Privacy

Controller within the meaning of the General Data Protection Regulation ("GDPR"): Infrared City GmbH

Director: Angelos Chronis

Address: Gumpendorferstrasse 91/1/12, 1060 Vienna, Austria

Registered at the Commercial Court of Vienna under: FN 612069b

Email: info@infrared.city

Personal data is information that relates to an identified or identifiable natural person ("data subject"). Examples are name, address, e-mail address, telephone number and IP address. The data that we process depends on how you use this website and which data you give us yourself.

a) Hosting and security (Cloudflare)

Cloudflare, Inc. hosts this website and delivers it to your browser. When you open a page, the server receives your IP address, the date and time, the page you ask for, and technical data of your browser. We and Cloudflare use this data to deliver the pages and to keep the website safe. Cloudflare Web Analytics can also run on this website. It is a script that Cloudflare adds. It counts page views and measures loading speed, sets no cookie and stores nothing on your device. It is independent of the statistics in point c.

b) Cookies and storage on your device

This website sets no cookies. It does not use local storage or session storage for analytics or for tracking.

There is one exception that you control. If you choose "Analytics: opt out", your browser keeps one small entry named ir-analytics-optout. This entry holds only your objection, and we need it to respect your choice. It holds no identifier. You can remove it at any time with the same link.

Services that you open on your own (a booking page or a podcast player, see point e and f) can set their own cookies. Their privacy notices apply to them.

c) Website analytics (PostHog)

Purpose. We want to know which pages people read, which buttons they use and where they leave. We use this to improve the content, the navigation and the speed of the website.

Legal basis. Art 6 para 1 lit f GDPR (legitimate interest). Our interest is to improve our own business website. We checked this interest against your interests. The result: the data is low in detail, we use it only for our own statistics, we make no profile, we store nothing on your device, we keep the data for a short time, and you can object at any time (point 7). We keep a written balancing test and can send it to you on request.

Tool. We use PostHog, a product of PostHog, Inc. (2261 Market Street #4008, San Francisco, CA 94114, USA). We use the PostHog cloud in the EU (Frankfurt). PostHog acts as our processor under a data processing agreement. Your browser does not talk to PostHog directly. It sends the data to our own domain (infrared.city/ingest), and our server forwards it.

Data. The address of the page without query string and fragment (we keep only campaign tags that start with utm_), the referring site without query string, clicks on elements of the page (which element, where on the page), page views and the time on a page, how far you scroll, browser type, operating system, screen size and language. Your IP address and browser details are used on the server to make a daily hash. The IP address is needed for this one step. PostHog states in its documentation that in this mode it makes the hash on its servers, removes the IP address before it processes the event further, and deletes the daily salt after the day. We cannot check this from outside. We do not change the IP settings of the PostHog project, so we do not claim more than PostHog states. A person cannot be followed from one day to the next.

What we do not do. We set no cookie and store nothing on your device for this. We make no person profile. We do not record sessions and we do not run surveys. We do not use the data to follow you on other websites. We do not link it to your platform account or to data in our booking tool. We do not read what you type into form fields, and we do not collect text that you copy.

Signals and opt-out. If your browser sends the Global Privacy Control or the Do Not Track signal, we do not load the analytics at all. You can also object at any time: Analytics: opt out.

d) Campaign tags on links to the platform

When you click a link to platform.infrared.city, we add three tags to the address: utm_source=website, utm_medium=(the page you were on) and utm_campaign=(the button). The tags are the same for all visitors and do not identify you. We do not store them on this website. The platform can save the source in your account if you sign up. The privacy notice of the platform applies to that.

e) Booking a call (HubSpot)

"Book a call" opens our booking page at meetings-eu1.hubspot.com in a new tab. Nothing is loaded from HubSpot before you click. HubSpot, Inc. processes the data that you enter there. The HubSpot privacy notice applies: https://legal.hubspot.com/privacy-policy

f) Podcast (Spotify)

The podcast player loads only after you press "Play here". Spotify AB then receives your IP address and data of your browser. The Spotify privacy notice applies: https://www.spotify.com/legal/privacy-policy/

g) Contact by email

If you write to us, we process your email address and the content of your message to answer you. The legal basis is Art 6 para 1 lit b GDPR (pre-contract steps) or lit f GDPR (answering enquiries).

h) Payments and accounts

This website sells nothing and has no accounts. Accounts and payments are on the platform at platform.infrared.city. The privacy notice of the platform applies there.

There are no automated decision-making processes according to Art 22 GDPR.

We process personal data only if a legal basis according to the GDPR exists.

a) Legitimate interest (Art 6 para 1 lit f GDPR)

If the processing is necessary for a legitimate interest of our company or of a third party, Art 6 para 1 lit f GDPR is the legal basis. Our legitimate interests are: to run and maintain this website; to keep the network and the data safe; to measure the use of the website and to improve it (point 3 c); to enforce or defend legal claims. You can object (point 7).

b) Performance of a contract (Art 6 para 1 lit b GDPR)

Art 6 para 1 lit b GDPR is the legal basis for processing under a contract. It includes steps before a contract that start with your contact to us.

c) Consent (Art 6 para 1 lit a GDPR)

If we ask for your consent, the consent text states the scope and purpose. You can withdraw a consent at any time with effect for the future. Write an email to info@infrared.city or send a letter to Gumpendorferstrasse 91/1/12, 1060 Vienna, Austria.

d) Legal obligations (Art 6 para 1 lit c GDPR)

If a legal obligation requires the processing, Art 6 para 1 lit c GDPR is the legal basis. An example is our duty to keep books and records for seven years (§ 132 BAO, Austrian Federal Fiscal Code).

Web analytics events: PostHog keeps them for the retention period of our PostHog plan. We use them for statistics for up to 12 months. The salt of the daily hash: deleted after the day. The opt-out entry in your browser: until you remove it. Server logs of Cloudflare: for the short time that Cloudflare needs for security and delivery. Emails and booking data: as long as we need them for the contact, and for the legal duties to keep records. We treat the data in line with this notice for the whole time.

You have the rights below. To use them, contact us with the details in point 1.

• a) The right to information about your personal data, its origin and recipients, and the purpose of the processing;
• b) the right to rectify your data, to transfer your data, to restrict the processing and to erase your data;
• c) the right to object (Art 21 GDPR). You can object at any time to processing that is based on legitimate interest, including the web analytics in point 3 c. Use this link: Analytics: opt out. Or write to info@infrared.city. The objection works for the future;
• d) the right to lodge a complaint with the supervisory authority. In Austria this is the Austrian Data Protection Authority (www.dsb.gv.at; Barichgasse 40-42, 1030 Vienna, Austria).

• a) We give personal data only to the extent necessary to service providers (processors) who work on our instructions. They are:

• i) Cloudflare, Inc. (hosting, delivery, security, forwarding of analytics requests, Web Analytics);
• ii) PostHog, Inc. (website statistics, EU cloud, point 3 c);
• iii) other IT service providers and software providers that help us to run our services.

• b) We also give personal data to these recipients (controllers) to the extent necessary:

• i) HubSpot, Inc. (booking page, only after your click) and Spotify AB (podcast player, only after your click);
• ii) legal representatives and courts in cases of need;
• iii) auditors, authorities, courts and other public bodies to the extent the law requires it.

• c) Cloudflare, Inc. and PostHog, Inc. are companies in the USA. PostHog stores the analytics data in the EU. Access from a third country, for example for support, can still happen. We give personal data to recipients outside the EEA only if the European Commission has issued an adequacy decision (for example under the EU-US Data Privacy Framework), if we have agreed suitable safeguards (standard contractual clauses), or if you have given your express consent under Art 49 para 1 lit a GDPR for a single case.

We can change this Privacy Policy, for example because of new technology, new laws or new services. The latest version is always on our website.

These services are part of this website or open from it:

• Cloudflare (Cloudflare, Inc.): hosts this website and some article images (imagedelivery.net). Cloudflare Web Analytics can run on this website: it counts page views and measures speed, without cookies.
• PostHog, EU cloud (PostHog, Inc.): website statistics without cookies and without storage on your device. Requests go through our own domain (infrared.city/ingest). Not loaded if your browser sends Global Privacy Control or Do Not Track, or if you opted out.
• HubSpot Meetings (HubSpot, Inc.): "Book a call" opens our booking page on meetings-eu1.hubspot.com in a new tab. Nothing loads before you click.
• Spotify (Spotify AB): podcast players load only after you press "Play here". "Open in Spotify" opens spotify.com in a new tab.
• Demo sites: each demo opens in a new tab on its own address (for example pages.dev, workers.dev or vercel.app hosting).
• infrared.city platform: platform.infrared.city opens in a new tab. Accounts and payments are there, with their own privacy notice.

Fonts are served from this website. This website sets no cookies. To object to the statistics, use Analytics: opt out.