Privacy

Hosting and delivery through Netlify

The website is delivered through Netlify (Netlify, Inc.). On access, the hosting provider processes technically necessary data such as IP address, timestamp, requested URL, referrer, browser and device information, log data plus security and CDN data.

Purposes include delivery, stability, security, abuse detection, error analysis and technical maintenance. The legal basis is our legitimate interest in secure, stable delivery (Art. 6(1)(f) GDPR).

Contact inquiries: transfer and storage

If you contact us by email or through the inquiry flow, we process data you submit, such as name, company, email address, phone number, website, selected topic, project details and message content. Name, email address and confirmation that you have read the privacy notice are always required. Depending on the selected check, the website, service and target market, current inquiry paths or a concrete starting question are also required; company and phone number remain optional.

If you previously consented to Statistics or Marketing, the inquiry also includes the first landing page, a referrer limited to origin and path, and any available UTM parameters. Advertising click IDs are added only with Marketing consent. This is used to identify which content or campaign led to the inquiry. Without the relevant consent, these attribution fields are neither stored nor submitted.

The inquiry is processed via Netlify Forms (provider Netlify, Inc.): the data you enter is transmitted to Netlify and stored there. Server-side email processing checks required fields, the consent field, email format and field lengths again.

In addition, we automatically send a confirmation to you and an internal notification to us. For sending these emails we use the service Brevo (Sendinblue SAS, Paris, France) as a processor under Art. 28 GDPR. The form details required for confirmation and internal handling are transmitted to Brevo and, according to the provider, processed within the EU. We do not use our own CRM or any further marketing services.

Processing serves inquiry handling, offers, contract preparation and follow-up (Art. 6(1)(b) and (f) GDPR). Inquiries without an engagement are reviewed regularly and deleted once no longer required for those purposes; the operational standard is no later than 90 days unless statutory duties or the defence of legal claims require longer retention.

AI Academy waitlist

On the Academy page you can join a waitlist with your email address to be notified at launch. Processing takes place via Netlify Forms (Netlify, Inc.) based on your consent (Art. 6(1)(a) GDPR). We use the address solely for the launch notification and delete it after launch or on withdrawal; you can withdraw at any time by emailing us.

As with contact inquiries, the confirmation of your sign-up is sent via the processor Brevo (Sendinblue SAS, Paris, France); your email address is transmitted to Brevo and, according to the provider, processed within the EU.

Security and spam prevention

The inquiry flow and Academy waitlist use Netlify Forms with a hidden honeypot field. As part of hosting, security and spam prevention, Netlify may process technical connection data such as the IP address. Nenaj currently applies no separate IP-based rate limit to these forms. The legal basis for the protective measures is our legitimate interest in secure, abuse-free operation (Art. 6(1)(f) GDPR).

Error monitoring (self-hosted)

For technical stability we may capture application errors via a self-hosted, Sentry-compatible monitoring on our own infrastructure within the EU. We process technical error data such as the error message, stack trace, affected page or route, browser and device information and the timestamp.

We deliberately do not send directly identifying content. The legal basis is our legitimate interest in stable, secure operation (Art. 6(1)(f) GDPR). The data does not leave the EU and is used only internally for debugging.

Google Analytics 4 and Google Tag Manager

We use Google Analytics 4, depending on configuration either directly or via Google Tag Manager (provider in each case Google Ireland Limited), for pseudonymous reach and usage analysis. These services load only after your “Statistics” consent; without consent no Google script runs.

We use Google Consent Mode v2: before consent, analytics_storage, ad_storage, ad_user_data and ad_personalization are set to “denied”. After consent, page views, interactions, device and browser data, a truncated IP address, approximate location, referrer, campaign parameters and pseudonymous identifiers may be processed. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021); you can withdraw it at any time via the cookie settings.

Recipients and international transfers

The recipient is the hosting provider Netlify (Netlify, Inc.), which delivers the website and processes the contact inquiries via Netlify Forms, and, for sending the confirmation and notification emails, the service Brevo (Sendinblue SAS, Paris, France). After your consent, Google (Google Ireland Limited, possibly Google LLC) for analytics and tag manager is added as a recipient.

Brevo is based in the EU and, according to the provider, processes the data within the EU; there is no transfer to a third country in this respect. Netlify and Google may process data outside the EEA (in particular the USA). The transfer relies on appropriate safeguards under Art. 44 et seq. GDPR, in particular the EU-US Data Privacy Framework (where the provider is certified) or EU Standard Contractual Clauses. You can obtain a copy or the location of these safeguards on request by emailing the controller. Full protection equivalent to the EU level cannot always be guaranteed with US services.

Retention

Contact inquiries without an engagement are reviewed regularly and generally deleted within 90 days once no further handling, statutory duty or defence of legal claims requires retention. Contract and invoice records: seven years under statutory tax retention duties (§ 132 BAO). Server and security logs: short-term.

Academy waitlist entries are deleted after the launch notification or upon withdrawal. Your cookie choice remains in the browser until you change it or a new consent version is introduced.

Your rights

Data subjects have GDPR rights to access, rectification, erasure, restriction, portability, objection and withdrawal of consent with future effect. The lawfulness of processing carried out before withdrawal remains unaffected.

You may also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.