Privacy Policy

NexGen IT-Security GmbH, Liechtensteinklammstraße 60, 5600 St. Johann im Pongau, Austria

E-mail: office@nexgen-itsec.com, phone: +43 670 350 1599

We are not legally required to appoint a data protection officer and have not done so. For all data protection questions, please contact us at the e-mail address above.

We only collect the data required for the respective purpose (data minimisation). This website uses no analytics, tracking or advertising services, no social media plugins and no externally loaded fonts, scripts or videos. All content is served from our own server, and all transmissions are encrypted with TLS.

When you visit the website, our server processes technically necessary data: IP address, date and time, requested address, HTTP status code, amount of data transferred, referrer, and browser and operating system identification.

Purpose: delivering the website, ensuring stability and security, detecting and preventing attacks (e.g. limiting excessive requests).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the website).

Retention: server logs are deleted after 14 days unless they are needed longer to investigate a specific security incident.

The website is operated on infrastructure of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in data centres within the European Union. AWS acts as a processor pursuant to Art. 28 GDPR. Since its parent company is based in the USA, access from a third country cannot be completely ruled out; such access is safeguarded by the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework and by standard contractual clauses.

When you contact us, we process your details (name, company, e-mail address, optional phone number, topic and message) to handle your enquiry.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to entering into a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Recipients: for e-mail communication we use IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, as a processor.

Retention: enquiries are deleted six months after they have been fully answered, unless a contractual relationship results from them or statutory retention obligations apply.

To protect against automated spam submissions, we use an invisible check field and a minimum completion time. No external services are used for this.

To provide an evaluation or a licence we process: company, contact person, business e-mail address, country, optional VAT number, chosen edition, licence and order data, the accepted version of the contract terms, and order timestamps.

Purpose: concluding and performing the contract, issuing the licence, sending the download link, invoicing, support.

Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations).

Retention: order and invoice data are retained for seven years from the end of the calendar year pursuant to § 132 Federal Fiscal Code (BAO) and § 212 UGB, and beyond that for as long as necessary to assert or defend claims. Data of expired evaluations without a subsequent purchase is deleted twelve months after expiry.

Licence payments are processed by Stripe: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details (e.g. card data) exclusively with Stripe; we do not receive them. From Stripe we only receive confirmation of the payment, the amount, the currency and a payment reference.

Legal basis: Art. 6(1)(b) GDPR. Stripe partly processes data as an independent controller, in particular for fraud prevention and to comply with legal obligations. Transfers to Stripe, Inc. in the USA are based on the EU-U.S. Data Privacy Framework or standard contractual clauses. More information: stripe.com/privacy.

AI Prompt Shield is downloaded via personal, time-limited links. To prevent misuse and ensure traceability, we log access to these links with the order and licence reference, time, result and a truncated IP address (the last part is removed). Only a hash value of the download link is stored on our server.

Legal basis: Art. 6(1)(b) and (f) GDPR (performance of contract; legitimate interest in secure software delivery).

Retention: twelve months.

We only use one technically necessary session cookie, and only on pages that contain a form (protection against cross-site request forgery, ordering). The legal basis is § 165(3) TKG 2021 in conjunction with Art. 6(1)(f) GDPR; no consent is required. Details are available under Cookie Settings.

Personal data is transferred to countries outside the European Economic Area only in the cases described above and only where an adequacy decision of the European Commission or appropriate safeguards pursuant to Art. 46 GDPR (standard contractual clauses) are in place.

AI Prompt Shield is operated in our customers’ infrastructure (on-premises). Checked requests, policies and logs remain with the customer; the software does not transmit request content to NexGen. The respective customer is the controller for processing in the context of using AI Prompt Shield. Where we obtain access to personal data in the course of support services, we conclude a data processing agreement with the customer pursuant to Art. 28 GDPR.

We implement appropriate technical and organisational measures pursuant to Art. 32 GDPR, including end-to-end transport encryption, a strict Content Security Policy, protection against cross-site request forgery and cross-site scripting, request rate limiting, least privilege on the server, storing access tokens only as hash values, and logged and secured payment confirmation.

In principle, you have the following rights:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR), unless retention obligations apply
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply send a message to office@nexgen-itsec.com. We will respond within one month.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. We would appreciate it if you contacted us first.

You are neither legally nor contractually obliged to provide your data. Without the details marked as mandatory in the form, however, we cannot process your enquiry or order. There is no automated decision-making, including profiling, pursuant to Art. 22 GDPR.

We update this privacy policy when our processing activities or the legal situation change. The version published on this page applies.