Privacy Policy

1. Controller

Blattgruen ESG GmbH
Albrechts 25
3961 Waldenstein
Austria

Represented by:
DI Rupert Petschina

Email: [email protected]

2. General information

We process personal data only where this is necessary to operate this website, provide its functionality, maintain security, communicate with visitors or comply with legal obligations.

Personal data may include, for example, IP addresses, technical request information, browser and device information, timestamps, log data and information that you provide to us directly.

3. Website hosting

This website is operated on STACKIT Cloud Foundry. STACKIT provides the technical infrastructure required to deliver the application.

In connection with the operation of the website, technical data such as IP addresses, request information, timestamps, error information and other server log data may be processed.

This processing is necessary to provide the website, ensure technical stability, detect errors and protect the infrastructure against misuse and attacks.

The legal basis is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in providing a secure, reliable and technically functional website.

STACKIT operates cloud regions in Germany and Austria. The Cloud Foundry environment currently used for blattgruen.ai is located in the STACKIT EU01 region.

4. Cloudflare

We use services provided by Cloudflare to operate and protect blattgruen.ai. Cloudflare is used in particular for DNS, reverse-proxy functionality, TLS termination, traffic routing and security functions.

When you access this website, your request may first be processed through Cloudflare infrastructure before being forwarded to the application hosted on STACKIT.

In this context, Cloudflare may process technical information including IP addresses, request and response data, browser and device information, timestamps and security-related information.

The processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the secure, reliable and efficient operation of the website, including protection against misuse, attacks and excessive traffic.

Cloudflare operates a global network. Personal data may therefore be processed outside the European Economic Area where necessary for the provision of the service. Cloudflare provides contractual safeguards for international data transfers, including the EU Standard Contractual Clauses and, where applicable, additional transfer mechanisms.

5. Server and security logs

When the website is accessed, technical log data may be generated automatically by Cloudflare, STACKIT and the application runtime.

This may include:

• IP address
• date and time of the request
• requested URL or resource
• HTTP method and status code
• browser and device information
• referrer information, where transmitted
• technical error and security information

This information is processed for technical delivery, troubleshooting, security monitoring and protection against unlawful or abusive use.

The legal basis is Art. 6 para. 1 lit. f GDPR.

6. Contact by email

If you contact us by email, we process the information you provide in order to respond to your request and, where applicable, to prepare or perform a business relationship.

Our email infrastructure is provided through Microsoft 365 / Exchange Online. In connection with email communication, Microsoft may process message content, attachments, sender and recipient information, timestamps, technical metadata and other information required to provide and secure the email service.

Depending on the purpose of the communication, the legal basis is Art. 6 para. 1 lit. b GDPR for pre-contractual or contractual communication, or Art. 6 para. 1 lit. f GDPR for other business communication.

Communication data is retained only for as long as necessary for the respective purpose and to comply with applicable statutory retention obligations.

Microsoft 365 provides data residency commitments for Exchange Online. For eligible EU tenants, Exchange Online mailbox content is stored at rest within the European Union geography. Microsoft also operates an EU Data Boundary for Microsoft 365, subject to documented limited exceptions for certain operational and support scenarios.

7. Cookies and tracking

blattgruen.ai currently does not use advertising cookies, behavioral tracking or third-party analytics services.

If such services are introduced in the future, this privacy policy will be updated and, where legally required, appropriate consent mechanisms will be implemented before the relevant data processing begins.

8. Recipients and processors

Personal data may be processed by service providers that support us in operating the website and its technical infrastructure.

These currently include in particular:

• STACKIT for cloud hosting and application runtime
• Cloudflare for DNS, proxy, TLS, network and security services
• Microsoft for Microsoft 365 / Exchange Online email infrastructure

Service providers are used only where necessary for the respective purpose and subject to applicable data protection requirements.

9. Storage periods

Personal data is stored only for as long as necessary for the purpose for which it was collected or for as long as statutory retention obligations apply.

Technical log and security data may be retained for limited periods where this is necessary to ensure system security, investigate incidents or protect legal interests.

10. Your rights

Subject to the requirements of the GDPR, you may have the right to:

• obtain information about your personal data
• request correction of inaccurate data
• request deletion of personal data
• request restriction of processing
• receive data in a portable format where applicable
• object to processing based on legitimate interests
• withdraw consent with effect for the future

To exercise these rights, please contact us at [email protected].

11. Right to lodge a complaint

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.

In Austria, the competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).

12. Changes to this privacy policy

We may update this privacy policy when the website, its technical architecture or the services used change, or where legal requirements make an update necessary.

Last updated: October 2026.