Privacy Policy

Effective Date: August 2, 2026
Last Updated: August 2, 2026

1. Introduction

This Privacy Policy explains how Integrations IT-Solutions e. U. (“we,” “us,” “our,” or “Company”) processes personal data when you visit our website integrations.at (the “Website”) and when you contact us through it.

It describes what we actually do. Where a detail is still being confirmed, we say so rather than promise something the system does not deliver.

2. Responsible Party (Data Controller)

Company Name: Integrations IT-Solutions e. U.
Legal Form: Einzelunternehmen (sole proprietorship)
Registration: FN 374390 z, Handelsgericht Wien
VAT ID: ATU60335747
Owner: Alexander Kastil
Email: agent@integrations.at
Postal Address: Neuwaldegger Straße 50-54/1/6, 1170 Wien, Austria

This is the same entity and the same contact named in our Imprint. Write to the email address above for anything in this policy: no account on any platform is required, and we do not route data protection requests through a contact form.

2.1 Data Protection Officer

We have not appointed a data protection officer. An undertaking of this size does not meet the conditions of Art. 37 GDPR: we carry out no large-scale systematic monitoring and process no large-scale special-category data. Data protection matters are handled directly by the controller at the address above.

3. Purposes, Data and Legal Basis

Each purpose below rests on exactly one legal basis under Art. 6(1) GDPR.

Purpose	Data processed	Legal basis
Delivering and securing the Website	IP address, request time, requested URL, user agent, referrer (platform and application logs)	Art. 6(1)(f): our legitimate interest in operating the site, keeping it available and defending it against abuse
Answering an inquiry you send us	Name, company, email address, selected topics, message	Art. 6(1)(b): steps taken at your request prior to a possible contract
AI-assisted background research on an inquiry (Section 6)	The inquiry data above, plus information found in publicly accessible web sources	Art. 6(1)(a): your separate, optional opt-in at the inquiry widget
Website analytics (Section 8)	Truncated technical request data processed by Ahrefs Web Analytics	Art. 6(1)(a): your consent given in the cookie banner
Recording and honouring your analytics choice	The value “accepted” or “declined” in the `iat_consent` cookie	Art. 6(1)(f): our legitimate interest in respecting your choice and being able to demonstrate it
Delivering consulting and training services	Contact and contract data of the client	Art. 6(1)(b): performance of the contract
Keeping accounting and tax records	Invoices and related business records	Art. 6(1)(c): retention duties under Austrian tax and commercial law

We never sell your personal data. We do not share it with advertisers or marketing networks.

Providing your name, company, email address and message is voluntary. It is neither a statutory nor a contractual requirement; the only consequence of withholding it is that we cannot reply to you. If we ever intend to process data we hold for a purpose other than the one it was collected for, we will inform you about that purpose before doing so (Art. 13(3) GDPR).

The floating “Let’s talk” widget is the only place on this site where you can submit personal data.

What it collects: your name, your company, your email address, the talk topics you selected, and your free-text message.
What happens to it: the data is sent to our API, stored in an Azure SQL database in the EU, and delivered to us as an internal notification email through Microsoft 365.
Purpose and basis: answering your request, on the basis of Art. 6(1)(b) GDPR.
Recipients: Microsoft as our hosting, database and mail processor (Section 9). No one else receives it.
Retention: inquiry records are kept for 24 months from receipt and are then deleted, unless a longer period is required by law or the inquiry has become part of a client relationship.

5. Website Logs

Serving a page produces technical log records on the server we operate at Hetzner and, for inquiry submissions, on our API running on that same server, together with application telemetry in Azure Application Insights. These records contain the IP address of the requesting device. Application Insights telemetry is configured with a retention of 90 days, after which it is deleted by the platform.

6. AI-Assisted Processing of Inquiries

If you switch on the optional AI research opt-in when you send an inquiry, we run an automated background research step on it. You can send an inquiry with this switch off; the switch is not a condition for contacting us.

What runs: the inquiry data (name, company, email address, topics, message) is passed to an AI agent hosted on Microsoft Foundry.
What it does: the agent performs a public web search to establish your likely professional role, your employer, the employer’s approximate size and sector, publicly reported business signals, and, where one is publicly published, a link to a profile picture.
Additional data from public sources: this means we obtain information about you from publicly accessible web sources (Art. 14 GDPR). The categories are the ones just listed; the sources are the public web pages the agent cites.
What we do with the result: the research summary is stored alongside your inquiry and included in the internal notification email so that a human can prepare a relevant answer.
Legal basis: your consent under Art. 6(1)(a) GDPR, given at the widget and withdrawable at any time (Section 12).
Retention: the research record is deleted together with the inquiry it belongs to.

No automated decisions. Nothing on this site makes a decision about you that produces legal effects or similarly significantly affects you. The research output is background material only: every reply to you is written and sent by a person, who reviews the AI output first. Art. 22 GDPR is therefore not engaged. AI outputs can be incomplete or wrong, which is one reason a human reviews them; you can ask us to correct or delete a research record at any time. Our transparency disclosure on AI use across the site is in our Terms, and this section is consistent with it.

Right to object: you can object to this processing at any time, and withdraw the opt-in in the same message. Section 12 sets out how.

Where this runs: the Microsoft Foundry project is provisioned in Sweden Central, and its model deployments use the EU Data Zone, so inference on your inquiry stays within the European Union. The web search the agent performs reaches public websites that may be hosted anywhere.

AI used to build this site, not to process you. The software of this website is written with AI assistance using Anthropic Claude under a Team licence. That is a development tool operating on source code on our own workstations. It is not part of the running website, it is not in the path of any request you make, and it receives no personal data about you. Anthropic is therefore not a recipient of your data and does not appear in Section 9.

7. Cookies and Local Storage

We use no advertising cookies, no tracking pixels and no cross-site identifiers. The complete list of what this site stores on your device is:

Item	Type	Purpose	Lifetime
`iat_consent`	First-party cookie, values “accepted” or “declined”	Stores your decision on website analytics so the banner is not shown again on every page	12 months
`agentsConfig`	`sessionStorage` entry (first-party)	Holds the talk topics you selected and the open state of the inquiry widget while you use it	Cleared when you close the browser tab

Both items are strictly necessary: one records the choice you made, the other keeps the widget you opened working. Neither is used to track you across websites. You can delete both at any time through your browser settings; deleting iat_consent brings the banner back so you can choose again.

8. Website Analytics (Ahrefs Web Analytics)

We use Ahrefs Web Analytics to understand which pages are read and where visitors come from. It is loaded only after you choose “Accept” in the cookie banner and never before.

Processor: Ahrefs Pte. Ltd., a company established in Singapore.
What it collects: page views and referrer information. According to the vendor, the script sets no cookies and writes nothing to your device’s storage, and raw IP addresses are not stored: they are combined with the user agent into a hash using a salt that is rotated every 24 hours.
Legal basis: your consent under Art. 6(1)(a) GDPR.
Withdrawing consent: choose “Reject” in the banner, or delete the iat_consent cookie and choose “Reject” when the banner reappears. Withdrawal takes effect immediately and does not affect the lawfulness of processing carried out before it. You can also email us and we will confirm.

9. Recipients and Processors

Recipient	What it does	Location
Hetzner Online GmbH	Provides the server on which the Website, the API that receives inquiries, and our database run	EU (Germany, Frankfurt)
Microsoft (Azure Application Insights / Azure Monitor)	Request and error telemetry for the API, 90-day retention	EU (West Europe)
Microsoft (Microsoft Foundry)	Runs the AI research agent and its web search grounding, only for opted-in inquiries	EU (Sweden Central, EU Data Zone)
Microsoft (Microsoft Graph / Microsoft 365)	Delivers the internal inquiry notification email	EU
Ahrefs Pte. Ltd.	Website analytics, only after consent	Singapore
Austrian authorities and courts	Only where we are legally obliged to disclose	Austria

10. International Data Transfers

Our Azure services are provisioned in EU regions and the inquiry data is stored in the EU. Where Microsoft accesses data from outside the EU/EEA for support or operations, that access is governed by the transfer mechanisms in the Microsoft Data Protection Addendum (Standard Contractual Clauses under Art. 46(2)(c) GDPR, and the EU-US Data Privacy Framework where the recipient is certified under it).

Ahrefs Pte. Ltd. is established in Singapore. There is no European Commission adequacy decision for Singapore, so this transfer relies on Standard Contractual Clauses under Art. 46(2)(c) GDPR. It only takes place if you consent to analytics.

You may ask us for a copy of these safeguards; Section 12 sets out how.

11. Data Retention

Data	Retention
Inquiry records (name, company, email, topics, message)	24 months from receipt, then deleted (see the note in Section 4)
AI research records	Deleted together with the inquiry they belong to
Internal inquiry notification emails	Deleted together with the inquiry record
Application Insights telemetry	90 days, enforced by the platform configuration
`iat_consent` cookie	12 months
`agentsConfig` session storage	Until you close the browser tab
Contract, invoice and accounting records	7 years, as required by Austrian tax and commercial law

12. Your Rights

You have the following rights in respect of your personal data:

Access (Art. 15): a copy of the data we hold about you and the details of its processing.
Rectification (Art. 16): correction of inaccurate or incomplete data.
Erasure (Art. 17): deletion where there is no basis to keep the data.
Restriction (Art. 18): processing frozen while a dispute is resolved.
Data portability (Art. 20): your data in a structured, commonly used, machine-readable format.
Objection (Art. 21): you can object at any time to processing based on our legitimate interests (Section 3), and to the AI research described in Section 6.
Withdrawal of consent (Art. 7(3)): where processing is based on your consent (website analytics, AI research), you can withdraw it at any time. Withdrawal is as easy as giving consent and does not affect the lawfulness of processing carried out before it.

How to exercise them: send one email to agent@integrations.at. No account on any platform is required, no form has to be used, and we do not charge for it. We answer within one month of receiving your request (Art. 12(3) GDPR); if a request is exceptionally complex we will tell you within that month and may extend it by up to two further months.

Right to lodge a complaint (Art. 77): you can complain to the Austrian supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

13. Children’s Privacy

This Website is aimed at businesses and is not directed at children. Under § 4(4) of the Austrian Datenschutzgesetz (DSG), read with Art. 8 GDPR, a child in Austria can consent to information society services once it has completed its 14th year of life; below that age, consent must be given or authorised by the holder of parental responsibility. We do not knowingly collect personal data from children under 14, and if we learn that we have, we delete it promptly.

14. Security

We apply the following technical and organizational measures:

Encryption in transit: the Website and the API are served exclusively over HTTPS/TLS.
Passwordless authentication between services: our services authenticate to Azure with managed identities (Azure Identity), so no service credentials are stored in the application.
No secrets in source control: credentials and keys are kept out of the repository and out of log output.
Access control: access to the inquiry database and the operator mailbox is limited to the controller.

If a personal data breach occurs, we are required to notify the Datenschutzbehörde within 72 hours of becoming aware of it and, where the risk to you is high, to notify you directly (Arts. 33 and 34 GDPR).

No security measure is absolute. If you send us confidential information, consider whether email is the right channel for it.

15. Third-Party Links

The Website links to external sites (for example LinkedIn, GitHub and Microsoft documentation). We are not responsible for their privacy practices. Review their privacy policies before providing personal data to them.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in the law or in how the Website works. The current version is always published on this page with the effective date at the top. Material changes are announced here; we do not use inquiry email addresses to send policy notifications.

Questions about this policy, data-subject requests and complaints all go to the controller named in Section 2, by the route set out in Section 12. Our full company, registration and imprint details are in the Imprint; the terms governing use of this Website are in our Terms of Service.

Last Updated: August 2, 2026This policy is governed by Austrian and EU data protection law, in particular the General Data Protection Regulation (EU) 2016/679 and the Austrian Datenschutzgesetz (DSG).