Privacy policy
<br>
Our data security principles
<ul>
<li>We try to reduce the amount of collected data to what is necessary for providing our services</li>
<li>We communicate internally only via encrypted communication</li>
<li>Unsafe communication (like email) is switched to secure communication as quickly as possible</li>
<li>All our mobile hard drives are encrypted</li>
<li>Unencrypted USB-sticks are used sparingly and only for public data (e.g.
presentations).</li>
<li>If technically possible, all our mobile devices are encrypted.</li>
<li>Anything which cannot be encrypted is locked away and inaccessible to anyone outside of the company.</li>
</ul>
Controller<br>
<p>
<strong>Neurohr Bytes Software e.U.</strong>
<br>
Contact details see "Processor".</p>
Controller's Data Protection Officer
<br>
<p>
<strong>KITTL4web | Inh.
Udo B.
S.
KITTL</strong>
<br>Contact details see "Processor's Data Protection Officer".</p>
Processor
<p>Ing. <strong>Philipp Neurohr</strong>, BSc, MSc</p>
<p>
<strong>Neurohr Bytes Software e.U.</strong>
</p>
<p>Web: neurohr.bytes.software</p>
<p>Email: neurohr@bytes.software</p>
<p>Burgenland: Mogersdorf 6, 8382 Mogersdorf, Austria</p>
<p>Tel: +43-680-2311-673</p>
<p>UID: ATU70020158 | FN: 443581a</p>
<p>Court of jurisdiction Graz, Austria</p>
<p>
<br>
</p>
<p>Next to our company internal servers Neurohr Bytes Software e.U.
has servers with following providers:</p>
<p>
<br>
</p>
<p>
<strong>internex GmbH</strong>
</p>
<p>Alserbachstraße 30</p>
<p>1090 Wien</p>
<p>Österreich</p>
<p>Firmenbuchnummer: 342171v</p>
<p>UID: ATU65604535</p>
<p>
<br>
</p>
<p>
<strong>Ledl.net GmbH</strong>
</p>
<p>
<strong>Domaintechnik.at</strong>
</p>
<p>Lederergasse 6</p>
<p>5204 Straßwalchen</p>
<p>Österreich</p>
<p>Firmenbuchnummer: FN 258818s</p>
<p>UID: ATU 61529037</p>
<p>
<br>
</p>
<p> In order to defend servers against DDoS attacks selected services and services under attack use Cloudflare, if the sensitivity of the processed data allows this measure.
</p>
<p>
<strong>Cloudflare Germany GmbH</strong>
</p>
<p>Rosental 7</p>
<p>80331 München</p>
<p>Deutschland</p>
<p>+49 89 25552276</p>
<p>Transparency report</p>
<p>
<br>
</p>
Processor's Data Protection Officer
<p>
<strong>KITTL4web | Inh.
Udo B.
S.
KITTL</strong>
</p>
<p>Web: www.kittl4web.at</p>
<p>E-mail: office@kittl4web.at</p>
<p>Öblarn 71</p>
<p>8960 Öblarn</p>
<p>Telephone: +43 660 232 82 27</p>
<p>TEL/Fax: +43 3684 20387</p>
<p>
<br>
</p>
<p>
<strong>internex GmbH:</strong>
</p>
<p>dataprotection@internex.at</p>
<p>
<br>
</p>
<p>
<strong>Ledl.net GmbH:</strong>
</p>
<p>Franz Reischenböck</p>
<p>Stv: Fabian Ledl</p>
Capture
Your data is captured personally by our employees, or provided by you via this portal.
Access and usage
Our employees can access your data via access controlled, two-factor authenticated, portal interfaces.
Storage
<p>
<strong>On production environments</strong> your data is stored on servers in our control.</p>
<p>
<br>
</p>
<p>
<strong>On archival systems</strong> your data is stored on encrypted hard drives and locked servers.
Our employees have no direct access to these storages during regular operation.</p>
Disposal and archives
<p>
<strong>In production environments</strong> your data is deleted on request.</p>
<p>Your data is automatically deleted if you close your account.</p>
<p>
<br>
</p>
<p>
<strong>On archival systems</strong> data is kept for up to 10 years (see below).</p>
<p> Your individual data cannot be deleted from (database) backups because of technical limitations.
Only named individuals of the controller and processors, with a special clearance and after completing an internal data protection training, can access these backups.
</p>
<p> Backups are only accessed in order to restore services, find errors, or provide data for reasonable and valid in law demands by public offices and courts of justice.
We will never use backups for any form of marketing analysis, or in order to restore data you wanted to be deleted.
</p>
<p> If data is provided to courts of justice and public offices, this is only done in accordance with our Data Protection Officer.
If we are not prohibited by law, we will always try to contact you to inform you about such data release.
</p>
<p>
<strong>Database backups</strong> of the portal are kept for 10 years.</p>
<p>
<strong>Invoicing data</strong> is kept for 10 years.</p>
<p>
<strong>Log files</strong> of the portal are kept for up to 90 days.</p>
<p>
<strong>IP addresses</strong> of failed and successful login attempts are kept for up to 90 days.</p>
<p>
<strong>Browser platforms, names and versions</strong>, which were used during login attempts, are kept for up to 90 days.</p>
<p>
<strong>Other backups</strong> of the portal are kept for up to 90 days.</p>
<p>
<br>
</p>
Transmission within member states of the European Union and countries with an Adequacy decisions on the basis of article 45 of Regulation (EU) 2016/679
<p>Your data is transmitted for following reasons:</p>
<p>
<br>
</p>
<p>
<strong>Communication:</strong> e.g.
letters, emails, telephone</p>
<p>
<strong>Contract fulfilment:</strong> e.g.
bank account</p>
<p>
<strong>Demands from public offices and courts of justice if reasonable and valid in law:</strong> We will comply with demands valid in law.</p>
<p> If data is provided to courts of justice and public offices, this is only done in accordance with our Data Protection Officer.
If we are not prohibited by law, we will always try to contact you to inform you about such data release.
</p>
Transmission to non-member countries
<p>There is <strong>no</strong> planed transmission of your data to non-member countries or international organisations, with the exception of your personal demands (e.g.
contact address in a non-member country).</p>
Cookies and external services
<p>
<strong>Information regarding the EU directive 2009/136/EC</strong>
<br> This online tool uses Cookies, Cloudflare and hCaptcha to provide the best possible functionality, to improve the service and to protect the portal from attacks.
</p>
<p>
<br>
</p>
<p>When you visit our portal you will receive some cookies necessary for the provision of the portal's services</p>
<p>
<br>
</p>
<p>
<strong>XSRF-TOKEN:</strong> This cookie helps us to battle Cross-Site-Request-Forgery (Wikipedia) .
</p>
<p>
<br>
</p>
<p>
<strong>laravel_token:</strong> This cookie is also used to battle Cross-Site-Request-Forgery (Technical reference) .
</p>
<p>
<br>
</p>
<p>
<strong>
<em>portal_name</em>_session:</strong> This is a secure and encrypted cookie storing all volatile data of your session.
</p>
<p>
<br>
</p>
<p>
<strong>remember_web_<em>random_string</em>:</strong> This cookie is set if you check the "Remember login" button during login.
</p>
<p>
<br>
</p>
<p>
<strong>browser_authentication:</strong> This cookie is set to reduce the amount of CAPTCHA-challenges in the current browser.
</p>
<p>
<br>
</p> If necessary
<p>
<strong>Cloudflare:</strong> In order to defend servers against DDoS attacks selected services and services under attack use Cloudflare, if the sensitivity of the processed data allows this measure.
</p>
<p>
<br>
</p>
<p>
<strong>Several cookies for hcaptcha.com:</strong> These cookies are set by hCaptcha at the latest if the login form is shown.
hCaptcha are the picture challenges you have to solve before being able to login.
This prevents attackers from accessing your account just by testing random password until one matches.
hCaptcha data security notice </p>
<p>
<br>
</p>
<p>
<strong>Several cookies for vimeo.com:</strong> This cookies are set when a Vimeo video or preview is loaded on the page.
Vimeo's Cookie Policy </p>
<p>
<br>
</p>
<p>
<strong>Several cookies for youtube.com:</strong> This cookies are set when a YouTube video or preview is loaded on the page.
YouTube data security notice </p>
<p>
<br>
</p>
<p>
<strong>__stripe_mid:</strong> Fraud prevention by the payment provider Stripe.
Stripe's Cookie Policy </p>
<p>
<br>
</p>
Tips for privacy aware browsing
<p> In order to block so-called tracking-cookies we suggest that you use DuckDuckGo, both the app, as well as the browser extention.
</p>
<p>
<br>
</p>
<p> As alternative, or in addition, we can recommend the browser extension Privacy Badger, which also sends Do Not Track signals to each website, if requested (see below).
</p>
<p>
<br>
</p>
Do Not Track (DNT) policy
<p> dnt-policy.txt
</p>
<p> Our software respects Do Not Track signals sent by your browser and takes care that external services are only connected with explicit permission.
This can lead to limited functionality and additional user interactions: Videos don't autoplay, payment providers are not available, registration is not possible, if an external CAPTCHA-service is required as additional security, etc.
<br>Permission is given per service, i.e.
if you allow one video to play then all videos from that external provider are allowed to play in your current session.
</p>
<p>
<br>
</p> NeurohrByteS - <strong>
</strong>
<small>GET https://neurohr.bytes.software/public/data-protection?lang=en</small>