Privacy Policy.

When visiting this website, technical access data, communication data and voluntarily submitted contact details may be processed.

If you use the contact or demo form, we process in particular your name, email address, organisation, phone number, message text, request language and the time of transmission. Mandatory fields are limited to the data required to process the enquiry.

Processing is used to provide the website, respond to enquiries, maintain system security and prepare potential organisation access.

The legal basis for processing contact, demo and onboarding enquiries is Art. 6(1)(b) GDPR where the enquiry relates to pre-contractual steps or potential organisation access. For technical access data, logs, abuse prevention and system security, we rely on Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and traceable operation of the website and forms.

We currently use the following service providers to operate the public website and forms: Vercel Inc. for hosting and delivery of the website, Supabase Inc. for database and form submission storage, and Resend / Plus Five Five, Inc. for sending notification emails from the contact and demo forms. These providers process personal data only as part of providing their respective technical services.

The website is provided via Vercel. Form submissions are stored in Supabase and notifications about new form enquiries are sent by email via Resend. Data is only shared with other recipients where this is required to process your enquiry or where we are legally required to do so.

Some of the service providers used are based in the United States or may use subprocessors outside the EU/EEA. Resend identifies the United States as its primary processing location and lists, among others, US-based subprocessors. Vercel also refers to primary processing facilities in the United States and operates its services on infrastructure including AWS, Azure and Google Cloud. Supabase projects can be operated in selectable AWS regions, including Frankfurt; Supabase also states that data may be transferred to countries outside a user's country of residence, in particular the United States and Singapore.

Where personal data is transferred to a third country without an adequacy decision, the providers state that appropriate safeguards are used, in particular the EU Standard Contractual Clauses. These statements are subject to the specific configuration, the providers' current terms and the final legal review.

Form data from contact and demo enquiries is generally stored only for as long as required to process the enquiry, prepare potential organisation access or comply with statutory retention obligations. If no contract or organisation access is established, enquiry data is intended to be deleted or reviewed for continued necessity regularly, no later than after 12 months.

Data subjects may request access, rectification, erasure, restriction of processing, data portability and object to processing based on legitimate interests. They also have the right to lodge a complaint with a competent data protection supervisory authority.

This privacy policy is a preliminary version and has not yet been reviewed by legal counsel. It describes, to the best of our knowledge, the current technical state of the public Auxfinora pages and form processing. The final version will be adjusted after legal review and reconciliation with the specific data processing agreements entered into.