Privacy Policy

Last updated: 31 July 2026

Protecting your personal data matters to us. This policy explains, in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), how we process your data when you visit our website contrixt.com or use the Contrixt service.

This is a translation. The German version prevails.

1. Controller

2. Processing activities in detail

a) Website access & server logs

When you access our website, technically necessary access data is processed (in particular IP address, timestamp, page requested, browser type and operating system). This data is required to deliver the website, ensure its stability and security and prevent misuse. The legal basis is our legitimate interest in a secure and functioning web offering (Art 6(1)(f) GDPR).

Hosting is provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres located in Germany.

b) Contact form & support tickets

When you write to us via the contact form or as a support request, we process the data you provide (in particular name, email address and your message) in order to handle and respond to your enquiry. The legal basis is the initiation or performance of a contract (Art 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art 6(1)(f) GDPR).

c) Registration & use of the application

To register for and use Contrixt, we process account, tenant and usage data (e.g. name, email address, login credentials, company, budget, contract and cost data as well as technical usage data). This processing serves to provide the service and is necessary for the performance of the contract (Art 6(1)(b) GDPR). Data is stored encrypted; tenant separation is additionally enforced at database level.

d) Payment processing

Paid subscriptions are processed via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Only the data required for payment is transmitted to Stripe; full credit card data does not reach our servers. Where applicable, data is transferred to Stripe Inc. in the USA; such transfer is based on the EU Standard Contractual Clauses. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

e) Service email notifications

As part of using the service, Contrixt sends functional notifications (e.g. about expiring deadlines, budget warning thresholds, pending requests as well as system and account information) to the email address you provide. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

f) Cookies & local storage

We use strictly necessary cookies and local storage entries only (e.g. for the login session and for language and design settings). No tracking via cookies takes place. For technically necessary storage, no consent is required pursuant to § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). You can find details in our Cookie Policy.

g) Web analytics (Matomo)

For anonymous reach measurement, we use the analytics software Matomo, which we operate exclusively on our own server located in Germany (Falkenstein). No cookies are set (cookieless tracking); visitors are not recognised across sessions. IP addresses are truncated (the last two bytes are anonymised) before storage, so that no conclusions can be drawn about individual persons. Your browser's Do-Not-Track setting is respected; if it is enabled, no data is collected.

We collect the pages visited, the referring page, a coarse browser and device type, and the anonymised IP address. The purpose of this processing is reach measurement and improving our offering. The legal basis is our legitimate interest in privacy-friendly, cookie-free statistics on the use of our website (Art 6(1)(f) GDPR).

The data collected remains exclusively on our server in Germany and is not disclosed to third parties. Raw data is retained only for a limited period and is then automatically deleted or aggregated.

h) Voting on roadmap entries

On our website you can vote for ("like") entries on our public product roadmap. To prevent multiple votes, we store your IP address solely as a cryptographic hash (a one-way procedure) that cannot be converted back into the original IP address. The IP address itself is not stored in plain text. There is no combination with other data, no recognition across sessions and no profiling; we store only the hash, the entry voted on and the timestamp. The legal basis is our legitimate interest in a tamper-resistant vote and in meaningful product planning (Art 6(1)(f) GDPR). In addition, your browser remembers votes you have already cast locally (local storage); this information does not leave your device.

3. Recipients & processors

To provide the service, we use carefully selected processors, each of which is bound by a contract pursuant to Art 28 GDPR:

• Hetzner Online GmbH (Germany) — hosting and operation of the infrastructure.
• Stripe Payments Europe Ltd. (Ireland) — payment processing.

We do not disclose your data to third parties beyond this unless we are legally obliged to do so.

Our customers can download a ready-filled data processing agreement pursuant to Art 28 GDPR at any time directly within the application (Administration → Settings).

4. Retention period

Contract and account data is stored for the duration of the contractual relationship. Invoicing and tax-relevant data is retained in accordance with statutory retention obligations (in particular § 132 BAO and § 212 UGB) for seven years. Server logs are stored only for a short period and then deleted.

After the contract ends, we keep your data for 90 days in a recovery window (in case you return); thereafter it is deleted completely and verifiably, unless statutory retention obligations require otherwise.

5. Your rights as a data subject

Under the GDPR you have the following rights: the right of access (Art 15), rectification (Art 16), erasure (Art 17), restriction of processing (Art 18), data portability (Art 20) and the right to object to processing based on a legitimate interest (Art 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future.

Full data exports are available to administrators at any time directly within the application. To exercise your rights, a message to contact@contrixt.com is sufficient.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

6. No automated decision-making

Automated decision-making, including profiling within the meaning of Art 22 GDPR, does not take place.

7. Data security

We take technical and organisational measures to protect your data. Transmission is TLS-encrypted throughout, storage is encrypted, and tenant separation is enforced at database level. On request, sensitive data can be encrypted with your own key (bring your own key).

8. Additional information for customers in the United States and Canada

The following additional information is provided for customers and users located in the United States and Canada, without prejudice to the GDPR-based information set out above, which continues to apply.

a) California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), grants you certain additional rights. We process the following categories of personal information: contact and account data (e.g. name, email address and company details) and usage data (e.g. log and usage data relating to the platform).

We do not sell or share personal information within the meaning of the CCPA/CPRA. California consumers have the right to know about and access the personal information we hold, the right to request deletion, the right to request correction of inaccurate information, and the right not to be discriminated against for exercising any of these rights. To exercise these rights, please contact us at contact@contrixt.com.

b) Canada (PIPEDA)

For users in Canada, our processing of personal information is carried out in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). The legal basis for processing is your consent or the performance of the contract between you and us. You have the right to access the personal information we hold about you. If you believe your rights under PIPEDA have not been respected, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC).

Regardless of your location, your data is processed exclusively in Germany and the European Union, as described above.