Privacy Policy
This policy explains how we handle personal data when you visit blockstruct.io and use our contact and chat features. It covers this marketing website. Our product applications on separate subdomains and our client project work are governed separately, as noted below.
Controller
The controller responsible for processing personal data on this website is:
Blockstruct GmbH, Zwölfergasse 10/8/3, 1150 Wien, Österreich · srdjan@blockstruct.io
Our two roles
For personal data collected through this website, Blockstruct GmbH acts as controller. When we deliver software and AI projects for clients, we typically act as a processor on the client's instructions under a separate data-processing agreement; that project data is not governed by this website policy.
What we collect
- Contact and enquiry forms: your name, email address and any details you submit, so we can respond and manage the enquiry.
- Live chat: the messages you send and the technical data needed to run the chat session.
- Server and security logs: IP address, request time, browser identifier and similar data, kept briefly to operate and secure the site.
- Spam protection: data processed by our anti-abuse challenge when you submit a form.
- Website analytics, only if you allow analytics cookies: the pages you open and a shortened IP address, described in detail below.
Why we may process it (legal bases)
- Consent (Art. 6(1)(a) GDPR): optional marketing communication and non-essential cookies.
- Contract or pre-contractual steps (Art. 6(1)(b) GDPR): answering enquiries and preparing an engagement.
- Legitimate interests (Art. 6(1)(f) GDPR): operating, securing and improving the site, and preventing abuse.
Services and processors we use
We use the following services for this website. External providers act on our instructions under a data-processing agreement. The self-hosted entries run on our own server, so no data reaches a third party.
| Service | Purpose | Location / hosting |
|---|---|---|
| IONOS | Server hosting (VPS) for the website and our self-hosted services | EU (Germany/Austria) |
| Odoo (self-hosted) | CRM and live chat, running on our own server | EU (our VPS) |
| n8n (self-hosted) | Workflow automation that delivers enquiries to our CRM | EU (our VPS) |
| Matomo (self-hosted) | Website analytics on our own server, with no transfer to a third party | EU (our VPS) |
| Sweego | Sending transactional email (confirmations and notifications) | EU (France) |
| Cloudflare | Anti-spam challenge (Turnstile) on public forms | EU / global (standard contractual clauses where applicable) |
Our product applications, such as parking.blockstruct.io, run on separate infrastructure (Scalingo for hosting and Supabase for the database, both with EU servers) and have their own privacy terms. Payment processing for purchases, for example masterclass tickets or product subscriptions, is handled by Revolut and will be described when checkout goes live.
Website analytics (Matomo)
We measure how this website is used with Matomo, open-source analytics software that runs on our own server in the EU. Matomo loads only after you allow analytics cookies. Before that, nothing is transmitted and no request is made to any external analytics service.
- The pages you open, when you open them, and the page you came from.
- Your approximate location, derived from a shortened IP address.
- Your browser, operating system, device type and screen size.
- Actions we count as goals: submitting an enquiry form, opening the booking dialog, following an outbound link and downloading a file.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, with effect for the future.
Matomo runs on our own server. There is no analytics provider, no processor and no transfer of this data to a third party or outside the EU.
IP addresses are shortened by two bytes before they are stored, and the approximate location is derived from the already shortened address. We assign no user ID and do not combine this data with your enquiry or chat records. Matomo honours the Do Not Track setting in your browser.
Raw analytics records are deleted after 6 months. Beyond that, only aggregate reports remain, which contain no individual records. The analytics cookies expire after 6 months (_pk_id) and after 30 minutes (_pk_ses).
To switch analytics off again, open the cookie preferences:
Transfers outside the EU
We keep processing in the EU wherever we can. Where a processor may transfer data outside the EU, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.
How long we keep data
We keep personal data only as long as needed for the purpose it was collected for or as required by law. Enquiry and CRM records are kept for the duration of the business relationship and applicable retention periods; server logs are kept only briefly.
Your rights
- Access to the data we hold about you.
- Rectification of inaccurate data.
- Erasure, where the legal conditions are met.
- Restriction of processing.
- Data portability.
- Objection to processing based on legitimate interests.
- Withdrawal of consent at any time, without affecting past processing.
To exercise any of these rights, contact us at the address above.
Right to complain
If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority. The competent authority is the Österreichische Datenschutzbehörde.
Cookies
We use only necessary cookies by default. Details and your choices are on the Cookies.
Changes to this policy
We may update this policy as our services or legal requirements change. The current version applies from the date shown above.
The German-language version of this document is legally binding. Translations are provided for convenience only.