Privacy policy

Version 1.4-entwurf

Draft – to be reviewed legally before the pilot operation.Only the German version is binding.

1 Controller

The controller for the processing of the data of the accounts of simmpel AVA (Art. 4(7) GDPR) is Samuel Simm, Strauchergasse 18, 8020 Graz, email: simm.samuel@simmpel.at (hereinafter “operator”). Until a company is founded, a private person operates simmpel AVA. No data protection officer has been appointed; please send enquiries to the email address given.

2 What data we process

• Account: name, email address, password (only as an Argon2id hash), second factor (encrypted), initials and signature (function, company, telephone), memberships and roles in organisations, consents to legal texts with version and time. • Interface settings: language (German or English), whether the welcome message appears after the login, time at which the tour was finished or skipped. • Login and security: sessions, logins and failed attempts with IP address and browser. • Use: last opened projects (per user, project and time, visible only to the user; for the order of the project list and the note “Continue with …”) and the audit log of the organisation (who imported, changed, sent what and when). • Email: system emails (invitations, links, notices) and dispatches of the quantity report with recipients and delivery status. Opens and clicks are not evaluated; the email provider counts them only anonymously. The operator processes project content (LV, invoices, distribution lists with contact persons) on behalf of the organisation; the data processing agreement applies to this. Cookies: only technically necessary cookies for the login (session) and for protection against forged requests (CSRF). They end when the browser is closed. Anyone who chooses “Keep me signed in” at the login (voluntary, not preselected) receives the same cookies permanently: until signing out, until the login has not been used for 15 days, at most 90 days (operator accounts 12 hours). Under Account › Logins, all logins on all devices can be ended. There are no analytics or advertising cookies and no integration of third-party services; fonts are delivered by the application itself. Browser storage (no cookie, no transmission to the server): the language chosen before the login until another choice and – until the browser window is closed – that the welcome message has already appeared.

3 Purposes and legal bases

• Provision of the application and management of the accounts, including language, welcome message, tour and last opened projects: performance of the contract (Art. 6(1)(b) GDPR). • Security, prevention of misuse and traceability (logs, limitation of failed attempts): legitimate interest in secure operation (Art. 6(1)(f) GDPR). • System emails about account, security and licence: performance of the contract; no advertising emails are sent. • Retention of invoices for paid plans: legal obligation (Art. 6(1)(c) GDPR, § 132 BAO).

4 Recipients and processors

• OVH GmbH (OVHcloud), St. Johanner Straße 41–43, 66111 Saarbrücken, Germany; parent company OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: hosting of the server (Public Cloud: compute instance) and storage of the encrypted backup (Object Storage) – server in the data centre in Frankfurt (Germany), backup in Gravelines (France). Agreement: data processing agreement of OVHcloud (annex to the general terms and conditions) in the version valid at the time of the order in October 2026. • Sendinblue GmbH (Brevo), Köpenicker Straße 126, 10179 Berlin, Germany; parent company Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France: sending of the e-mails (system e-mails and quantity reports) via SMTP, reports on undeliverable e-mails and spam; Brevo counts opens and clicks only anonymously, simmpel AVA does not evaluate opens – European Union. Agreement: data processing agreement (annex 3 of the general terms of use of the Brevo services) in the version valid when the account was opened in October 2026. No transfer to countries outside the EU/EEA takes place.

5 Storage period

• Account including the interface settings: until the account or the organisation is deleted. • Last opened projects: until the user or the project is deleted or the membership in the organisation ends. • Login and security events (with IP address and browser): 12 months. • Technical logs (import, change, dispatch, licence) and dispatch archive: as long as the organisation exists. • Failed login attempts: 1 day; sessions: at most 30 days, with “Keep me signed in” at most 90 days. • Access log of the web server (IP address shortened): 14 days; logs of the application: 30 days. • Reports of the email provider on undeliverable emails and spam: 90 days. • Backups: 30 days (daily) or 12 months (monthly). After the end of a licence, the data of the organisation are deleted at the earliest after 90 days and only after notice.

6 Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can lodge complaints with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).

7 Obligation to provide data, automated decisions

Name, email address and password are required for use; without them no account is possible. There is no automated decision-making, including profiling.