Privacy Policy

01 Data Controller

The controller responsible for the data processing within the meaning of Art. 4 No. 7 GDPR is:

02 Sign-up & Issuance of the API Key

When you sign up for access, we process the following data:

• E-mail address – for verification (double opt-in) and for issuing the API key.
• Time of sign-up and of confirmation as well as the confirmation IP address – as evidence of consent.
• Generated API key – for authenticating requests to the MCP server.

Purpose: provision of the service, verification of the e-mail address and prevention of misuse.

Legal basis: performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR) as well as consent within the framework of the double opt-in (Art. 6 (1) (a) GDPR). Consent can be withdrawn at any time with effect for the future.

Usage data per API key: To provide the service, to enforce fair-use limits (rate limit) and to prevent misuse, we log per API key which tools are queried how often and when (aggregated counters per day). The key is stored only as a hash value; the usage log contains neither the content of the queries nor the e-mail address. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR) and our legitimate interest in stable, misuse-free operation (Art. 6 (1) (f) GDPR). Retention period: a maximum of 12 months, then automatic deletion.

Technical measurements per call: To detect faults and gaps in the service — such as queries that return no result — we record technical measurements for each tool call: the tool called, the processing time, the database load caused, the number of results (or whether there were none), the page number, the plan (e.g. Free or Pro) and the names of the filters set (such as “bundesland” or “branche”). The contents of the filters are not recorded — no search terms, no company names, no prompts. A technical session identifier is added that groups the calls of one connection; no link to an account, API key or e-mail address is stored. Processing takes place in Azure Application Insights (Germany West Central region, EU). Legal basis: our legitimate interest in a functioning, low-fault service (Art. 6 (1) (f) GDPR). Retention period: 90 days, then automatic deletion.

03 Firmenbuch Data & Personal Data of Officers

On an individual query, the service delivers data from the Austrian Firmenbuch (High Value Dataset of the BMJ/JustizOnline, CC BY 4.0). This also includes personal data of officers (e.g. managing directors, board members, authorised signatories): name, function and type of representation as well as the year of birth or the age calculated from it.

Data minimisation: Of birth dates, exclusively the year is processed and delivered, never the day or month.

Purpose: provision of business information on Austrian companies (e.g. for creditworthiness, succession or business-partner checks) by way of individual query. Legal basis: legitimate interest in providing publicly accessible register information (Art. 6 (1) (f) GDPR). The data is in any case accessible in the public Firmenbuch on a statutory basis (Firmenbuch Act).

No mass processing: Systematic mass extraction, profiling as well as the disclosure or resale of the personal data are technically limited and prohibited under the Terms of Service.

Your rights: Affected persons can assert their rights towards the controller (see the section Your Rights). The service reflects the official register status; changes to an entry are to be initiated primarily at the Firmenbuch court.

04 Cloudflare Turnstile

To protect the sign-up form against automated requests (spam/bots), we use Cloudflare Turnstile, a service of Cloudflare, Inc. Turnstile checks whether the input comes from a human without classic captcha puzzles; in doing so, technical information (e.g. IP address, browser characteristics) is processed. Cloudflare states that it does not set any tracking cookies for advertising purposes for this.

Legal basis: legitimate interest in secure, misuse-free operation (Art. 6 (1) (f) GDPR). Insofar as data is transferred to third countries, this is based on Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework. Details: Cloudflare Privacy Policy.

05 Server Logs & Hosting

The website is hosted with Microsoft Azure (Static Web Apps / Functions, Germany West Central region, EU). When the site is accessed, technically necessary data is automatically processed in server log files: IP address (shortened where possible), date and time, requested resource, referrer, browser and operating-system identifier.

Purpose: delivery of the website, stability and security. Legal basis: legitimate interest (Art. 6 (1) (f) GDPR). A data-processing agreement in accordance with Art. 28 GDPR is in place with the host.

06 Fonts

This website loads fonts via the Google Fonts CDN (Google Ireland Ltd.). In doing so, the visitor's IP address is transmitted to Google. Legal basis: legitimate interest in a consistent, performant presentation (Art. 6 (1) (f) GDPR).

07 Cookies

We use no tracking or marketing cookies and no web-analytics tool. Only – if the browser permits it – a technically necessary piece of information is stored in local storage (localStorage) so that the one-time cookie notice is not shown again. This information remains on the respective device and is not transmitted to us.

08 Recipients, Processors & Payment Processing

Data is only disclosed to service providers who support us in providing the service, to the extent necessary and on the basis of data-processing agreements:

• Hosting / infrastructure provider: Microsoft Ireland Operations Ltd. (Azure, EU region)
• E-mail dispatch (confirmation / transactional e-mails): Microsoft (Azure Communication Services)
• Bot protection: Cloudflare, Inc. (Turnstile)
• Payment processing (only for the paid Pro subscription): Stripe Payments Europe, Ltd.

Payment processing via Stripe: For the paid Pro subscription, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., Ireland). When a subscription is concluded or managed, the data required for this – in particular e-mail address, payment-method and invoicing data as well as a customer identifier (Stripe customer ID) – is processed by Stripe. Full payment data (e.g. card numbers) is processed exclusively by Stripe and is not stored with us; we essentially receive from Stripe the payment or subscription status and the customer identifier in order to assign the plan to the account. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR) as well as compliance with legal – in particular tax-related – obligations (Art. 6 (1) (c) GDPR). Insofar as a transfer to third countries takes place, this is based on Standard Contractual Clauses (SCC). Details: Stripe Privacy Policy.

The Firmenbuch data retrieved via the MCP server is not transferred to third parties for advertising purposes.

09 Retention Period

We store personal data only for as long as is necessary for the stated purposes or for as long as statutory retention obligations exist. Sign-up and API-key data is deleted as soon as the account or the key is revoked or requested for deletion, at the latest after 12 months of inactivity. Technical measurements per call (see section 02) are deleted automatically after 90 days.

10 Your Rights

Under the GDPR, you have the following rights:

• access (Art. 15), rectification (Art. 16) and erasure (Art. 17)
• restriction of processing (Art. 18) and data portability (Art. 20)
• objection to processing based on legitimate interests (Art. 21)
• withdrawal of consent given, with effect for the future (Art. 7 (3))

To exercise them, a message to office@jngb.online is sufficient. In addition, you have the right to lodge a complaint with the supervisory authority – in Austria the Austrian Data Protection Authority (www.dsb.gv.at).

11 Changes to this Notice

We adapt this Privacy Policy if the service or the legal situation changes. The version published on this page applies in each case.