DE
Go to shop

Privacy Policy

Controller and general information

Please note: This English text is a convenience translation. Only the German version is legally binding.

As of August 2026

The address of our website is: https://www.mydatacenter.at

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (referred to below as “data”) within our online offering and the websites, functions and content connected with it, as well as our external online presences such as our social media profiles (referred to together below as the “online offering”). For the terms used, such as “processing” or “controller”, we refer you to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

Categories of data processed

  • Master data (e.g., names, addresses)
  • Contact data (e.g., email addresses, phone numbers)
  • Content data (e.g., text entries, photographs, videos)
  • Usage data (e.g., pages visited, interest in content, access times)
  • Meta and communication data (e.g., device information, IP addresses)

Categories of data subjects

Visitors to and users of the online offering (below we also refer to the data subjects together as “users”).

Purpose of processing

  • Provision of the online offering, its functions and content
  • Answering contact requests and communicating with users
  • Security measures
  • Marketing

Terms used

“Personal data” means any information relating to an identified or identifiable natural person (below the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically every handling of data.

“Pseudonymization” means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures which ensure that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of the use of those personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Applicable legal bases

In accordance with Art. 13 GDPR we inform you of the legal bases for our data processing. Where the legal basis is not named in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing in order to perform our services and carry out contractual measures as well as to answer inquiries is Art. 6(1)(b) GDPR; the legal basis for processing in order to meet our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing in order to safeguard our legitimate interests is Art. 6(1)(f) GDPR. Where the vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.

Security measures

In accordance with Art. 32 GDPR, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as the access, input and disclosure relating to it, and by securing availability and separation. We have also set up procedures that ensure data subject rights can be exercised, that data are erased and that we respond to threats to the data. We further take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in line with the principle of data protection by design and by default (Art. 25 GDPR).

TLS encryption with https

We use https in order to transmit data over the internet in encrypted form (data protection by design, Art. 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission over the internet, we protect confidential data while it is in transit. You can recognize this protection by the padlock symbol on the left of your browser’s address bar and by the https scheme (instead of http) as part of our internet address.

Working with processors and third parties

Where, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit data to them or otherwise grant them access to the data, this happens only on the basis of a legal permission (e.g., where transmitting the data to third parties such as payment service providers is necessary to perform a contract under Art. 6(1)(b) GDPR), where you have consented, where a legal obligation provides for it, or on the basis of our legitimate interests (e.g., when using agents or payment service providers).

Where we engage third parties to process data on the basis of what is known as a “data processing agreement”, this happens on the basis of Art. 28 GDPR.

Your rights as a data subject

Rights of data subjects

You have the right to obtain confirmation as to whether data concerning you are being processed, to obtain access to that data and to further information and a copy of the data in accordance with Art. 15 GDPR. Under Art. 16 GDPR you have the right to request that data concerning you be completed or that inaccurate data concerning you be rectified. Under Art. 17 GDPR you have the right to request that data concerning you be erased without undue delay, or alternatively, under Art. 18 GDPR, to request that the processing of the data be restricted. In accordance with Art. 20 GDPR you have the right to receive the data concerning you that you have provided to us and to request its transmission to other controllers.

You also have the right, under Art. 77 GDPR, to lodge a complaint with the competent supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, www.dsb.gv.at).

Right to withdraw consent

You have the right to withdraw consent you have given, with effect for the future, in accordance with Art. 7(3) GDPR.

Right to object

You may object at any time to the future processing of data concerning you in accordance with Art. 21 GDPR. In particular, you may object to processing for the purposes of direct marketing.

Contact for data protection matters

To exercise your rights, or if you have concerns or further questions about data protection, please write to myDC Cloud Services GmbH, Dr.-Franz-Wilhelm-Straße 2, 3500 Krems an der Donau, or send an email to datenschutz@myDataCenter.at.

Erasure of data

The data we process are erased, or their processing is restricted, in accordance with Art. 17 and Art. 18 GDPR. Unless expressly stated otherwise in this privacy policy, the data stored by us are erased as soon as they are no longer required for their intended purpose and no statutory retention obligations stand in the way of erasure. Where data are not erased because they are required for other purposes permitted by law, their processing is restricted. That means the data are blocked for other purposes and not processed further. This applies, for example, to data that must be retained for company law or tax law reasons.

Under Austrian statutory requirements, data are retained in particular for 7 years pursuant to Section 132(1) BAO (Austrian Federal Fiscal Code: accounting records, receipts and invoices, accounts, business papers, statements of income and expenditure and the like), for 22 years in connection with real property, and for 10 years for records relating to electronically supplied services, telecommunications, broadcasting and television services that are supplied to non-business customers in EU member states and for which the One-Stop Shop (EU-OSS) is used.

Data processing in detail

No external services embedded

This website embeds no external services; fonts are served locally. No third-party content is loaded (no external web analytics services, no external fonts, maps or videos). When you visit this website, your IP address is therefore not transmitted to any third party. We also run our audience measurement (see below) entirely ourselves, on our own infrastructure in Austria.

Hosting and server log files

Our online offering runs on our own infrastructure in Austria; no external web host is involved. When you visit our website, we process access data in the form of server log files on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR (security and stability of the online offering). This includes in particular the address of the page requested, the date and time of the request, the volume of data transferred, the message confirming a successful request, browser type and version, the operating system, the previously visited page (referrer URL) and the IP address.

For security reasons (e.g., to investigate misuse), log file information is stored for a maximum of 7 days and then erased or anonymized. Data whose further retention is required as evidence are exempt from erasure until the incident in question has been finally resolved.

Audience measurement with Matomo (self-hosted, without cookies)

On this website we use the open-source web analytics software Matomo. Matomo runs entirely on our own infrastructure in Austria; no data are transmitted to third parties.

Audience measurement works without cookies and without accessing or storing information on your device. Consent under Section 165(3) TKG 2021 (Austrian Telecommunications Act) is therefore not required. Your IP address is truncated by its last two bytes before it is stored (anonymization); individual visitors are not recognized across several visits.

The following are processed: the truncated IP address, the pages visited, the referring page (referrer), browser type and version, operating system, screen resolution, language, the date and time of access, and the approximate origin (country). The origin is determined from the IP address when the page is loaded; the IP address is stored in truncated form only. The legal basis is our legitimate interest in anonymized audience measurement and in improving our online offering (Art. 6(1)(f) GDPR). Raw data are erased automatically after 180 days; only aggregated, anonymous statistics are kept.

Matomo respects the “Do Not Track” setting in your browser: if it is enabled, nothing at all is recorded. This lets you object to the processing at any time (Art. 21 GDPR).

Cookies and local storage

“Cookies” are small files that are stored on the user’s device and can be transmitted to the server when a page is loaded. They serve to store information about a user or a device during or after a visit to an online offering.

No cookies are set when you visit this website – neither for tracking nor for marketing or analytics purposes. Our audience measurement (Matomo, see above) also works entirely without cookies. Only your chosen display setting (light or dark mode) is – if you change it – stored locally in your browser as a technically necessary entry (the localStorage entry “mydc-mode”). This information stays on your device and is not transmitted to us; consent is not required for it under Section 165(3) TKG (Austrian Telecommunications Act).

You can view and delete stored cookies and local browser data at any time in your browser settings.

Contacting us

When you contact us (e.g., via our request form, by email, by phone or through social media), the details provided by the user are processed in order to process and handle the contact request pursuant to Art. 6(1)(b) GDPR. Users’ details may be stored in a customer relationship management system (“CRM system”) or comparable system for organizing requests.

We erase requests once they are no longer required. We review whether they are still required every two years; statutory archiving obligations also apply.

Request form

On individual pages of this website you can reach us through a form. We process the details entered there solely in order to handle and answer your request. The legal basis is Art. 6(1)(b) GDPR (answering inquiries and carrying out pre-contractual measures); separate consent is not required for this and we do not obtain any.

Only the fields we need in order to give you a useful answer are marked as mandatory – as a rule company, name, email address and the category of your request. All other fields (such as phone number, when you prefer to be reached, the size of your project, the environment you use or particular requirements) are voluntary; they only help us to answer more precisely.

The processing takes place on our own infrastructure in Austria. Your request is forwarded to the internally responsible mailbox and is additionally stored in the database of this website so that no request is lost. This copy in the website is erased automatically and permanently no later than 90 days after receipt; for further correspondence about your request, the retention described above under “Contacting us” applies. The data are not passed on to third parties, nor are they used for advertising or newsletters.

Your IP address is not stored with the request. To protect against automated bulk submissions, we only check how many requests arrive from the same connection within one hour; for this purpose an irreversible check value derived from your IP address is stored for at most one hour and then erased automatically (Art. 6(1)(f) GDPR, protection against misuse). If a mandatory field is missing when you submit, the data you have already entered are cached technically for at most ten minutes so that you do not have to fill in the form again. No cookies are set in the process.

Online presences on social media

We maintain online presences within social networks and platforms in order to communicate with the customers, prospective customers and users active there and to inform them about our services. When you visit the respective networks and platforms, the terms and conditions and the data processing policies of their respective operators apply.

Unless stated otherwise in this privacy policy, we process users’ data where they communicate with us within the social networks and platforms, for example by writing posts on our online presences or sending us messages.

Changes to this privacy policy

We reserve the right to change this privacy policy when we update our website or change our data processing procedures. You will always find the current version at www.mydatacenter.at/en/privacy-policy.