MeasureMatePrivacy Policy
1. Data Protection Provisions
Conota e.U. operates the website www.measure-mate.app (the "Website") to present MeasureMate, a measuring app for professionals in construction and infrastructure. We only process the personal data needed to run the Website, to measure its use if you consent, and to send our newsletter if you subscribe.
This Privacy Policy informs visitors of the Website in accordance with Art 13 GDPR about the processing of personal data by Conota e.U. It covers the Website only. Once released, the MeasureMate app will have its own privacy policy.
You can visit the Website without creating an account and without providing personal data such as your name or email address.
2. Controller
The controller within the meaning of Art 4 para 7 GDPR is:
| Controller | Conota e.U. |
|---|---|
| Managing Director | Michael K. Kostner |
| Address | Dreiheiligenstraße 21a, 6020 Innsbruck, Austria |
| Company register | FN 627909x, Regional Court Innsbruck |
| ppa.atonoc@ycavirp |
Conota e.U. is not required to appoint a data protection officer. For all questions about data protection, please contact us at the email address above.
3. Hosting and Server Log Files
The Website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers located within the European Union. Hetzner processes data on our behalf as a processor under a data processing agreement according to Art 28 GDPR.
Each time you visit the Website, your browser automatically sends the following information to our server, where it is stored in log files:
- IP address of your device
- Date and time of access
- Page or file requested and the amount of data transferred
- Website from which you came (referrer)
- Browser type and version, operating system
- Status code of the request
We process this data to deliver the Website, to keep it stable and secure, to detect and defend against attacks and to fix errors. The legal basis is our legitimate interest in the secure and reliable operation of the Website (Art 6 para 1 lit f GDPR). We do not combine log data with other data and do not use it to identify you.
Log files are deleted automatically after 30 days at the latest, unless we need to keep a specific entry longer to investigate a security incident.
4. Cookies and Consent
Cookies are small text files that your browser stores on your device. The Website uses two kinds:
| Type | Purpose | Legal basis | Consent needed |
|---|---|---|---|
| Necessary cookies or local storage | Operating the Website and saving your cookie choice | § 165 para 3 TKG 2021, Art 6 para 1 lit f GDPR | No |
| Analytics cookies (Google Analytics) | Measuring how visitors use the Website, see point 5 | § 165 para 3 TKG 2021, Art 6 para 1 lit a GDPR | Yes |
When you first visit the Website, a cookie banner asks for your consent. Google Analytics is only loaded, and its cookies only set, after you click Accept. Before that, your browser does not connect to Google at all. If you decline, the Website works fully without Google Analytics.
You can change or withdraw your consent at any time through the cookie settings link in the footer of the Website. You can also delete cookies or block them in the settings of your browser.
5. Web Analytics with Google Analytics
If you consent, we use Google Analytics 4 to understand how visitors use the Website and to improve it. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), which acts as our processor.
Google Analytics uses cookies to collect the following usage data:
- Pages viewed, time spent on the Website and clicks
- How you reached the Website (for example a search engine or a link)
- Approximate location (country, region, city)
- Device type, browser, operating system, screen resolution and language
- A random identifier stored in the cookie, which recognises your browser on return visits
According to Google, Google Analytics does not log or store IP addresses of users in the EU. Your IP address is only used to derive your approximate location and is then discarded. Google Signals is not activated, our Analytics account is not linked to any advertising service, and we do not use Analytics data for advertising.
The cookies used are _ga and _ga_[ID], each with a lifetime of up to 2 years. Analytics data is stored for no longer than 14 months and then deleted automatically.
The legal basis is your consent (Art 6 para 1 lit a GDPR in connection with § 165 para 3 TKG 2021). You can withdraw it at any time with future effect through the cookie settings link in the footer.
Data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the Data Privacy Framework (DPF), for which the European Commission adopted an adequacy decision on 10 July 2023 (Art 45 GDPR). Google also uses Standard Contractual Clauses (Art 46 para 2 lit c GDPR).
More information is available in the privacy policy of Google.
6. Newsletter with Brevo
If you subscribe to our newsletter, we send you news about MeasureMate, such as product updates, launch information and events. To subscribe, you need to enter your email address. Any further fields in the form, such as your name, are optional.
To prove your consent, we record the time of your signup, the time of any confirmation and the IP address used.
To protect the form against spam, we use checks that run on our own server, without third party services. The legal basis is our legitimate interest in preventing abuse of the form (Art 6 para 1 lit f GDPR).
Our newsletter emails contain small tracking pixels and tracked links. These show us whether and when an email was opened and which links were clicked. We use this information only in order to improve the content of the newsletter.
The newsletter is sent through Brevo, a service of Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France. The signup form sends your details to our own server, which passes them on to Brevo, so your browser does not connect to Brevo directly. Brevo processes your data on our behalf as a processor under a data processing agreement according to Art 28 GDPR, and stores it on servers in the EU. Brevo may use subprocessors outside the EU, in particular in the USA and India, and protects such transfers with appropriate safeguards such as Standard Contractual Clauses (Art 46 para 2 lit c GDPR).
The legal basis for sending the newsletter and for measuring opens and clicks is your consent (Art 6 para 1 lit a GDPR in connection with § 174 TKG 2021). The record of your consent is kept to meet our duty to prove it (Art 6 para 1 lit c in connection with Art 7 para 1 GDPR).
You can unsubscribe at any time using the link at the end of every newsletter or by writing to ppa.atonoc@ycavirp. Your email address is then removed from the mailing list. We keep the record of your consent for up to 3 years after you unsubscribe, solely to prove that it was given.
More information is available in the privacy policy of Brevo.
7. Contact by Email
If you contact us by email, we process your email address, your name and any other information you include in your message, such as your company or job title. We use this data only to answer your request.
The legal basis is the handling of steps prior to entering into a contract at your request (Art 6 para 1 lit b GDPR), for example when you ask about licences or a pilot project. For all other requests, it is our legitimate interest in answering enquiries (Art 6 para 1 lit f GDPR).
We keep these messages for up to one year after our last contact, unless a contract follows, in which case the retention periods in point 10 apply.
8. Legal Basis of Processing
We process your personal data on the following legal bases, as set out for each purpose above:
- Consent (Art 6 para 1 lit a GDPR), for analytics cookies together with § 165 para 3 TKG 2021 and for the newsletter together with § 174 TKG 2021. You can withdraw your consent at any time (see point 15).
- Steps prior to entering into a contract and performance of a contract (Art 6 para 1 lit b GDPR), for example when you ask us about MeasureMate licences.
- Legal obligations (Art 6 para 1 lit c GDPR), for example retention duties under tax law and the duty to prove consent.
- Legitimate interests (Art 6 para 1 lit f GDPR), namely the secure operation of the Website, answering enquiries and the assertion, exercise or defence of legal claims.
We only process data to the extent necessary for these purposes (Art 5 para 1 lit c GDPR).
Providing personal data is not required by law or by contract. Without the technical data in the server log files (see point 3), the Website cannot be displayed. Without an email address, we cannot send you the newsletter or answer your enquiry. Declining analytics has no effect on your use of the Website.
9. Data Recipients and Transfers to Third Countries
We only share your data with the following service providers, each bound by a data processing agreement according to Art 28 GDPR. We do not sell your data.
| Recipient | Purpose | Legal basis | Location and transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH, Germany | Hosting of the Website, server log files | Legitimate interest (Art 6 para 1 lit f GDPR) | EU, no transfer outside the EU |
| Google Ireland Limited, Ireland, and Google LLC, USA | Web analytics (Google Analytics) | Consent (Art 6 para 1 lit a GDPR) | Ireland, possible transfer to the USA; Google LLC certified under the Data Privacy Framework, plus Standard Contractual Clauses |
| Sendinblue SAS (Brevo), France | Sending the newsletter, measuring opens and clicks | Consent (Art 6 para 1 lit a GDPR) | EU, possible transfers by subprocessors to the USA and India under Standard Contractual Clauses |
In addition, we may disclose data to courts, public authorities or legal advisers where we are legally obliged to do so or where it is necessary to assert or defend legal claims.
10. Duration of Processing (Retention Period)
We store your data only as long as necessary for the purpose for which we collected it, unless a legal retention duty requires longer storage.
| Data | Retention period |
|---|---|
| Server log files | Up to 30 days, longer only to investigate a specific security incident |
| Google Analytics data | No longer than 14 months; cookies expire after up to 2 years |
| Newsletter subscription | Until you unsubscribe |
| Proof of newsletter consent | Up to 3 years after you unsubscribe |
| Email enquiries | Up to 1 year after our last contact |
| Contracts, invoices and related correspondence | 7 years for tax reasons (§ 132 BAO) |
In justified individual cases, such as the assertion or defence of legal claims, we may store data for up to 30 years after the end of the business relationship.
11. Links to Other Websites and App Stores
The Website contains links to other websites, such as the Apple App Store, Google Play and our social media pages. When you click such a link, you leave the Website and the operator of the linked site becomes responsible for processing your data. We have no control over the content or privacy practices of these sites and recommend reading their privacy policies.
12. Data Privacy for Children
The Website is aimed at professionals and is not directed at persons under the age of 14. We do not knowingly collect personal data from children under 14. If we learn that a child under 14 has provided us with personal data, we delete it immediately. If you are a parent or guardian and believe this has happened, please contact us.
13. Automated Decision Making including Profiling
We do not use your data for automated decision making within the meaning of Art 22 GDPR. Google Analytics creates pseudonymous usage statistics, which have no legal or similarly significant effect on you.
14. Your Rights
If the legal requirements are met, you have the following rights regarding your personal data:
- Access: to know which of your data we process (Art 15 GDPR)
- Rectification: to have incorrect or incomplete data corrected or completed (Art 16 GDPR)
- Erasure: to have your data deleted (Art 17 GDPR)
- Restriction: to have the processing of your data restricted (Art 18 GDPR)
- Data portability: to receive the data you provided in a structured, commonly used and machine readable format (Art 20 GDPR)
- Objection: to object to processing based on our legitimate interests, on grounds relating to your particular situation (Art 21 GDPR)
To exercise any of these rights, please write to ppa.atonoc@ycavirp. We respond within one month (Art 12 para 3 GDPR). We may ask you to confirm your identity before answering.
Right to Object
Where we process your data based on our legitimate interests (Art 6 para 1 lit f GDPR), namely for the server log files, email enquiries and spam protection of the newsletter form, you have the right to object at any time on grounds relating to your particular situation (Art 21 para 1 GDPR).
We will then stop processing your data for these purposes, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims. To object, please write to ppa.atonoc@ycavirp.
15. Withdrawal of Consent
Where we process your data based on your consent, you can withdraw it at any time with effect for the future (Art 7 para 3 GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.
- Analytics cookies: through the cookie settings link in the footer of the Website
- Newsletter: through the unsubscribe link in every newsletter
- In all cases: by writing to ppa.atonoc@ycavirp
16. Right to Complain to a Supervisory Authority
If you believe that we have violated your right to lawful processing of your data, please contact us first by post or email so that we can resolve the issue.
You also have the right to lodge a complaint with the supervisory authority responsible for you (Art 77 GDPR). In Austria, this is the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Wien, www.dsb.gv.at.
17. Data Security
The Website uses TLS encryption, which you can recognise by "https" and the lock symbol in the address bar of your browser. We also take appropriate technical and organisational measures (Art 32 GDPR) to protect your data against loss, misuse and unauthorised access. Access to personal data is limited to persons who need it for the purposes described in this policy.
18. Changes to this Privacy Policy
We update this Privacy Policy when the Website, our services or the law change. The current version is always available on this page.
19. Contact Us
If you have questions about this Privacy Policy or about how we handle your data, please contact us at ppa.atonoc@ycavirp or by post at Conota e.U., Dreiheiligenstraße 21a, 6020 Innsbruck, Austria.