Privacy policy

1. Controller and contact

EachVisit is a product of Codivities GmbH. The controller for the processing described here is Codivities GmbH, Hamburgerstraße 10/2/9, 1050 Vienna, Austria, FN 684150d, Handelsgericht Wien. Contact: [email protected].

Send privacy enquiries to the same email or postal address. Please indicate whether your request concerns a website visit, beta enquiry, business account or booking with a business, so that we can direct it correctly.

2. Scope of this notice

This notice covers the public marketing website at eachvisit.com and our handling of contact and beta enquiries. Visiting the website does not create an EachVisit account. Sending an email enquiry is neither registration nor an order.

Business accounts, signed-in product use and guest bookings involve additional processing. Section 12 explains the allocation of responsibilities. This website notice does not replace the booked business’s privacy information or an agreement covering the processing of its guest data.

3. Data processed when you visit

To retrieve a page, your browser transmits your IP address, request time, requested address, technical browser and connection details and, where applicable, the referring page. HTTP status and technical errors may also arise when serving content. The browser’s Accept-Language header can be used to choose a language; the language is then part of the address, such as /de or /en.

We use this information to serve pages, diagnose faults and protect against abuse or attacks. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, available and functioning website. Technical connection data is required to deliver the requested pages.

4. Hosting and protection of traffic

We use infrastructure provided by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. We operate the website on this infrastructure using our own operational software. Hetzner has access capabilities to the data processed there as part of its hosting service and acts as our processor.

We use Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, to deliver and protect traffic. Requests passing through Cloudflare involve IP addresses, requested addresses and technical connection and security information. Our use serves protection against attacks and reliable delivery; its legal basis is Article 6(1)(f) GDPR.

Cloudflare operates a global network. The location of our server alone therefore does not rule out processing outside the European Economic Area. Processing on our behalf is covered by Cloudflare’s data processing addendum; Cloudflare also processes certain operational and security data as a controller under its own privacy policy. See section 8 for international transfers.

5. Cookies, browser storage and embedded content

The marketing application sets no cookies of its own and stores no visitor identifiers in Local Storage or Session Storage. Language selection is represented by the page address. This statement concerns the marketing website, rather than signing in to the EachVisit application or visiting another website that embeds a booking widget.

Schibsted Grotesk and JetBrains Mono fonts are served with the website. We embed no Google Fonts requests, analytics scripts, advertising pixels, external maps or video players. Hosting and network protection remain separate technical recipients.

Storage of or access to information on your device is also assessed under section 165(3) of Austria’s Telecommunications Act 2021. Consent is not required for transmission alone or for a service you expressly request where that access is strictly necessary. Non-essential analytics or advertising technologies would require a separate assessment and, where required, your prior consent.

6. Contact and closed-beta requests

When you write to us, we process your email address, name, business details, message and attachments. We use them to respond, discuss your intended use of EachVisit and prepare possible beta participation. We need a reachable contact address to reply; other information is optional unless needed to resolve your particular enquiry.

The request-beta-access button opens your email application with a suggested message. Clicking alone sends no enquiry to us. You can edit the text and choose which information to send. Please do not include guest lists, health information, passwords or payment data in an initial enquiry.

For an individual preparing their own contract, the legal basis is Article 6(1)(b) GDPR. For a company’s contact person or other enquiries, we rely on Article 6(1)(f): our interest in responding to business enquiries and organising the beta.

We review participation manually and retain the selected email address to approve access. Approval permits registration with that address; it does not replace mailbox verification or constitute consent to advertising. Removing an address from the approval list does not delete an existing account.

7. Email service and other recipients

Our business email is processed through Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, together with Google affiliates and subprocessors. Sender and recipient addresses, messages, attachments and technical delivery information are processed. Google Workspace acts as our processor for the commissioned email service.

Messages to [email protected] are forwarded through Cloudflare Email Routing to our business mailbox at Google Workspace. Cloudflare processes sender and recipient addresses, message content and technical delivery information for forwarding. Delivery also involves your chosen email provider and its delivery routes.

Internally, access is limited to people handling your enquiry or operating the systems. Legal advisers, courts and authorities may receive data where necessary and lawful to meet a legal obligation or establish, exercise or defend specific legal claims. We do not publish your beta request.

8. Processing outside the EEA

Cloudflare and Google may involve processing in the USA and other countries outside the EEA through global infrastructure, affiliates and support services. We therefore make no blanket promise that all website and email processing takes place exclusively in the EU.

Cloudflare’s and Google’s data processing terms provide EU Standard Contractual Clauses for covered transfers. These impose contractual safeguards on the recipient. You can request information about the safeguards applicable to the particular service and how to access them at [email protected]. Reliance on the EU-US Data Privacy Framework requires current certification of the specific recipient.

Provider information is available at cloudflare.com/cloudflare-customer-dpa, cloudflare.com/privacypolicy and cloud.google.com/terms/data-processing-addendum. Processing by your own email provider follows its terms and your choice of service.

9. Retention by data category

Technical request data is initially processed for transmission. We do not keep regular access logs of individual page requests for the marketing website. Infrastructure operation and error messages are rotated by size; the server retains at most three log files of 10 MB each per container. Retention therefore depends on log volume. Data separately retained to investigate a specific security incident is limited to that incident and deleted once it is resolved, unless needed for related legal claims. Cloudflare’s own security data is covered by its separate information.

We handle an open enquiry until it is resolved. Where no business relationship or agreed further contact results, we delete the enquiry file within six months of the correspondence ending. We also remove an unused beta approval within six months of the associated enquiry ending. This concerns our enquiry administration; existing product accounts form a separate data set.

If an enquiry leads to a contract, only the necessary data is transferred into contract administration. Accounting and other records subject to statutory retention under section 132 BAO or section 212 UGB are generally kept for seven years from the relevant statutory starting point, and longer where legally required. This does not require retaining every website enquiry for seven years.

Documents needed for a specific dispute are retained until the proceedings end or the applicable legal period expires. Access and use remain restricted to that purpose. Backups are separate from active data and are overwritten according to their backup cycle; legal holds and provider deletion procedures can affect the final removal of individual copies.

10. A beta request does not subscribe you to advertising

A beta request and our reply do not subscribe you to a newsletter. We do not automatically add enquiries to an advertising list or publish messages as customer testimonials. Separate advertising communications require their own applicable privacy and telecommunications-law basis.

We create no analytics or advertising profiles on this website and make no solely automated decision about beta admission with legal or similarly significant effects under Article 22 GDPR. A person decides on approval; checking the approved-email list later is a technical access control.

11. Security

We use HTTPS/TLS to transmit website and application data. Permissions and technical access controls restrict access to operational and account data. These measures aim to prevent unauthorised access and manipulation; they are not a guarantee of absolute security.

Ordinary email is not necessarily end-to-end encrypted throughout delivery. Please agree on a suitable transfer method with us before sending particularly confidential documents.

12. Business accounts and bookings with a business

Codivities GmbH acts as controller when administering its own contractual and business relationships, including relationships with software customers and their contacts. For guest and booking data processed according to a business’s instructions, that business generally acts as controller and Codivities as processor. The particular operation determines the allocation; an optional guest account also requires its own assessment.

Processing on behalf of a business requires an Article 28 GDPR agreement, defined technical and organisational measures and the actual subprocessors. Publishing this notice does not itself conclude a data processing agreement.

For information about a business’s use or retention of your booking data, contact the business identified in the booking offer. It determines booking purposes, cancellation requirements and retention instructions. We assist it in responding to your request where we process data on its behalf.

Visiting this marketing website sends no booking data to Stripe and no text to an AI model provider. Payments, optional AI-assisted setup and signed-in product use require information matched to the service actually activated.

13. Access, correction and erasure

Under Article 15 GDPR you can ask whether and which personal data we process about you and receive a copy and information about purposes, recipients, sources and retention. Article 16 allows you to correct inaccurate information and complete incomplete information.

Under Article 17 you can request erasure where there is no lawful reason for continued storage. Under Article 18 you can request restriction in the circumstances provided by law, including while accuracy is being checked. Required notifications to recipients about correction, erasure or restriction follow Article 19 GDPR.

Under Article 20 you may receive data you provided and which is processed automatically on the basis of consent or contract in a structured, commonly used, machine-readable format, or request its transmission, where the statutory conditions apply.

14. Objection and withdrawal

Where processing relies on Article 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We then stop unless we demonstrate compelling legitimate grounds overriding your interests or require the data for legal claims.

You can object to processing for direct marketing at any time without giving reasons. Where a particular activity relies on consent, you may withdraw it at any time for the future without affecting the lawfulness of earlier processing. An ordinary contact or beta request does not require blanket privacy or advertising consent.

15. Exercising your rights

Write to [email protected] or the postal address above. We respond without undue delay and normally within one month. Where necessary because of complexity or the number of requests, the period may be extended by up to two further months; we explain this and the reasons within the first month.

If there are reasonable doubts about identity, we may request additional information needed to identify the data correctly. Please do not send an unsolicited copy of your identity document. Requests are generally free of charge, subject to the statutory exceptions for manifestly unfounded or excessive requests.

16. Complaints

You may complain to a data protection supervisory authority, particularly in the country of your habitual residence, workplace or alleged infringement. In Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, email: [email protected], website: dsb.gv.at.

You do not need to contact us before making a complaint. You can nevertheless report a privacy concern to us at any time so that we can investigate it.

17. Updates and further information

We update this notice when the activities described or applicable requirements change. Publishing a new version does not replace required consent or a necessary contractual agreement. This version is dated 20 October 2026.

Relevant legislation includes the GDPR, the Austrian Data Protection Act and, for device access, section 165(3) of the Austrian Telecommunications Act 2021. Full legal texts are available through EUR-Lex and Austria’s federal legal information system.