Privacy policy.

1. Data controller (Art. 4(7) GDPR)

PureSurf FlexCo, Sandgasse 36/IV, 8010 Graz, Austria
Phone: +43 664 4788120
Email: office@puresurf.eu

2. Data Protection Officer

Given the size and nature of our processing activities, we are not legally required to appoint a Data Protection Officer (Art. 37 GDPR). Please direct all privacy enquiries to office@puresurf.eu.

3. Data processed and sources

We only process personal data that you actively provide to us yourself. We do not collect personal data from third-party sources within the meaning of Art. 14 GDPR.

• Contact and form data: Name, company, role, email address, phone number, area of application and interest, message, attachments where provided.
• Technical server logs: IP address (truncated where technically possible), browser type and version, operating system, referrer URL, time of access.
• Consent data: Your cookie preferences, timestamp and version of consent (stored locally in your browser).

4. Purposes and legal bases (Art. 6 GDPR)

• Handling your enquiry / sample request: Art. 6(1)(b) GDPR (pre-contractual measures).
• Operating and securing the website: Art. 6(1)(f) GDPR (legitimate interest in providing a secure and functional website).
• Sending confirmation emails: Art. 6(1)(b) GDPR.
• Optional cookies / analytics: Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021 (Austrian Telecommunications Act): consent.
• Statutory retention obligations: Art. 6(1)(c) GDPR (e.g. Austrian Commercial Code, Federal Fiscal Code).

5. Recipients and processors (Art. 28 GDPR)

We only share your data with the following carefully selected processors, bound by Art. 28 GDPR data processing agreements:

• Supabase (EU): Database hosting, storage of form data and edge functions, EU region (Frankfurt).
• Brevo (EU): Sending of transactional emails (confirmations, replies). Operator: Sendinblue SAS, Paris, France.
• Lovable / Cloudflare: Hosting, content delivery network and DDoS protection. Data is transmitted in encrypted form via the EU network.
• Google Ireland Ltd. (Google Analytics 4): Website audience measurement, only after your consent given via the cookie banner.
• Apollo.io (Apollo Website Tracker): Marketing cookie used to recognise the company a visitor comes from, only after your consent given via the cookie banner.
• Microsoft Ireland Operations Ltd. (Microsoft Dynamics 365): Customer relationship management system holding business contacts, enquiries and visit records. Data stored in the EU and Switzerland.

6. Transfers to third countries

Your data is primarily processed within the European Union. If, in individual cases (e.g. support or CDN routing), a transfer to a third country becomes necessary, it will only occur on the basis of appropriate safeguards within the meaning of Art. 46 GDPR (in particular EU Standard Contractual Clauses, SCCs) or a valid adequacy decision (e.g. EU-US Data Privacy Framework).

7. Retention periods

• Enquiries / sample requests: maximum of 24 months after the last contact.
• Business correspondence with tax / commercial relevance: 7 years (§ 132 BAO, § 212 UGB).
• Server logs: 7 to 30 days.
• Cookie consent: 12 months from the date given.

8. Your rights as a data subject

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and to withdraw any given consent at any time with effect for the future (Art. 7(3) GDPR).

Please send your requests to office@puresurf.eu.

9. Automated decision-making / profiling

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

10. Cookies and similar technologies

By default we only set strictly necessary cookies. Optional cookies (analytics, preferences, marketing) are only set after your explicit, granular consent given via our cookie banner (§ 165(3) TKG 2021 in conjunction with Art. 6(1)(a) GDPR). You can give, change or withdraw consent at any time.

Manage cookie settings

11. Recognising business visitors and our customer system

We want to know which organisations are interested in our products. When you visit our website, our server looks up in public internet registries (RDAP) which organisation the network you are browsing from is registered to. Your IP address is used only for this lookup and is not stored. If the network belongs to a company or institution, we store its name, the pages viewed, the time, the device type and the approximate country. Networks of private internet access providers are not evaluated.

If the organisation is already one of our business contacts, we record the visit with that company in our customer relationship management system Microsoft Dynamics 365, operated for us by Microsoft Ireland Operations Ltd. as processor, with data stored in the EU and Switzerland. The legal basis is our legitimate interest in understanding business interest in our products and in preparing our conversations with companies, Art. 6(1)(f) GDPR.

Visits are linked to you personally only in two cases. First, if you open a personal link we sent you, we record that you opened it and which page it led to. Second, if you have consented to marketing cookies, we store a random visitor ID in your browser, so that your later visits can be linked to you once you identify yourself, for example through a personal link or by sending us a form. The legal basis for this is your consent, Art. 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021. You can withdraw your consent at any time in the cookie settings; the visitor ID is then deleted from your browser.

If you send us an enquiry through our contact or booking form and you are already one of our business contacts, the enquiry is also stored with your contact record.

Visit records are deleted after 24 months at the latest. You can object to this processing at any time with effect for the future by writing to office@puresurf.eu.

12. Right to lodge a complaint with the supervisory authority

Without prejudice to any other remedies, you have the right to lodge a complaint with the Austrian Data Protection Authority (Art. 77 GDPR):

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at

13. Security (Art. 32 GDPR)

We implement appropriate technical and organisational measures to protect your data, in particular TLS encryption of all data transmission (HTTPS), strict access controls and regular security updates.

14. Changes to this privacy policy

We reserve the right to amend this privacy policy in order to adapt it to changes in the legal situation or in our services. The current version is always available on this page.