Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Controller

Bleier Solutions – Raphael Bleier, Robatschgasse 11, 9020 Klagenfurt am Wörthersee, Austria

Email

office@bleier-solutions.com

Phone

+43 677 61817457

No data protection officer has been appointed; the conditions of Art 37 GDPR are not met.

2. Hosting and delivery (Cloudflare)

This website runs on the platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers). When a page is called, Cloudflare processes technically necessary connection data: IP address, time, address called, volume of data transferred, browser identifier and referring page.

The legal basis is Art 6 para 1 lit f GDPR. The legitimate interest lies in the secure and efficient operation of the website and in fending off attacks. A data processing agreement pursuant to Art 28 GDPR is in place with Cloudflare; the transfer to the USA is based on the standard contractual clauses and the EU-US Data Privacy Framework.

Cloudflare additionally uses its own security mechanisms, among them a JavaScript check for bot detection. This check sets no cookies for advertising purposes.

Cloudflare Web Analytics runs alongside. That service works without cookies, without recognition across sessions and without profiling; it therefore requires no consent.

3. Contact form, Turnstile and Resend

When you submit the contact form, we process the details you entered: name, optionally company, email address, optionally phone number and your message. We additionally store the time, the origin of the inquiry and the language.

The legal basis is Art 6 para 1 lit b GDPR insofar as the inquiry is directed at a contract, otherwise Art 6 para 1 lit f GDPR for answering inquiries.

Spam protection with Cloudflare Turnstile

To protect against automated inquiries we use Cloudflare Turnstile. Turnstile checks whether the request comes from a human and processes the IP address, the browser identifier and technical characteristics of the device. Turnstile creates no advertising profiles and sets no cookies for advertising purposes. The legal basis is Art 6 para 1 lit f GDPR; the legitimate interest lies in fending off spam and misuse.

The call to Cloudflare does not happen when the page opens: Turnstile is loaded only once you select the first field of the form. The same check also protects the input field of the Website Check.

Delivery with Resend

The form message is sent to our mailbox through Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA) as a processor. The content of your inquiry and your email address are transferred in the process. A data processing agreement is in place with Resend; the transfer to the USA is based on the standard contractual clauses.

Misuse protection without a plain text IP address

To limit the number of inquiries per sender we do not store your IP address in plain text but only as a salted hash value. The IP address cannot be calculated back from that value.

4. Storage in Cloudflare D1 and deletion periods

Inquiries are stored in a database based on Cloudflare D1 so that no inquiry is lost if sending the mail fails once. What is stored are the details submitted in the form, the time, the sending status and the salted hash value of the IP address.

If you send an inquiry from the Website Check, the result of that check (the address checked, the overall grade, the findings and the metrics) is stored together with the inquiry so that I can answer it. The legal basis is Art 6 para 1 lit b GDPR, otherwise Art 6 para 1 lit f GDPR. The same deletion period applies as for the inquiry itself, and it is deleted together with it. Without an inquiry actually sent, no result is stored.

Inquiries are deleted 24 months after receipt unless a contractual relationship has arisen from them. If an inquiry leads to an order, the tax and commercial retention periods of seven years pursuant to § 132 BAO (Austrian Federal Fiscal Code) apply.

5. Audience measurement (Google Analytics 4)

Only with your express consent do we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand which content is read and where visitors drop off.

What is measured are page views and individual usage events: clicks on the contact action in the header and navigation, opening the contact form from the price calculator or the Website Check, the first input focus in the contact form, and a successfully submitted form. All that is transmitted is where on the website the event was triggered and in which language version. The content of your message, your name, your email address, your phone number and the address checked in the Website Check are not transmitted to Google.

Without your consent no script from Google is loaded and no connection to a Google server is established. We use Google Consent Mode v2; every consent type is set to denied when the page is called. The IP address is processed in truncated form.

The legal basis is your consent pursuant to Art 6 para 1 lit a GDPR in conjunction with § 165 para 3 TKG 2021 (Austrian Telecommunications Act). Data is also transferred to Google LLC in the USA; the transfer is based on the standard contractual clauses and the EU-US Data Privacy Framework.

Once consent has been given, Google Analytics sets two cookies on this domain: _ga distinguishes visitors, _ga_G-B7MHB00VDV holds the session. Their lifetime is up to two years; common browsers shorten it to 400 days. Without consent neither is set.

You can withdraw your consent at any time with effect for the future, through the entry Change consent in the footer of every page. The withdrawal takes effect immediately: measurement is switched off on the same page, and from the next page call no script from Google is loaded any more. Cookies already set remain in your browser until they expire; you can delete them there at any time. The withdrawal does not affect the lawfulness of the processing carried out up to that point.

6. Website Check and Google PageSpeed Insights

This website offers a free Website Check. If you enter an address there, we retrieve that address and additionally pass it to the programming interface of Google PageSpeed Insights (Google Ireland Limited) in order to obtain measured values for loading speed. The address you entered is transferred to Google in the process.

A note to that effect stands directly at the input field. The legal basis is Art 6 para 1 lit b GDPR, because the transfer is necessary to provide the check you requested. Only check addresses you are entitled to check. This form is also protected against automated calls with Cloudflare Turnstile, see section 3; in addition we limit the number of checks per sender.

The address checked and its result stay in a cache for 24 hours so that the same check does not run repeatedly. After that they expire by themselves. We do not store who checked which address.

7. Fonts

All fonts are delivered from our own server. When the page is called there is no connection to Google Fonts or any other third party font service.

8. Your rights

You have the following rights vis-a-vis the controller:

• Access to the data stored about you (Art 15 GDPR)
• Rectification of incorrect data (Art 16 GDPR)
• Erasure (Art 17 GDPR)
• Restriction of processing (Art 18 GDPR)
• Data portability (Art 20 GDPR)
• Objection to processing based on legitimate interests (Art 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art 7 para 3 GDPR)

An informal message to office@bleier-solutions.com is enough to exercise them.

9. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent body is the Austrian data protection authority, Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.