Privacy Policy autonoma.cloud

We process personal data (hereinafter usually referred to simply as “data”) only to the extent necessary to provide a functional and user-friendly website, including its content and services.

Pursuant to Art. 4(1) of Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter “GDPR”), “processing” means any operation performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

In addition to the GDPR, the Austrian Data Protection Act (DSG) applies, as does, for cookies and similar technologies, Section 165 of the Austrian Telecommunications Act 2021 (TKG 2021).

In this privacy policy, we inform you about the nature, scope, purpose, duration and legal basis of the processing of personal data, insofar as we decide on the purposes and means of processing either alone or jointly with others. We also inform you about third-party components we use, insofar as these process data under their own responsibility.

Our privacy policy is structured as follows:

• Information about us as the controller
• Rights of users and data subjects
• Information on data processing

I. Information about us as the controller

The controller within the meaning of Art. 4(7) GDPR for this website is:

Autonoma Technologies GmbH, Rudolfstraße 6 4040 Linz, Austria Email: [email protected] Company register number: FN 556218 v, Regional Court of Linz VAT ID: ATU76988627 Managing directors authorised to represent the company: Florian Haslhofer, David Gumpinger, Florian Bauernfeind

Contact person for data protection:

Florian Bauernfeind Autonoma Technologies GmbH, Rudolfstraße 6, 4040 Linz Email: [email protected]

II. Rights of users and data subjects

With regard to the data processing described below, users and data subjects have the right

• to confirmation as to whether data concerning them is being processed, to access this data, to further information about the processing and to copies of the data (Art. 15 GDPR);
• to rectification or completion of inaccurate or incomplete data (Art. 16 GDPR);
• to the immediate erasure of data concerning them (Art. 17 GDPR) or, where further processing is required under Art. 17(3) GDPR, to restriction of processing (Art. 18 GDPR);
• to receive the data concerning them that they have provided and to have this data transmitted to other controllers (Art. 20 GDPR);
• to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected. You can withdraw your consent to cookies and tracking at any time via the “Cookie Settings” on our website
  

In Austria, the competent supervisory authority is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40–42, 1030 Vienna Email: [email protected] Web: www.dsb.gv.at

Right to object: Where data is processed on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time pursuant to Art. 21 GDPR on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, an informal message to [email protected] is sufficient.

III. Information on data processing

Your data will be erased or blocked as soon as the purpose of storage no longer applies, provided that no statutory retention obligations prevent this (for example under Section 132 BAO or Section 212 UGB, seven years in each case) and nothing else is stated for the individual processing operations.

Server data

For technical reasons, in particular to ensure a secure and stable website, your browser transmits data to us or to our hosting provider. These server log files record, among other things, the type and version of your browser, the operating system, the previously visited website (referrer URL), the pages accessed, the date and time of access and the IP address.

This data is stored temporarily and not together with other data about you. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the stability, functionality and security of our website.

The data is deleted after seven days at the latest, unless further retention is required for evidentiary purposes. In that case, it is exempt from deletion in whole or in part until an incident has been resolved.

Cookies

We use cookies. Cookies are small text files or comparable storage technologies (e.g. local storage) that your browser stores on your device. Information such as browser or location data or your IP address may be processed in this context.

a) Strictly necessary cookies: Some cookies are strictly necessary for the operation of the website, for example for session management and security (e.g. “a-session” and “XSRF-TOKEN”, lifetime two hours) or for storing your cookie choices. We use these without consent pursuant to Section 165(3) TKG 2021. The legal basis for the associated processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and proper operation of the website.

b) Non-essential cookies and third-party cookies: We use cookies for analytics, marketing and embedded third-party content only with your consent (Section 165(3) TKG 2021 in conjunction with Art. 6(1)(a) GDPR). Details can be found under the respective services below.

c) Withdrawal and removal: You can withdraw your consent at any time via the “Cookie Settings”. You can also block or delete cookies in your browser. If you restrict cookies, some features of the website may not be available.

Cookie manager

To obtain and manage your consent to non-essential cookies, we use the HubSpot cookie banner (for the provider, see the “HubSpot” section). Your choices are stored in cookies (including “__hs_cookie_cat_pref”, “__hs_opt_out”, “__hs_do_not_track”) so that the request does not reappear on every visit.

These cookies are required to obtain and document your consent in compliance with the law. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, as well as Art. 6(1)(f) GDPR.

Contact requests and contact options

If you contact us via the contact form or by email, we use your details to process your request. Without this information, we cannot answer your request, or can do so only to a limited extent. Requests submitted via the contact form are stored in our CRM system HubSpot.

The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to your enquiry.

We delete your data as soon as your request has been fully processed and no statutory retention obligations prevent this, for example in the case of subsequent contract performance.

To protect our forms from spam, we use Cloudflare Turnstile (see the “Cloudflare” section).

Newsletter and test account requests (HubSpot)

If you subscribe to our newsletter or request a test account via our form, we process your email address and other voluntary information (e.g. name, company). We also store your IP address and the date and time of registration. Newsletter subscription uses the double opt-in procedure: you will receive an email in which you confirm your subscription.

Forms, newsletter delivery and the management of subscriptions are handled via HubSpot (for the provider and data processing, see the “HubSpot” section). Your details are stored in our CRM system.

Our newsletters contain tracking links and a tracking pixel. This allows us to see whether and when a newsletter was opened and which links were clicked. This data may be assigned to your contact record in the CRM. We use it to improve our newsletter.

The legal basis for sending and analysing the newsletter is your consent pursuant to Art. 6(1)(a) GDPR and Section 174 TKG 2021. The legal basis for processing a test account request is Art. 6(1)(b) GDPR. You can withdraw your consent at any time via the unsubscribe link in every newsletter or by sending us a message.

We store your data until you unsubscribe. After that, we keep your email address on a blocklist so that we can prove your withdrawal and prevent further mailings. The legal basis for this is Art. 6(1)(c) and (f) GDPR.

Company profile on LinkedIn

We operate a company page on LinkedIn to present our company and our services and to communicate with customers and prospects. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

We are jointly responsible with LinkedIn for the page statistics (“Page Insights”) (Art. 26 GDPR). The corresponding agreement can be found at legal.linkedin.com/pages-joint-controller-addendum. We have no access to the user data itself; this lies with LinkedIn.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in communicating with prospects and promoting our services. LinkedIn may also process data in the USA. LinkedIn Corporation is certified under the EU-US Data Privacy Framework.

Further information: LinkedIn Privacy Policy.

Company profile on Instagram

We operate a company presence on Instagram to promote our products and services and to communicate with prospects and customers. We are jointly responsible for this with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The joint controllership agreement can be found at facebook.com/legal/terms/page_controller_addendum. You can reach Meta's data protection officer via this contact form.

When you visit our profile, Meta processes user data (e.g. IP address, device information, interactions) and may set cookies. Meta uses this data for statistics about our company presence, for market research and advertising, and to create user profiles. If you are logged in, Meta can assign the data to your account.

If you contact us via Instagram, we use your details to process the request and delete them as soon as the request has been fully answered and no retention obligations prevent this.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the analysis, communication and promotion of our products and services. Where Meta obtains consent, the legal basis is Art. 6(1)(a) GDPR; you withdraw this consent with Meta. Processing by Meta Platforms, Inc. in the USA cannot be ruled out. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

Further information: Instagram Data Policy.

Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use it to embed and manage analytics and marketing services. Tag Manager itself does not set any cookies, but it processes your IP address when it loads, including on servers of Google LLC in the USA.

The services embedded via Tag Manager are listed exhaustively in this privacy policy and are only triggered after you have given your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.

Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google. We use it to analyse the use of our website and to measure the effectiveness of our marketing campaigns. Data collected includes the time, approximate location and frequency of visits, click paths, interactions, and device and browser information. IP addresses are truncated in the EU and not stored.

For this purpose, Google sets cookies (“_ga” and “_ga_SC3N4F779H”, lifetime up to 2 years). The data is stored for 2 months. If you have enabled personalised advertising in your Google account, Google may analyse your usage across devices; we only receive aggregated statistics. You can disable this feature in your Google account settings.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Google LLC is certified under the EU-US Data Privacy Framework. Further information: policies.google.com/technologies/partner-sites.

Google Ads with conversion tracking and remarketing

We use Google Ads from Google. If you click on one of our ads, a conversion cookie is set (including “_gcl_au”, lifetime 90 days). This lets us see how many users visited our website or submitted a form after clicking an ad. We do not receive any information that would allow us to identify you.

With the remarketing function, we show visitors to our website interest-based ads on other sites in the Google advertising network. For this purpose, Google stores an identifier in a cookie (including on doubleclick.net). If you have agreed to linking with your Google account, Google can do this across devices.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Google LLC is certified under the EU-US Data Privacy Framework. You can also disable personalised advertising at adssettings.google.com. Further information: policies.google.com/technologies/ads.

Hotjar

We use Hotjar, an analytics service provided by Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian's STJ 3141, Malta (part of the Contentsquare group). Hotjar records usage behaviour such as mouse movements, clicks and scroll depth and analyses device, browser and approximate location data. Input in form fields is not recorded. Hotjar can also collect direct feedback and sets cookies for this purpose (including “_hjSessionUser”, lifetime up to 1 year).

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Further information: Hotjar privacy policy.

Plausible Analytics

We also use Plausible Analytics from Plausible Insights OÜ, Tartu, Estonia. Plausible creates anonymous visitor statistics (e.g. pages accessed, referrer, country, device type, browser) and does not set any cookies. A daily changing, non-traceable identifier is generated from the IP address and browser identifier; the IP address itself is not stored. The data is stored exclusively in the EU (Hetzner, Germany).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in privacy-friendly audience measurement and improving our website. Further information: plausible.io/data-policy.

HubSpot

We use HubSpot, CRM and marketing software from HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland, a subsidiary of HubSpot, Inc., USA. We use HubSpot for our cookie banner, for forms, for sending newsletters and emails, for managing contacts and enquiries, and for analysing website usage.

With your consent, HubSpot sets cookies (“__hstc” and “hubspotutk”, lifetime 6 months; “__hssc”, 30 minutes; “__hssrc”, session). These record the pages visited, time spent, device and browser data and the IP address. If you submit a form, this usage data may be assigned to your contact record in our CRM. In addition, HubSpot's CDN provider Cloudflare sets the strictly necessary cookie “__cf_bm” (30 minutes) for bot protection.

HubSpot processes the data on our behalf in its EU data centre (Frankfurt). Access from the USA cannot be ruled out; HubSpot, Inc. is certified under the EU-US Data Privacy Framework. We have concluded a data processing agreement with HubSpot pursuant to Art. 28 GDPR.

The legal basis for tracking cookies and analytics is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. For the processing of form requests, the legal bases set out in the “Contact requests” section apply. Further information: legal.hubspot.com/privacy-policy.

LinkedIn Insight Tag

We use the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. We use it to measure the effectiveness of our LinkedIn ads (conversion tracking), to receive aggregated statistics on website visitors (e.g. industry, job title, company size) and to show ads on LinkedIn to visitors of our website (retargeting).

In the process, data including the IP address, URL accessed, referrer, device and browser properties and timestamps are transmitted to LinkedIn. LinkedIn sets cookies, including “bcookie” (1 year), “li_sugr” (90 days), “UserMatchHistory”, “AnalyticsSyncHistory” and “li_fat_id” (30 days each) and “lidc” (24 hours). If you are logged in to LinkedIn, LinkedIn can assign the visit to your account. We do not receive any data that would allow us to identify you.

We are jointly responsible with LinkedIn for the collection and transmission of the data (Art. 26 GDPR). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Processing in the USA is possible; LinkedIn Corporation is certified under the EU-US Data Privacy Framework. You can also disable personalised advertising in your LinkedIn settings. Further information: LinkedIn Cookie Policy.

Leadfeeder (Dealfront)

We use Leadfeeder from Dealfront Group GmbH, Durlacher Allee 73, 76131 Karlsruhe, Germany. Leadfeeder matches the IP addresses of visitors against databases of known companies. This tells us which companies have visited our website so that we can make them suitable offers. Natural persons or private individuals are not identified in the process.

Leadfeeder records the pages accessed, time spent, referrer and IP address and sets the cookie “_lfa” (lifetime 2 years) to recognise returning visits. The data is processed on our behalf on servers in the EU.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Further information: Leadfeeder privacy notice.

lemlist (website visitor identification)

We use the website visitor feature of lemlist, a service of lempire SAS, 128 rue La Boétie, 75008 Paris, France. When a page is accessed, the lemlist script transmits the URL accessed, the time, the browser identifier (user agent) and the IP address to lemlist. This allows us to recognise which companies visit our website and whether recipients of our email campaigns visit our website.

lemlist processes the data on our behalf on servers in the EU. Transfers to sub-processors outside the EU take place only on the basis of an adequacy decision or EU standard contractual clauses.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Further information: lemlist privacy policy.

Cloudflare (CDN and Turnstile)

We use services of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (“Cloudflare”):

• cdnjs: Loading JavaScript libraries (e.g. Popper, Slick) via the content delivery network cdnjs.cloudflare.com.
• Turnstile: Protecting our forms against spam and automated access. For this purpose, Turnstile checks technical characteristics of your browser and device as well as your IP address, without presenting puzzles.

In particular, your IP address, the page accessed, browser and operating system data, and the date and time are processed. Cloudflare may set the strictly necessary cookie “__cf_bm” for this purpose.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in fast delivery, secure operation of the website and protection against misuse. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. Further information: cloudflare.com/privacypolicy.

Other content delivery networks (CDNs)

For display purposes and fast loading times, we load JavaScript and stylesheet libraries from the following CDNs. In each case, your IP address is transmitted to the provider unless the file is already cached in your browser. A connection to servers outside the EU cannot be ruled out.

These CDNs do not set any cookies. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a fast, reliable and consistent presentation of our website. You can prevent these scripts from loading with a JavaScript blocker; in that case, some features may not be available.

For the United Kingdom, there is an adequacy decision of the European Commission. For transfers to the USA, see the “Transfers to third countries” section.

Google Maps

On our contact page, we embed Google Maps from Google Ireland Limited to display our location. When the map loads, your IP address, the referring page and browser data are transmitted to Google, including in the USA, and Google may set cookies.

The map is only loaded once you consent. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Google LLC is certified under the EU-US Data Privacy Framework. The Google Terms of Service and the Google Maps Additional Terms of Service also apply. Further information: policies.google.com/privacy.

Transfers to third countries

Some of the providers mentioned are based in the USA or process data there. For companies certified under the EU-US Data Privacy Framework, there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR (list of certified companies). For other recipients, transfers are based on EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

Updates to this privacy policy

Last updated: October 2026. We will update this privacy policy if our website or the legal situation changes.