Privacy Policy
Last revised: October 2026 • Valid for Licencify FlexCo (Austria)
1. Identity of the Controller
The Data Controller responsible for the processing of personal data on this website and within our business operations pursuant to Art. 4 No. 7 of the General Data Protection Regulation (GDPR) is:
Managing Director: Patrick Thomschitz
Vienna, Austria
Company Registration Number: FN 688269k
Commercial Register Court: Commercial Court of Vienna
Email: office@licencify.io
Website: https://licencify.io
For any inquiries, requests regarding your statutory rights, or data protection concerns, please contact us directly at the email addresses listed above.
2. Scope & Privacy by Design Commitment
This Privacy Policy governs the processing of personal data when you visit our public website (licencify.io), submit inquiry or demo forms, communicate with our team, or evaluate our platform.
As an enterprise License Intelligence provider, data minimization and privacy-by-design (Art. 25 GDPR) are foundational to our architecture. We strictly distinguish between:
- Website Visitors & Inquiries: Processing of contact details and usage metrics to respond to requests and optimize platform presentations (covered in Sections 3 through 9).
- Enterprise Database Discovery (Local Gateway):Our software connects strictly in read-only mode to technical system dictionaries. All hostnames and IPs are pseudonymized locally inside the client's perimeter before transfer; no production tables, personal application data, or user passwords ever leave customer networks (detailed in Section 10).
3. Web Server Log Files & Technical Hosting
When accessing our website, our web servers automatically record technical connection data transmitted by your browser. These server log files contain:
- IP address of the accessing client device
- Date and exact time of the server request
- Name and URL of the retrieved resource/file
- HTTP status code and volume of transmitted bytes
- Referrer URL (the previous page from which you accessed our site)
- Browser type, software version, language settings, and operating system
Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interest). Our legitimate interest lies in the technical delivery of the website, system security, DDoS defense, failure diagnostics, and the prevention of fraudulent access attempts.
Storage & Retention: Server log data is stored on secure European servers and is automatically rotated and purged within 14 days, unless a security incident requires evidentiary retention until the matter is resolved.
4. Cookies, Local Storage & Consent Management
Our website uses modern browser storage mechanisms, including cookies and HTML5 local storage (localStorage), to ensure website functionality and to respect your privacy preferences.
Strictly Necessary Technical Storage
We store your cookie consent preference locally in your browser (key: licencify_cookie_consent). This entry prevents the consent banner from displaying on every single page view. Because this storage is strictly required to fulfill your choice and operate the site securely, it does not require prior consent under the Austrian Telecommunications Act and Art. 6(1)(f) GDPR.
Analytics & Performance Cookies (Optional, Requires Consent)
Non-essential analytics cookies (Google Analytics 4) are completely blocked by default until you grant explicit consent via our cookie banner.
Legal Basis: Art. 6(1)(a) GDPR and the Austrian Telecommunications Act (Consent).
You can reopen our consent manager at any point to accept or decline analytics cookies.
5. Web Analytics: Google Analytics 4 (Consent Mode v2)
Subject to your prior affirmative consent pursuant to Art. 6(1)(a) GDPR, our website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
Google Consent Mode v2: We have implemented Google Consent Mode v2 with default-denied parameters (analytics_storage: 'denied'). Prior to user interaction with our cookie banner, no personal tracking cookies are placed and no advertising identifiers are activated.
IP Masking / Anonymization: In Google Analytics 4, IP addresses are processed automatically with IP anonymization enabled. Your IP address is truncated within Member States of the European Union or other contracting states to the Agreement on the European Economic Area before transmission to external Google endpoints.
International Data Transfers: In certain instances, statistical data collected by Google may be transferred to and stored on servers of Google LLC located in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF), providing an adequate level of data protection recognized by the European Commission pursuant to Art. 45 GDPR. In addition, European Commission Standard Contractual Clauses (SCCs) under Art. 46 GDPR are contractually agreed with Google.
Revocation & Browser Opt-Out: You can revoke your consent at any time via the button in Section 4. Alternatively, you may install the official Google Analytics Opt-out Browser Add-on available at: https://tools.google.com/dlpage/gaoptout.
6. Local Typography & Font Hosting (No External Requests)
To render text consistently and efficiently while protecting user privacy, our website uses fonts (including Montserrat) bundled locally via Next.js Font Optimization (next/font).
The font binary files are downloaded and served directly from our own European hosting environment. No HTTP connections are made to Google Font servers during your page visit, and your IP address is never transmitted to external typography providers.
7. Contact Inquiries, Lead Forms & Demo Requests
When you contact us via our contact forms, book an enterprise demo, request a licensing assessment, or register for whitepapers, we collect the following categories of information:
- First Name and Last Name
- Corporate Work Email Address
- Company / Organization Name
- Estimated Database Counts & Virtualization Environment Scope
- Optional project context, messaging notes, or event follow-up details
Purpose of Processing: We process this data exclusively to verify enterprise eligibility, respond to your inquiries, deliver requested documentation, and coordinate customized demonstrations or architecture reviews.
Legal Bases:
- Art. 6(1)(b) GDPR: For handling inquiries aimed at taking steps prior to entering into a contract, or fulfilling pre-contractual evaluations requested by you.
- Art. 6(1)(f) GDPR: Legitimate interest in conducting professional business communications with enterprise prospects and ensuring prompt client support.
Retention Periods: Information submitted via contact or demo forms is retained for the duration of the pre-contractual evaluation. If no ongoing contractual agreement or business relationship develops, records are routinely deleted after 12 months, unless you give explicit consent for continued contact or statutory record-keeping duties apply. If a commercial contract is concluded, billing-relevant records are retained for seven years in compliance with statutory Austrian commercial and tax law (§ 212 Austrian Commercial Code, § 132 Austrian Federal Fiscal Code).
8. Transactional Communications (Microsoft Graph API & Bookings)
To dispatch transactional inquiry confirmations and internal notifications reliably, we utilize Microsoft 365 cloud services operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Microsoft Graph API: When a demo or contact form is submitted, transactional messages are routed via encrypted HTTPS calls to the Microsoft Graph API. Microsoft acts as a Data Processor pursuant to Art. 28 GDPR under a strict Data Protection Addendum (DPA) and Standard Contractual Clauses (SCCs).
Microsoft Bookings:If you choose to schedule a direct consultation slot via our Microsoft Bookings calendar integration, you are directed to Microsoft's scheduling interface to select a meeting time. The appointment details are processed strictly to coordinate the technical session.
Legal Basis: Art. 6(1)(b) GDPR (Pre-contractual communication) and Art. 6(1)(f) GDPR (Efficient business coordination).
9. Database Infrastructure & EU Hosting
Form inquiries and website data are stored in encrypted relational databases hosted in ISO 27001-certified European data centers. All data storage is maintained strictly within the territorial scope of the European Union / European Economic Area.
Sub-processor Governance: Cloud database and hosting infrastructure providers are bound by Data Processing Agreements in compliance with Art. 28 GDPR. We do not sell, lease, or transfer your contact data to third-party database vendors or commercial data brokers.
10. Enterprise Platform Security: The Local Gateway Guarantee
Organizations evaluating or operating the Licencify License Intelligence platform benefit from our proprietary, security-isolated architecture:
- Zero Production Agents: No binary agents, daemons, or kernel modules are installed on production database nodes or virtual hosts.
- Read-Only System Queries: The Local Gateway connector executes solely read-only queries against system dictionary tables (such as
V$PARAMETERor vCenter hardware topologies). - Perimeter-Level Pseudonymization:IP addresses, server hostnames, internal database names, and user identifiers are scrubbed or cryptographically hashed inside the customer's perimeter before outbound transmission.
- Zero Raw Business Data: Customer tables, records, passwords, database content, and business transactions are mathematically inaccessible to the Gateway and are never uploaded.
- Outbound-Only TLS 1.3: Communications utilize strictly outbound-initiated TLS 1.3 connections, requiring no open incoming firewall ports.
- Art. 28 GDPR Data Processing Agreement (DPA): Commercial customer deployments are formalized with a tailored Data Processing Agreement that clearly defines technical and organizational security measures (TOMs).
11. Technical and Organizational Security Measures (Art. 32 GDPR)
Licencify implements state-of-the-art technical and organizational measures (TOMs) to safeguard personal data against accidental loss, unauthorized access, destruction, and tampering:
- Full HTTPS encryption using TLS 1.3 across all website endpoints
- Network segmentation, strict firewall policies, and role-based access control (RBAC)
- Zero hardcoded credentials and encrypted storage of runtime secrets
- Automated dependency vulnerability audits and continuous patching
12. Your Statutory Rights under GDPR
As a data subject under the GDPR and the Austrian Data Protection Act, you are entitled to the following statutory rights free of charge:
To exercise any of your statutory rights, please send an informal email stating your request to: office@licencify.io.
13. Right to Lodge a Complaint with the Supervisory Authority (Art. 77 GDPR)
Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
E-Mail: dsb@dsb.gv.at
Official Website: https://www.dsb.gv.at
14. Automated Decision-Making & Profiling (Art. 22 GDPR)
We do not use automated decision-making or profiling mechanisms that produce legal effects concerning you or similarly significantly affect you.
15. Status and Amendments
We reserve the right to amend this Privacy Policy to reflect changing legal requirements, technical improvements, or updates to our service portfolio. The current version published on this page is authoritative.