes; both expire on their own.

Your rights under section 10 apply to the data in the client area without restriction. On request we delete your access together with the storage area, unless a statutory retention obligation stands against it.

8. Advertising by post to businesses

We occasionally introduce our services to businesses in Carinthia with an addressed letter. For this we process the company name and business address and, where stated there, the salutation, title and name of the owner or management. We do not collect this data from you; we look it up individually in publicly accessible sources: the legal notice on your website, the Austrian Economic Chamber's business directory (Firmen A-Z) or the company register. The specific source is stated in each letter.

The legal basis is Art 6 para 1 lit f GDPR. Our legitimate interest lies in presenting our services to businesses for which they are a professional fit (direct marketing, recital 47 GDPR). We use the data only for the letter, do not pass it on, and use neither address brokers nor other service providers for it. We do not contact you by email or phone without your prior consent.

If you do not reply, we delete your data no later than 24 months after sending. If you get in touch, we process your details to answer your enquiry.

Objection: You can object to this use at any time without giving reasons (Art 21 para 2 GDPR), for example with a short message to office@bleier-solutions.com. After that we send you no further advertising. To make sure it stays that way, we keep only the company, address and date of the objection for up to three years on a suppression list (Art 6 para 1 lit f GDPR).

9. Fonts

All fonts are delivered from our own server. When the page is called there is no connection to Google Fonts or any other third party font service.

10. Your rights

You have the following rights vis-a-vis the controller:

• Access to the data stored about you (Art 15 GDPR)
• Rectification of incorrect data (Art 16 GDPR)
• Erasure (Art 17 GDPR)
• Restriction of processing (Art 18 GDPR)
• Data portability (Art 20 GDPR)
• Objection to processing based on legitimate interests (Art 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art 7 para 3 GDPR)

An informal message to office@bleier-solutions.com is enough to exercise them.

11. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent body is the Austrian data protection authority, Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.