Privacy Policy

1. Controller

No data protection officer is required under Art. 37 GDPR and none has been appointed.

2. Principles

• No cookies are set, so no cookie banner is required.
• No advertising or social media plugins, and no cross-site tracking.
• Reach is measured with self-hosted software that stores neither cookies nor IP addresses (section 5).
• Typefaces are served from our own server. No connection is made to Google or any other font service.
• No automated decision-making and no profiling.
• Data is never passed on for advertising purposes.

3. Hosting and server log files

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The servers are located in Frankfurt am Main, Germany. Hostinger processes the data arising from your visit solely on our behalf, under a data processing agreement pursuant to Art. 28 GDPR that forms part of its terms of service. Hosting involves no transfer of personal data to a third country.

Each request is recorded in log files: truncated IP address (the final block is removed before the entry is written, so no full address is stored), date and time, name and URL of the requested file, volume transferred, access status, browser, operating system and where applicable the referring page.

Legal basis: Art. 6(1)(f) GDPR: legitimate interest in faultless operation and defence against attacks. This data is not merged with other sources.

Retention: deleted after 30 days at the latest, unless needed longer to preserve evidence of a security incident.

4. Contact form

The contact form lets you send an enquiry. Name and email address are transmitted, and optionally company, revenue range, type of enquiry and your message.

Purpose and legal basis: handling your enquiry and exploring possible cooperation, under Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR. Providing the data is voluntary; without a name and email address we cannot reply.

Processing: the form is delivered and processed on the same server as this website. No external form service is involved, and the form itself transmits no data to a third country. Your enquiry is stored on that server and forwarded to our business email address, which is operated through Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on the basis of a data processing agreement under Art. 28 GDPR; Google may process data in third countries, and the EU standard contractual clauses apply to such transfers.

Retention: deleted once the matter is concluded, unless statutory retention applies. Where a business relationship arises, the seven-year period under §132 of the Austrian Federal Fiscal Code applies.

5. Reach measurement

To learn how often pages are opened and which sources visitors arrive from, this website uses GoatCounter, open-source analytics software running on the same server as the website. No third-party provider is involved and no data leaves that server.

Recorded for each page view: the page opened, the referring page, the browser and operating system in general terms, the approximate screen size, and the country derived from the IP address. The IP address itself is not stored. To recognise repeat views within a single day, a non-reversible hash is formed from the IP address, the browser identifier and a value that changes daily. It is discarded at the end of the day and allows no conclusion about you.

No cookies are set and nothing is stored on your device, so the measurement works without consent and this website needs no cookie banner.

Legal basis: Art. 6(1)(f) GDPR: legitimate interest in understanding which content is used and in operating the website economically. Because no personal identifiers are stored, the interference with your rights is minimal.

Retention: the aggregated counts are kept indefinitely and contain no personal data. The daily hash is deleted after 24 hours.

6. External links

This website links to external services, in particular adastrasolutions.at and LinkedIn. These are plain text links. No content is loaded automatically and no data transmitted unless you click.

7. Screenshots

All screenshots on this website show anonymised sample data from a fictional company. No real client data is displayed.

8. Your rights

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal message to office@cfofoundry.io is sufficient.

9. Right to lodge a complaint

10. Changes

This policy will be updated whenever data processing changes, for instance through new features or a change of hosting or form provider. The version published here applies.

Last updated: September 2026