Privacy policy
1. Controller
The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is lemon42 IT, Web und Software GmbH, Schönbrunner Straße 108/Top 6, 1050 Vienna, Austria, phone +43 1 403 01 95-0, e-mail office@lemon42.com.
Your contact for all data protection questions is Otto Kinigadner, who can be reached at dsgvo@lemon42.com. We have not appointed a data protection officer, as the conditions of Art. 37 GDPR do not apply to us.
2. No cookies, no tracking, no third-party content
This website sets no cookies, neither strictly necessary ones nor any for analytics or advertising, and stores no data in your browser. No analytics, tracking, advertising or social media services are embedded. Fonts, images and videos are served exclusively from our own server; visiting this website opens no connection to third-party servers. There are no user accounts.
3. Server log files
When you visit this website, your browser transmits data for technical reasons to our web server, which stores it in log files: IP address, date and time of access, page or file requested, HTTP status code, bytes transferred, the previously visited page (referrer), and browser and operating system identifiers.
This processing serves to deliver the website, analyse errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website. We do not combine this data with other data sources and do not analyse it to identify visitors.
The log files are deleted automatically after 14 days. Data that must be kept to investigate a security incident is deleted once the incident has been fully resolved.
4. Hosting
This website is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in the Frankfurt am Main (Germany) data centre region. AWS processes the data listed under section 3 on our behalf; a data processing agreement under Art. 28 GDPR is in place with AWS.
AWS belongs to the group of Amazon.com, Inc., based in the USA. Access to data from the USA therefore cannot be entirely ruled out. Should it occur, the transfer is based on the certification of Amazon Web Services, Inc. under the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
5. Contact by e-mail
If you contact us by e-mail, for example to arrange a demo, we process the details you send us (usually name, e-mail address, organisation and the content of your message) solely to handle your enquiry.
The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry. For our e-mail communication we use Google Workspace from Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, as a processor. Google belongs to the group of Google LLC, based in the USA; any transfer there is based on the certification of Google LLC under the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
We delete your details once your enquiry has been fully handled, unless statutory retention obligations apply, for example under § 132 of the Austrian Federal Fiscal Code (7 years) if the enquiry leads to a business transaction.
6. Contact form
If you write to us using the form on the “Contact” page, your browser transmits your e-mail address, your message, the language of the page and the page of this website from which you came to the form. Our server forwards these details to us as an e-mail and does not store them. To send it we use Amazon Simple Email Service (Amazon SES) from AWS in the Frankfurt am Main data centre region; the data processing agreement mentioned under section 4 applies. We then handle the e-mail as described under section 5, with the same legal basis and deletion period.
To protect against spam, our server counts how many enquiries come from an IP address and accepts at most five per hour. This count is held only in memory and is deleted after one hour at the latest. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is protecting the form against misuse.
7. Recipients
The only recipients of your data are our processors (AWS as hosting provider and for sending the contact form, Google Cloud EMEA Limited for e-mail). Data is passed on to other third parties only where we are legally obliged to do so.
8. No obligation to provide data, no automated decision-making
You are not obliged to provide us with personal data. Without the access data your browser transmits, however, the website cannot be displayed, and without contact details we cannot answer your enquiry. There is no automated decision-making, including profiling, under Art. 22 GDPR.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21). To do so, write to dsgvo@lemon42.com.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.
10. Last updated
This privacy policy was last updated in October 2026. We adapt it when the website or the legal situation changes.