Privacy Policy

01Controller

Rostify GmbH
Tigergasse 17
1080 Vienna
Austria
Email: office@rostify.app
Phone: +43 1 4120052
Company register: FN 522237x, Commercial Court of Vienna

For all data protection matters, contact us at office@rostify.app or at the postal address above. We have not appointed a data protection officer, as the requirements of Article 37 GDPR do not apply to us.

02Scope

This policy applies to

• the website www.rostify.app (including its English version),
• the product documentation at docs.rostify.app and
• appointment booking at book.rostify.app.

For the processing of personal data in the Rostify software (login.rostify.app), our customers – usually your employer – are the controllers. Rostify processes this data as a processor under an agreement pursuant to Article 28 GDPR. Your employer provides information about this processing and your rights. The software’s servers are located in data centres in Austria, Germany and France.

03Visiting our websites (server log files)

Purpose:

When you access www.rostify.app, docs.rostify.app or book.rostify.app, your browser necessarily transmits data to our web server. We process this data to deliver the pages to you, to keep the service stable and to detect and repel attacks on our servers.

Data:

IP address, date and time of access, requested address (URL), previously visited page (referrer), amount of data transferred, HTTP status code, browser type and version, and operating system (user agent).

Legal basis:

Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional provision of our websites.

Retention:

We delete server log files after 30 days. If a specific attack is detected within this period, we keep the affected entries until the investigation is complete.

Provision:

Without this data, the websites cannot technically be accessed.

04Protection against automated attacks

To protect the contact form against spam, it contains a field that is invisible to humans and is filled in only by automated programs. In addition, your browser solves a small computational task before submitting (Cap). Both run on our own server, without third parties.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is protecting the website and the contact form against misuse.

05Contacting us by form, email or phone

Purpose:

Answering your enquiry and, where applicable, preparing a contract.

Data:

Name, email address, subject and message (contact form), or the information you give us by email or phone.

Legal basis:

Article 6(1)(b) GDPR where your enquiry concerns the conclusion or performance of a contract; otherwise Article 6(1)(f) GDPR. Our legitimate interest is answering enquiries addressed to us.

Recipients:

Form submissions are sent as an email to our mailbox. Our web server and mailbox are operated for us by Host Europe GmbH, Germany, as processor (see section 9).

Retention:

We delete enquiries that do not lead to a contract 12 months after the correspondence has ended. If an enquiry leads to a contract, we retain the correspondence as business correspondence for seven years from the end of the calendar year (Section 212 Austrian Commercial Code (UGB), Section 132 Austrian Federal Fiscal Code (BAO)), and beyond that only as long as it is relevant to pending proceedings.

Provision:

Name and email address are mandatory fields; without them we cannot reply. There is no legal or contractual obligation to contact us.

06Product documentation at docs.rostify.app

Purpose:

Providing the Rostify manual to our customers and their staff. Protected areas are accessible only after login.

Data:

Username, email address, name, password (stored exclusively as an encrypted hash), time of login, and the server log data described in section 3.

Cookie:

For login, docs.rostify.app sets a session cookie (rostify-…) valid for 30 minutes.

Legal basis:

Article 6(1)(b) GDPR where you are our contractual partner yourself. If you use the documentation as an employee of a customer, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is providing the contractually owed documentation to the persons designated by our customer. For the session cookie: Section 165(3) TKG 2021.

Retention:

We delete access credentials as soon as access is no longer needed, at the latest three months after the end of the contract with the respective customer.

07Appointment booking at book.rostify.app

Purpose:

Arranging and holding an online demonstration of the software (demo) and, where applicable, preparing a contract.

Data:

First name, last name, email address and organisation (mandatory fields), optionally phone number and message, the selected appointment, language and time zone, and the server log data described in section 3.

Technology:

Appointment booking runs on the open-source software Easy!Appointments on our own web server (Host Europe GmbH, see section 9). The page loads no third-party content and uses no analytics or tracking services. To protect against spam and automated bookings, your browser solves a small computational task before submitting (ALTCHA). This also runs on our server, without third parties.

Emails:

You receive a confirmation of your appointment by email. Using the link in it, you can change or cancel the appointment and delete your data. We send you the access link to the video conference by email. The demo takes place via Microsoft Teams or Zoom. If you invite us through your organisation’s account, its settings and privacy information apply.

Cookies:

book.rostify.app sets two strictly necessary cookies: ea_session (booking session, 7 days) and csrf_cookie (protection against forged form requests, 2 hours).

Legal basis:

Article 6(1)(b) GDPR where the booking serves to prepare a contract with you; in all other cases, for example where you book on behalf of your organisation, Article 6(1)(f) GDPR. Our legitimate interest is demonstrating our software to prospective customers. For the cookies and spam protection: Section 165(3) TKG 2021.

Retention:

The booking system deletes your data automatically after 365 days. If the demo leads to a contract, we retain the correspondence as described in section 5.

Provision:

Without the mandatory fields we cannot arrange an appointment. There is no legal or contractual obligation to book.

08Cookies and similar technologies

Cookies are small text files that your browser stores on your device. We set strictly necessary cookies without consent on the basis of Section 165(3) TKG 2021. We do not set any other cookies, for example for analytics or advertising. That is why our websites have no cookie banner.

09Recipients and processors

We do not sell personal data and do not disclose it for advertising purposes. The following service providers process data solely on our behalf and on our instructions under a contract pursuant to Article 28 GDPR:

Beyond this, we disclose data to authorities and courts only where we are legally obliged to do so (Article 6(1)(c) GDPR).

10Links to social networks

Our website contains a plain link to our company page on LinkedIn. This is not an embedded plug-in: no data is transmitted to LinkedIn when you visit our website. Only when you click the link are you taken to LinkedIn's website, where LinkedIn's privacy policy applies.

11No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.

12Data security

All our websites are accessible exclusively via encrypted HTTPS (TLS). We take technical and organisational measures under Article 32 GDPR to protect your data against loss, manipulation and unauthorised access, and keep them up to date with the state of the art. Please note: unencrypted emails are not protected against access by third parties in transit. Do not send us confidential information by unencrypted email.

13Your rights

You have the following rights regarding personal data concerning you:

• Access (Article 15 GDPR)
• Rectification (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)

Send your request to office@rostify.app. We respond within one month; in complex cases this period is extended by at most two further months, and we will inform you of this (Article 12(3) GDPR).

Right to object (Article 21 GDPR)

Where we process your data on the basis of our legitimate interest (Article 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Send your objection informally to office@rostify.app.

Right to lodge a complaint

If you consider that the processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. In Austria, this is the

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

14Changes to this policy

We update this policy whenever our processing or the legal situation changes. The version published here applies; the date is shown at the top. This English version is a translation; in case of discrepancies, the German version prevails.