Privacy policy

This site has no cookie banner because it needs none: it sets no cookie that would require consent and stores nothing on your device that recognises you. What data still arises, what we use it for and how long we keep it is set out here.

This is a translation for convenience. The German version of this policy is the binding one.

Controller

Name: Michael Steinmötzger
Address: Erzherzog-Karl-Straße 84–88/8/8, 1220 Vienna, Austria
Email: info@ionvo.at

Questions about data protection go to the same address. We are currently not required to appoint a data protection officer under Art. 37 GDPR.

Hosting

The site runs as a container on a server we operate ourselves. The server is located at [hosting provider, location]. The provider supplies the machine and the network connection and may process connection data such as your IP address to run its network and fend off attacks.

Processor: [hosting provider, address]
Location: [data centre location]
Legal basis: Art. 6(1)(f) GDPR, legitimate interest in secure and stable operation
Contract: Data processing agreement under Art. 28 GDPR

The connection between your browser and the server is encrypted with TLS.

Server log files

On every request the server writes one line to a log file: IP address, time, the address requested, status code, amount of data transferred, the page you came from if your browser sends it, and browser and operating system. We use these lines to find faults and fend off attacks. We do not combine them with other data and do not evaluate them by person.

Purpose: Operating the site, security, fault finding
Legal basis: Art. 6(1)(f) GDPR, legitimate interest in secure and stable operation
Retention: As long as needed for these purposes, after which the log files are deleted. While an attack is being investigated, we keep the lines concerned until it is closed.

Waitlist and newsletter

When you join the waitlist or subscribe to the newsletter, we store your email address and the time you signed up. We then send you an email with a confirmation link. Your entry only becomes valid once you click it; we also store the time of confirmation as evidence of your consent. The waitlist and the newsletter are two separate lists: leaving the newsletter keeps you on the waitlist.

After joining the waitlist you can answer three questions: which trade, how many employees, how you write your invoices today. The answers are optional. We store them, together with the language of the site and the place where you signed up, as attributes of your address. They help us finish IONVO first for the businesses that need it most, and to write to you only about what concerns you.

We keep the lists with the software Listmonk on our own server. The emails themselves, the confirmation mail and every newsletter, are sent through Amazon Simple Email Service (SES). Amazon receives your email address and the content of the message for that and processes both on our behalf.

Purpose: Waitlist: a message when IONVO launches. Newsletter: a few times a year, what is happening in e-invoicing and construction billing and what is new in IONVO.
Legal basis: Art. 6(1)(a) GDPR, your consent
Retention: Until you unsubscribe or withdraw your consent. After that we delete your address and the attributes stored with it.
Processor: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, for sending the emails through Amazon SES
Contract: Data processing agreement under Art. 28 GDPR (AWS GDPR Data Processing Addendum). Where Amazon Web Services, Inc., based in the USA, accesses data, the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR apply; Amazon Web Services, Inc. is also certified under the EU-US Data Privacy Framework.

When you submit the form, we process your IP address briefly in the server’s memory to limit mass sign-ups. It is not written to a log file and is discarded after one hour at most. The legal basis is Art. 6(1)(f) GDPR, legitimate interest in protecting the form from abuse.

You can unsubscribe through the link at the end of every email or with a message to info@ionvo.at. It takes effect at once.

More on how Amazon handles data is in the AWS privacy notice.

Audience measurement with Umami

We want to know which pages are read and whether the site works. For that we use Umami, audience measurement software that we run ourselves. No data flows to a vendor.

Umami sets no cookie and stores nothing on your device. On a page view our server receives the page viewed, the referring page, browser, operating system, device type, screen size, language and your IP address. From the IP address the server derives country and region and then discards it; it is not stored. To count repeat views from the same browser, Umami builds a hash from the IP address, browser data and a regularly rotating random value, from which neither the address nor the person can be recovered.

We also count individual actions: that a form was submitted, that the booking calendar was opened, that the price calculator was used, that the language was switched. What you entered is not transmitted, nor is an email address.

Purpose: Counting views and actions in order to improve the site
Legal basis: Art. 6(1)(f) GDPR, legitimate interest in statistics that do not touch your device
Retention: IP address: none. Statistics: permanently, with no link to a person.

We show no cookie banner for this: Umami does not access your device and stores nothing on it, so § 165(3) of the Austrian Telecommunications Act (TKG 2021) requires no consent. We base the brief processing of the IP address on our legitimate interest.

You can object to this processing at any time by email to info@ionvo.at. Because we store no IP address, a past visit can no longer be attributed to anyone; the statistics contain nothing that leads back to you.

Spam protection with Cloudflare Turnstile

So that the waitlist and the newsletter are not flooded by automated programs, Cloudflare Turnstile checks when a form is submitted whether a person is at the device. For that your browser loads a script from Cloudflare. Cloudflare receives your IP address and technical characteristics of your browser and device, and observes how you interact with the form. The result is a verification token that our server checks with Cloudflare. Cloudflare does not see what you entered in the form.

Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany
Legal basis: Art. 6(1)(f) GDPR, legitimate interest in protecting the forms from abuse. The check is strictly necessary for the security of the service.
Third country: Transfer to the USA on the basis of the EU-US Data Privacy Framework, under which Cloudflare, Inc. is certified, and the European Commission’s standard contractual clauses

Appointment booking with Microsoft Bookings

On the contact page and after joining the waitlist you can book a 20-minute call. The calendar comes from Microsoft Bookings, a service in our Microsoft 365 account. It does not load by itself: at first you see only a note and a button. Only when you click “Pick a time” does your browser load the booking page from outlook.office365.com in an embedded frame. On a phone it opens in a new tab.

On loading, Microsoft receives your IP address and technical details about your browser, and the booking page may set its own cookies and storage inside its frame. What you enter there, that is name, email address, phone number and trade where asked, and the chosen time, lands in our calendar and is processed by Microsoft on our behalf.

Processor: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
Legal basis: Loading the calendar: your consent given by the click, Art. 6(1)(a) GDPR. Booking and call: Art. 6(1)(b) GDPR, steps prior to entering into a contract.
Contract: Microsoft Products and Services Data Protection Addendum (processing under Art. 28 GDPR) with the European Commission’s standard contractual clauses for any processing outside the EU; Microsoft Corporation is also certified under the EU-US Data Privacy Framework
Retention: Until the call has taken place and is settled, unless a business relationship follows from it

More in Microsoft’s privacy statement.

Fonts

The typefaces Archivo and JetBrains Mono are stored on our own server and delivered together with the site. Your browser opens no connection to Google Fonts or any other outside server for them.

Contact by email

When you write to us, we process your email address and the content of your message in order to answer it. The legal basis is Art. 6(1)(b) GDPR for pre-contractual enquiries and otherwise Art. 6(1)(f) GDPR.

We delete the message once the enquiry is settled and no retention obligation stands in the way. We do not pass your address on and do not use it for advertising.

Cookies

This site sets a single cookie, and only when you switch the language by hand: ionvo_lang remembers whether you chose German or English, so that you land on the right home page next time. It holds only the language code, is valid for one year and is strictly necessary for this function; under § 165(3) TKG 2021 it needs no consent. Otherwise the site stores nothing on your device, not even in the browser’s local storage.

The embedded Microsoft Bookings calendar may set its own cookies inside its frame after you click “Pick a time”, see above.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7(3)). Write to info@ionvo.at for any of these.

Supervisory authority

If you believe we are not processing your data lawfully, you can complain to the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at.

Changes

If something is added to the site that processes data, we update this policy. The date below says when that last happened.

Last updated: September 2026