Privacy policy

1. Controller

Stephan Automation e.U., owner Jan Stephan
Rochusstraße 9/4, 7100 Neusiedl am See, Austria
Phone +43 660 800 7100, email info@stephan-automation.at

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Hosting and server log files

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes the data on my behalf; a data processing agreement pursuant to Art. 28 GDPR is in place.

Each time the website is accessed, the server automatically stores data in so-called log files:

• IP address of the accessing device
• date and time of access
• page or file accessed and amount of data transferred
• website from which you came (referrer)
• browser and operating system used

I need this data to operate the website securely and reliably and to detect attacks. The legal basis is my legitimate interest pursuant to Art. 6(1)(f) GDPR. The log files are deleted after [storage period according to IONOS].

To protect the login to the website administration against attacks, the website remembers an encrypted checksum of the IP address for 15 minutes after a failed login attempt, not the address itself. The legal basis is again my legitimate interest pursuant to Art. 6(1)(f) GDPR.

To protect against attacks, I also use the security plugin Wordfence by Defiant Inc., Seattle, USA. It checks requests for known attack patterns and, for requests it recognises as attacks, stores the IP address, time and requested address in the database of this website. Participation in the Wordfence security network, which would transmit such IP addresses to Defiant, is switched off. The legal basis is my legitimate interest in a secure website pursuant to Art. 6(1)(f) GDPR.

The connection to the website is encrypted with TLS. You can recognise this by the padlock symbol and “https://” in the address bar.

3. Contact by email, phone or form

If you contact me by email, phone or via the contact form, I process your details in order to answer your enquiry. In the form these are your name, company, email address, subject and message, and optionally your phone number.

The form is part of this website and does not use any third-party service. Your details are sent to me by email via the IONOS mail server and are not stored in the website’s database. My mailbox is hosted by Microsoft 365. Microsoft processes the emails on my behalf; for the transfer of data, the information in section 4 applies.

The legal basis is Art. 6(1)(b) GDPR, because your enquiry usually prepares an order, otherwise my legitimate interest in answering it pursuant to Art. 6(1)(f) GDPR. I keep enquiries for six months for follow-up questions and delete them afterwards. If an order results, I keep the documents for as long as tax law requires. This is usually seven years (§ 132 BAO).

To protect against spam, the website checks whether the form was filled in by a human, for example by the time taken to submit it. To prevent the form from being sent in bulk, it remembers an encrypted checksum of your IP address for ten minutes, not the address itself. No data is transferred to third parties for this. The legal basis is my legitimate interest in a spam-free form pursuant to Art. 6(1)(f) GDPR.

4. Appointment booking with Microsoft Bookings

You can book a 15-minute call via a link. The booking page is not embedded in this website. Only when you click the link does the Microsoft page open and data is transferred to Microsoft.

The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you book, I process your name, company, email address, the chosen appointment and your request. The phone number is optional. If the call takes place by video, it runs via Microsoft Teams.

Microsoft processes the data on my behalf pursuant to Art. 28 GDPR and stores it in Microsoft 365. A transfer to the USA cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR.

The legal basis is Art. 6(1)(b) GDPR. I delete booking data [six months] after the appointment unless an order results. More on how Microsoft handles your data: Microsoft privacy statement.

5. Cookies

This website does not set any cookies for statistics, marketing or advertising. Technically necessary cookies are only set when I log in to the WordPress administration area as the operator. The legal basis for technically necessary cookies is § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). As no other cookies are set, I do not need consent and do not show a cookie banner.

6. No analytics tools and no embedded content

I do not use visitor statistics such as Google Analytics. Fonts are not loaded from Google or other providers. Maps, videos or posts from social networks are not embedded.

7. Links to social networks

On this website you will find simple links to my profiles on LinkedIn, Instagram and YouTube. These are normal links, not embedded plugins. Data is only transferred when you click a link and open the platform. The privacy policy of the respective provider then applies:

• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland – privacy policy
• Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland – privacy policy
• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – privacy policy

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on my legitimate interest (Art. 21). Simply write to info@stephan-automation.at.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

There is no automated decision-making or profiling pursuant to Art. 22 GDPR.

9. Changes

I update this privacy policy when the website or the legal situation changes. Last updated: [date of publication]