Privacy Policy

1. Data Controller

Nodera FlexCo
Andrei Buliga
Freytaggasse 25/12, 1210 Vienna, Austria
Email: [email protected]
Phone: +43 664 1580151

2. Overview

This privacy policy explains how Nodera FlexCo (“we”, “us”, “our”) processes personal data when you visit our website nodera.studio and use our services. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the Swiss Federal Act on Data Protection (FADP).

3. Data We Collect

3.1 Contact Form Data

When you submit our contact form, we collect the following information:

• Name (required)
• Email address (required)
• Phone number (optional)
• Project type, budget range, and timeline preferences
• Project description / message
• Preferred availability for a call

Legal basis: Art. 6(1)(b) GDPR — processing is necessary for the performance of pre-contractual measures taken at your request.

3.2 Analytics Data

We use Cloudflare Web Analytics to collect anonymized usage data including page views, session duration, referrer information, and general device/browser information. Cloudflare Web Analytics is privacy-focused: it does not use any client-side state (such as cookies or localStorage), does not fingerprint visitors, and does not collect personally identifiable information.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding website usage to improve our services.

3.3 Server Logs

Our hosting provider (Hetzner Online GmbH) and CDN provider (Cloudflare) automatically collect server access logs including IP addresses, request timestamps, requested URLs, HTTP status codes, and user agent strings. These logs are necessary for the secure operation of our website.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in IT security and the reliable operation of our website.

4. Cookies and Local Storage

4.1 Essential Storage

We use the following essential client-side storage:

• Theme preference (localStorage): Stores your light/dark mode preference. No personal data.
• Contact form progress (localStorage): Temporarily saves your form progress so you can resume if you navigate away. Cleared after submission.
• Cookie consent preference (localStorage): Records your cookie consent choice.

5. Data Processors and Third-Party Services

6. International Data Transfers

Resend (US): Contact form data is transmitted to Resend Inc. in the United States for email delivery. This transfer is safeguarded by the EU-US Data Privacy Framework (DPF). As a fallback, Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR apply.

Simple Icons CDN (US): When technology icons are loaded, your IP address and user agent may be transmitted. This is a minimal data transfer necessary for content delivery.

7. Data Retention

• Contact form data: 7 years (Austrian Federal Fiscal Code / BAO, §132 retention obligation)
• Analytics data: As per Cloudflare's retention settings
• Server logs: 30 days
• Local storage data: Until manually cleared by you or cleared upon form submission

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): Obtain confirmation of whether your data is being processed and request a copy.
• Right to rectification (Art. 16 GDPR): Request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): Request deletion of your data, subject to legal retention obligations.
• Right to restriction (Art. 18 GDPR): Request restriction of processing in certain cases.
• Right to data portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): Withdraw consent at any time (e.g., analytics cookies via our cookie banner). Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise your rights, contact us at: [email protected]

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for Austria is:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: [email protected]
Web: dsb.gv.at

10. Supplement for Swiss Visitors

If you are located in Switzerland, the Swiss Federal Act on Data Protection (FADP / DSG) may also apply. You have the right to request information about your data, request corrections, and object to processing. The competent Swiss authority is:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
Web: edoeb.admin.ch

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. We recommend reviewing this page periodically.