Privacy Policy

Resolv – Digital Solutions e.U.
Last updated: October 2026

1. About this Privacy Policy

This Privacy Policy explains how Resolv – Digital Solutions e.U. (“Resolv”, “we”, “us”, or “our”) processes personal data when you visit our website, contact us, inquire about our services, or submit a job application.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Austrian data protection law.

This policy covers our corporate website. Separate privacy notices may apply to our products and platforms.

2. Data Controller

The controller responsible for processing your personal data is:

Resolv – Digital Solutions e.U.
Owner: Stefan Schuh
Römerstraße 352
8232 Grafendorf bei Hartberg
Austria

Email: office@resolv.at
Website: resolv.at

Company Registration Number: FN 669692t
VAT Identification Number: ATU82794709

Please contact us using the details above for questions about this policy or to exercise your data protection rights.

3. Website Delivery, Hosting and Security

Our website uses Google Firebase and Google Cloud infrastructure for hosting and delivering website content. Cloud Firestore is used to provide published website content, including legal information.

For an Austrian billing address, Google identifies Google Cloud EMEA Limited, Ireland, as the contracting entity for Google Cloud and paid Firebase services, unless otherwise agreed. Google contracting entities.

When your browser connects to our website or its infrastructure, technical information is processed, including:

IP address;
date and time of access;
requested pages and resources;
browser and operating system information;
referring page, where transmitted;
response status, error information and security events.

We process this information to deliver the website, maintain availability, diagnose errors and prevent misuse or unauthorized access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of our website and the protection of our systems.

Retention: Ordinary website access and diagnostic logs are retained for up to 30 days. Relevant records may be retained longer where necessary to investigate a specific security incident or establish, exercise or defend legal claims.

Separate infrastructure audit logs may follow service-specific retention periods. In particular, Google Cloud retains logs in its mandatory _Required audit bucket for 400 days; this is distinct from ordinary website access logging. Google Cloud log retention.

Further information is available in Firebase’s privacy and security information.

4. Contact and Business Inquiries

When you contact us by email or through our contact form, we process the information you provide. This may include your name, email address, company, selected area of interest, message content and any attachments or additional contact details.

We use this information to respond to your inquiry, clarify requirements, prepare proposals and manage the resulting business relationship.

The legal basis is:

Article 6(1)(b) GDPR where processing is necessary for a contract with you or steps you request before entering into a contract;
Article 6(1)(f) GDPR for other inquiries, including communication with representatives of business customers. Our legitimate interest is responding to requests and maintaining business relationships;
Article 6(1)(c) GDPR where statutory obligations require further processing or retention.

We use Microsoft 365, including Exchange Online, for email communication and associated business correspondence. Microsoft processes relevant email content, attachments, contact details and technical delivery information as part of providing these services. The applicable processing terms are described in the Microsoft Products and Services Data Protection Addendum.

Retention: General inquiries that do not result in a contractual relationship are deleted within six months after the inquiry is closed, unless a legal obligation or a specific legal claim requires longer retention.

Correspondence that becomes part of a contractual relationship is retained for the relevant contractual purpose and applicable statutory periods.

Providing information is voluntary. However, we cannot respond to your inquiry without sufficient contact information and details about your request. Required form fields are identified accordingly.

Acknowledging that you have read this Privacy Policy does not constitute consent to marketing.

5. Contact Form Protection

Our contact form uses validation, a hidden spam detection field and request rate limiting to reduce automated submissions and misuse.

For this purpose, the system processes submitted form values and temporarily uses the requesting IP address to identify repeated requests.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the website and our communication channels against spam and abuse.

This processing does not serve advertising or cross-website tracking.

6. Job Applications

When you submit a job application, we process the information you provide, such as:

name and contact details;
CV, qualifications and employment history;
cover letter and supporting documents;
correspondence and assessment information arising during recruitment.

We use this information to assess your suitability and conduct the recruitment process.

The legal basis is Article 6(1)(b) GDPR for steps taken at your request before entering into an employment contract. Retention needed to defend against potential legal claims is based on Article 6(1)(f) GDPR, reflecting our legitimate interest in documenting a lawful recruitment process.

Application information is accessible only to persons involved in recruitment and service providers supporting the relevant communication and storage.

Retention: Unsuccessful applications are deleted within seven months after rejection or closure of the recruitment process. Unsolicited applications that do not lead to an active recruitment process are deleted within seven months after receipt.

Longer retention may be necessary in connection with a specific legal dispute. If you are hired, information necessary for the employment relationship is transferred to your personnel records and becomes subject to the applicable employee privacy information.

Retention for future vacancies requires a separate, voluntary agreement specifying the retention period. Any consent given for this purpose may be withdrawn at any time.

7. Cookies, Browser Storage and Analytics

The current website does not use Google Analytics, advertising pixels or other optional services for tracking visitors across websites.

Technical cookies or comparable browser storage may be used where necessary to provide a service expressly requested by you, particularly authentication and session management in the restricted administration area.

Access to or storage of information on your device is governed by Section 165(3) of the Austrian Telecommunications Act 2021. Necessary technologies may be used under the statutory exception; optional technologies requiring consent will only be activated after that consent has been obtained. Section 165 TKG 2021.

Any associated processing of personal data is based on the legal basis applicable to the relevant function, particularly Article 6(1)(f) GDPR for secure administration.

You can delete or restrict cookies and browser storage through your browser settings. Doing so may affect functions that depend on them.

8. Restricted Administration Area

Authorized administrators sign in using Microsoft business accounts through Firebase Authentication.

This involves processing account identifiers, name and email address where provided by the identity provider, authentication tokens, access permissions and relevant security information.

The purpose is to authenticate authorized users, enforce access restrictions and protect website administration.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is securely managing website content and preventing unauthorized access.

Authentication and account information is retained for as long as the relevant administrative access is required. Session information may remain in browser storage until sign-out, expiration or deletion, depending on the authentication mechanism.

9. Recipients and International Transfers

Where necessary for the purposes described above, personal data may be accessed by:

Google, for Firebase and cloud infrastructure;
Microsoft, for email, business communication and administrator authentication;
authorized IT support providers;
professional advisers, courts or public authorities where necessary or legally required.

Service providers acting on our behalf are subject to the applicable data processing arrangements under Article 28 GDPR.

Use of international cloud services can involve processing outside the European Economic Area, including in the United States. Selecting a European hosting region does not necessarily exclude international processing for support, security or service operation.

International transfers must be covered by an applicable mechanism under Chapter V GDPR, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, with supplementary safeguards where required. Google’s contractual safeguards are described in its Cloud Data Processing Addendum; Microsoft’s safeguards are described in its Data Protection Addendum.

You may contact us for further information about applicable safeguards and to request a copy, subject to necessary redactions protecting confidential information or the rights of others.

10. Retention and Deletion

The specific periods stated above apply unless another legal requirement or a documented need relating to a particular legal claim justifies longer retention.

Accounting records, invoices and tax-relevant business correspondence are generally retained for seven years from the end of the relevant calendar year. Longer statutory periods or pending proceedings may require extended retention. Austrian statutory retention information.

Where continued retention is required, access and use are restricted to the relevant purpose. Personal data is otherwise deleted or irreversibly anonymized when no longer required.

11. External Links and Product Platforms

Our website links to external websites and platforms, including Resolv Nexus, UNBROKEN and Eventox.

Following a link establishes a connection to the destination website. Its operator may then process personal data under its own privacy notice.

Additional service-specific privacy information applies where a linked platform is operated by Resolv. The processing associated with using those platforms is outside the scope of this corporate website policy.

12. Your Rights

Subject to the conditions of the GDPR, you have the right to:

access your personal data under Article 15;
obtain rectification under Article 16;
request erasure under Article 17;
request restriction of processing under Article 18;
receive or transfer eligible data under Article 20;
object to processing under Article 21.

Where processing is based on our legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims.

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise your rights, contact office@resolv.at. We may request information reasonably necessary to verify your identity.

You may also lodge a complaint with a competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the alleged infringement.

In Austria:

Austrian Data Protection Authority — Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna, Austria
Email: dsb@dsb.gv.at
Website: dsb.gv.at

The authority publishes its current contact information here.

13. Automated Decisions

We do not use personal data collected through this website for solely automated decisions, including profiling, that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.

14. Changes to This Policy

We update this Privacy Policy when our processing activities or applicable requirements change. The current version is available on this website, with its revision date stated above.

Where a change requires additional information or consent, we will provide that information or request consent before the relevant processing begins.