Privacy notice (preview operation)

1. Controller

Controller for the processing described here: [[Company name and address to be confirmed]], email office@krp6.at.

The operating entity for this domain has not been finally confirmed. Fields marked [[...]] must be completed with verified master data before any real operation. We do not invent company data, and a domain name alone is not a legal operator.

2. What is actually processed

This preview is deliberately data-sparse. There are no advertising trackers, no analytics services, no external scripts, no external font services and no social media plugins.

Server log files: timestamp, requested URL, HTTP status, transferred volume, browser type, operating system, referring page and IP address. Purpose: operation, security, error analysis. Retention: 14 days, then deletion.

Session cookie (cfc_sid): one technically necessary cookie with a random session identifier. No advertising, no profiling. Expires with the session or after 12 hours at the latest.

Language cookie (cfc_lang): stores which language was selected. Duration: 12 months.

Language preselection by country: your IP address is compared once per page view against a local copy of the free DB-IP Lite country database to derive the country and from that the suggested language. This happens on our own server, without any external service, without storage and without profiling; the plain IP address is only kept in the server log for 14 days. A language you chose yourself always takes precedence and is never overwritten.

Demo accounts: email address, password hash (PBKDF2-SHA256 with random salt, never the password itself), display name, optional city/country, and the demo actions you perform (bids, favourites, messages, saved searches).

Contact form and support form: the data you enter (name, email address, message) so that the demo flow can be shown. No email is sent from the preview.

Security data: hashed IP address and a short timestamp on bids and logins to detect misuse (rate limiting).

3. Purposes and legal bases

Providing the preview and its interactive demo functions: performance of the user relationship you initiate by using it, and our legitimate interest in presenting the project (Art. 6(1)(f) GDPR).

Security, error analysis and defence against attacks: legitimate interest (Art. 6(1)(f) GDPR).

Technically necessary cookies: no consent is required, because they are strictly necessary for the function you requested (cfc_sid) or store your explicit language choice (cfc_lang).

Contact and support enquiries: processing to answer your enquiry (Art. 6(1)(b)/(f) GDPR).

Language preselection from the country of the calling IP address: our legitimate interest in a user-friendly presentation (Art. 6(1)(f) GDPR). No consent is required, because nothing is stored and no user profile is created; the suggestion can be changed at any time.

We do not use your data for advertising, profiling or automated decision-making. There is no newsletter and no interest list.

4. Hosting and recipients

The application runs on a server of a hosting provider within the European Union (Netcup GmbH, Germany). The server location is the EU.

A contract for order processing within the meaning of Art. 28 GDPR is to be concluded with the hosting provider and documented before a real operation. The preview itself uses no other processors, no cloud services and no external APIs.

Access to the server is limited to the technical administration. Data is not sold and not transferred to third countries.

5. Storage duration

Server log files: 14 days.

Session: until logout or 12 hours after the last activity.

Language cookie: 12 months.

Demo account and demo actions: until the demo data set is reset. Reset happens when the preview is redeployed, at the latest at the end of the preview phase.

Contact and support enquiries: until the enquiry is answered, at the latest 6 months.

Afterwards the data is deleted unless a statutory retention obligation applies.

6. Your rights

You have the right to information, correction, deletion, restriction of processing, data portability and objection. To exercise these rights, write to office@krp6.at.

If you believe that processing violates data protection law, you may lodge a complaint with a supervisory authority. In Austria this is the Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna).

Because this is a demo, the simplest way to have your demo data removed is to ask us for deletion — we will delete the demo account and its actions.

7. Cookies in this preview

Exactly two cookies are set, both first-party and both technically necessary:

cfc_sid — session identifier, HttpOnly, SameSite=Lax, Secure when the site is used over HTTPS, lifetime 12 hours.

cfc_lang — language choice (de or en), SameSite=Lax, lifetime 12 months.

No consent banner is shown, because no consent-requiring cookie is set. If analytics or marketing tools are added later, they must be blocked until consent is given and this notice must be extended beforehand.

8. No tracking, no profiling, no automated decisions

There is no web analytics, no pixel, no advertising network, no fingerprinting, no A/B testing and no profiling. There is no automated decision-making with legal effect.

The preview also does not load content from third-party servers, so no data is transmitted to third parties through your browser.

---

Allt innehåll på denna sida är exempeldata. Interaktiv projektförhandsvisning. Inga liveauktioner. Lanseringsdatum är inte bekräftat.