Privacy policy

Controller

The controller for this website within the meaning of the General Data Protection Regulation (GDPR) is:

Name

Sebastian Kirsch

Address

Sarstein 24, 4822 Bad Goisern, Austria

Email

sebastian.kirsch@meritong.com

Website

https://meritong.com

Collection and processing of personal data

This website collects and processes personal data only to the extent required to operate the website and provide the services offered.

a)Server log files

When you access this website, the hosting provider automatically stores information in so-called server log files. These are:

• IP address of the requesting device
• date and time of access
• name and URL of the file retrieved
• browser and operating system used
• referrer URL
• volume of data transferred and HTTP status code

This data is not merged with other data sources and serves solely the secure and stable operation of the website.

Processor

Amazon Web Services EMEA SARL as processor, see point 3 g)

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website)

Storage period

The data is deleted after 30 days at the latest.

b)Contact by email

If you contact us by email, the data you provide — email address, name and the content of your message — is stored for the purpose of handling your enquiry and in case of follow-up questions. We do not pass this data on without your consent.

Legal basis

Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest)

Storage period

The data is deleted as soon as the enquiry has been conclusively handled and no statutory retention obligation applies.

Browser storage, embedded services and analytics tools

a)Technically necessary storage in the browser

This website stores your consent status locally in your browser (localStorage). This data does not leave your device and is not transmitted to third parties.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in the technical operation of the website). No separate consent is required for technically necessary storage (§ 165(3) TKG 2021, Austrian Telecommunications Act).

If you switch the language using the language switcher, we store your choice in a cookie called “lang” (content: only “de” or “en”, lifetime 12 months), so that the next time you visit meritong.com you land directly in your language. The cookie is only set when you click the language switcher, not merely by visiting the site. It is not passed on to third parties and is not used for tracking.

Legal basis

§ 165(3) TKG 2021 (strictly necessary for us to provide the service you requested, displaying the website in your language) and Art. 6(1)(f) GDPR.

b)Visitor analysis with Leadfeeder

This website uses the technologies of Leadfeeder (Leadfeeder Finland Oy as part of Leadfeeder Group GmbH) to analyse visitor behaviour. In this process, the IP address of a visitor is processed to help us understand which businesses (B2B) are visiting our site, by enriching IPs with associated information such as company name or industry code.

At the beginning of each session, the visitor's IP address and session data are matched against a large whitelist of known companies. First-party cookies are used as part of this analysis. The service is only loaded once you have consented in the cookie banner.

Provider

Leadfeeder Finland Oy as part of Leadfeeder Group GmbH

Legal basis

Your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021 (cookie banner). You can withdraw consent at any time with effect for the future, via “Cookie settings” in the footer. In addition, you may install an appropriate ad-blocker or no-script plugin in your browser.

Data processing agreement

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Leadfeeder.

Storage period

Data is deleted as soon as it is no longer required for its intended purpose.

Further information

www.leadfeeder.com/privacy

c)Web analytics with Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited. Google Analytics uses cookies and similar technologies to collect and analyse information about how this website is used. The data collected (for example page views, session duration, approximate location, device and browser type) is transmitted to and stored on Google's servers. In addition, individual events are recorded: clicks on appointment-booking links, newsletter sign-ups, submitted contact enquiries and confirmed booking requests.

IP anonymisation is enabled by default in GA4: IP addresses are truncated before storage, making direct identification of individuals impossible. Google may transfer this information to third parties where required by law or where such third parties process the data on Google's behalf. The service is only loaded once you have consented in the cookie banner.

Provider

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Legal basis

Your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021 (cookie banner). You can withdraw consent at any time with effect for the future, via “Cookie settings” in the footer.

Third-country transfer

Data transfers to the United States are based on the EU–US Data Privacy Framework.

Data processing agreement

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google.

Objection

You can opt out of Google Analytics tracking by installing the browser add-on available at tools.google.com/dlpage/gaoptout. Alternatively, you can disable cookies in your browser settings or use an appropriate ad-blocker.

Further information

policies.google.com/privacy

d)Appointment booking (Cal.com)

We use the scheduling service Cal.com in its EU-hosted variant (cal.eu) to arrange calls. When you request an appointment via a booking link on our website, you leave our website; processing takes place on Cal.com's pages.

Data processed: name, email address, your answers to the booking questions (company and website, role, product description, reason for the request), the selected time slot, and technical access data (including IP address) generated when the booking page is loaded. The purpose is handling your booking request, assessing whether we can help, and preparing the call.

Provider

Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA

Hosting

EU-hosted variant (cal.eu). According to the provider, EU-instance data is processed on servers within the EU.

Legal basis

Art. 6(1)(b) GDPR (pre-contractual steps taken at your request) and Art. 6(1)(f) GDPR (legitimate interest in screening incoming booking requests)

Data processing agreement

A data processing agreement under Art. 28 GDPR is in place with Cal.com.

Third-country transfer

Cal.com, Inc. states that it is certified under the EU–US Data Privacy Framework; to the extent data is accessed from the USA, the transfer relies on this basis.

Storage period

We delete booking data once it is no longer required for these purposes and no statutory retention obligations apply. Providing the data is necessary for booking; without it, no appointment can be arranged.

Further information

cal.com/privacy

e)Contact form

When you use our contact form, we process the data you provide (name, email address, the topic you select if any, and your message), together with the page from which you submitted the form and the time of submission, to handle your enquiry and for possible follow-up questions. Transmission runs through a function (AWS Lambda) in our hosting at Amazon Web Services, see point 3 g); from there, the message is delivered to our mailbox as a transactional email via Brevo.

Provider

Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (hosting and processing in the form); Brevo (formerly Sendinblue) SAS, 17 rue Salneuve, 75017 Paris, France (delivery of the email)

Legal basis

Art. 6(1)(b) GDPR (pre-contractual steps taken at your request) and Art. 6(1)(f) GDPR (legitimate interest in handling enquiries addressed to us)

Data processing agreement

Data processing agreements pursuant to Art. 28 GDPR are in place with both providers. According to Brevo, processing takes place on servers within the EU.

Storage period

We delete contact-enquiry data once it is no longer required for handling the enquiry and no statutory retention obligations apply. Providing your name, email address and message is necessary for processing your enquiry.

f)Email updates (newsletter)

When you sign up for our email updates, we process your email address in order to occasionally send you content on dependency patterns from hardware audits (currently in English). Sign-up uses a double opt-in procedure: after you enter your address you receive an email in which you confirm the subscription. To document consent we log the confirmation with time and IP address.

You can withdraw your consent at any time: via the unsubscribe link in every email or by simply writing to sebastian.kirsch@meritong.com; your data is then removed from the list.

Provider

Brevo (formerly Sendinblue) SAS, 17 rue Salneuve, 75017 Paris, France. The emails are sent from news@meritong.com.

Legal basis

Your consent pursuant to Art. 6(1)(a) GDPR

Data processing agreement

Data processing agreement pursuant to Art. 28 GDPR. According to the provider, processing takes place on servers within the EU.

Storage period

Your data remains stored until you unsubscribe; the documentation of your consent is retained beyond that as proof.

Further information

brevo.com/legal/privacypolicy

g)Hosting and delivery

This website is operated at Amazon Web Services (AWS): the content is stored in Amazon S3 and delivered via the Amazon CloudFront content-delivery network; the contact form is processed by AWS Lambda. In the course of this, the server log data described under point 2 a) is generated.

Provider

Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg

Role

Processor. A data processing agreement pursuant to Art. 28 GDPR is in place with AWS.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in the secure and performant operation of the website)

Third-country transfer

To the extent that data is transferred to the United States, the transfer relies on the EU–US Data Privacy Framework.

h)Fonts

The fonts used on this website are delivered from our own server. No request is made to Google Fonts or any other external font service. Your IP address is therefore not transmitted to any third party for this purpose.

i)Audience measurement with Pirsch Analytics

We use Pirsch Analytics to analyse visits statistically. Pirsch works without cookies and stores nothing on your device. Your IP address is not stored: Pirsch derives an anonymous value from it and other technical data (such as browser and screen size), which changes daily and does not allow any conclusions about you. No consent banner is required for this.

Provider

Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany

Server location

Germany

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in analysing and improving the website)

Storage period

Only anonymous, aggregated values without personal reference are stored.

Objection

You may object to the processing at any time (Art. 21 GDPR) by sending an informal message to sebastian.kirsch@meritong.com.

Further information

pirsch.io/privacy

j)Spam protection in the contact form (Cloudflare Turnstile)

To protect the contact form against automated requests (spam, bots), we use Cloudflare Turnstile. As soon as you interact with the contact form (for example by clicking a field), your browser loads a script from Cloudflare; no connection to Cloudflare is made before that. Technical characteristics of your browser and device as well as your IP address are transmitted to Cloudflare to check whether the request comes from a human. When you submit the form, a token is sent along, which our server verifies with Cloudflare. Turnstile does not set cookies for advertising or analytics purposes.

Provider

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in protecting the form against misuse)

Transfer to third countries

Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

Disclosure of personal data to third parties

Your personal data is generally not disclosed to third parties, unless:

• you have expressly given your consent (Art. 6(1)(a) GDPR),
• the disclosure is necessary for the performance of a contract (Art. 6(1)(b) GDPR),
• there is a legal obligation (Art. 6(1)(c) GDPR), or
• there is a legitimate interest and no overriding interests of yours warranting protection prevail (Art. 6(1)(f) GDPR).

The providers named under point 3 act as processors on the basis of corresponding contracts pursuant to Art. 28 GDPR.

Your rights as a data subject

Under the GDPR you have the following rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object (Art. 21 GDPR)
• right to withdraw consent once given, with effect for the future

An informal message to sebastian.kirsch@meritong.com is enough to exercise these rights.

Irrespective of this, you have the right to lodge a complaint with the supervisory authority:

Supervisory authority

Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Wien, www.dsb.gv.at

Data security

This website uses SSL/TLS encryption for the transmission of data between your browser and our server. You can recognise an encrypted connection by the browser address bar starting with https://.

Beyond this, we take appropriate technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction or access by unauthorised persons.

Validity and amendment of this privacy policy

This privacy policy is currently valid and dates from October 2026. As our website develops further, or because of changed statutory or official requirements, it may become necessary to amend this privacy policy. The privacy policy in force at any given time can be accessed on this page at any time.