Privacy Policy

Last updated: 30 October 2026 · Deutsch

This policy explains the processing of personal data in connection with our website, software and customer service. It covers Zip-Share, iTaskX, iMeetingX, InvoiceRenamer and ShareManager. The functions described below apply only where available in your product version and used.

The website and apps are separate: Google Analytics, Google Ads and the Meta Pixel, including advanced matching, are used only on the website, not in our software products. Using an app does not constitute consent to website tracking.

1. Controller and privacy contact

Techno-Grafik Christian Lackner e.U.
Weißenwolffstraße 14, 4221 Steyregg, Austria
Telephone: +43 732 640571
Email: info@techno-grafik.at

Christian Lackner is the contact person for privacy matters. Please send privacy enquiries and requests to exercise your rights to the email address above.

2. Purposes and legal bases

We process data to provide agreed software functions, respond to enquiries and perform contracts (Article 6(1)(b) GDPR), to fulfil legal obligations, particularly accounting obligations (point (c)), and to operate our services securely and establish, exercise or defend claims where necessary (point (f)). For business customers' contact persons, business communications are based on our legitimate interest in performing the contract with the organisation. Website analytics and advertising requiring consent rely on your consent (point (a) and section 165(3) of the Austrian Telecommunications Act 2021).

Contract and contact information is required where we cannot fulfil an order or answer an enquiry without it. Additional information, support attachments and consent to analytics or advertising are voluntary. Basic website functions remain available without such consent.

3. Processing within our applications

The content processed by an app depends on your files, settings and chosen functions. Installing an app does not, by itself, send us its documents. If files are saved in a cloud or network folder you select, or sent through another application, your chosen providers and recipients are also involved.

Zip-Share: selected files, names, folder structures, archive and preset settings, and any saved archive passwords. Sharing transfers selected content to your chosen app, service or recipient. A password does not automatically conceal the file and folder names visible within a ZIP archive.
iTaskX: project plans, including tasks, resources, dates, names and other project information entered by the user.
iMeetingX: meetings, participants, tasks, minutes and other content entered by the user.
InvoiceRenamer: selected invoices and documents, recognised information, company details, naming rules and filing settings. Configured iCloud synchronisation of the company list transfers that list's data, not invoice files or local folder permissions. A shared filing or synchronisation folder configured by the user is a separate mechanism.
ShareManager: configured network shares, server and path details, connection and deployment settings, and technical states. Connections to network shares, VPN services or deployment sources use the endpoints configured by you or your organisation.

For other people's personal data that you process independently using our software, you or your organisation determine the purposes, permissions and retention. This does not automatically give Techno-Grafik access. If you send us such content for support, section 6 applies.

4. iCloud, synchronisation and sharing

When iCloud functions are enabled, the data intended for synchronisation is processed through Apple iCloud or CloudKit. Depending on the app, this includes presets or company lists and technical record and account associations. Synchronisation may result from an enabled default setting; check the relevant app option. Disabling synchronisation does not automatically delete existing cloud data.

In Zip-Share, presets including saved archive passwords can be synchronised through iCloud and made available to authorised people through preset sharing. Preset exports also contain saved passwords. Share such presets deliberately. Revoking access later does not remove copies already saved by recipients or passwords they already know. Local folder permissions are configured on each device.

This processing provides the relevant synchronisation or sharing function. Apple's independently provided account and platform services are also subject to Apple's Privacy Policy. Cloud data and shared copies have a separate lifecycle: manage or delete them in the relevant apps and accounts and with recipients. Removing an app alone does not delete every copy.

5. Purchases, licences and updates

App Store: Apple handles purchases and payments. To unlock or restore access, the app processes purchase and entitlement evidence provided by Apple, such as product and transaction identifiers, purchase dates and trial, expiry or revocation status. We also receive the settlement and reporting information Apple makes available to providers. Purchases do not disclose your payment instruments or Apple Account password to us.

Direct sales invoiced by us: For individual licences we process company and contact details, billing address, VAT identification number where applicable, order, agreed licence scope and payment status. These support quotations, delivery, support and accounting. An individual contract may specify additional information needed to assign a licence; its terms govern.

Updates and downloads: Apple provides App Store updates. Versions with their own update checks, for example through Sparkle, contact the update source. This involves in particular IP address, time, requested resource and technically transmitted app/system information. Update checks support compatible and secure software; our regular server logs are subject to section 9. The app's settings govern automatic checks.

6. Support and diagnostic reports

When you contact us, we process your contact details, message, product and version information, and any files you choose to attach. Submitted diagnostic reports may include technical events, system information and text you add. Review reports and attachments before sending them and remove unnecessary personal data, passwords and confidential document content.

Website support email is processed through Microsoft 365, so messages and attachments are also processed by Microsoft as a service provider. Microsoft's Privacy Statement explains its own processing; processing our business communications on our behalf is governed by the applicable data processing terms. Creating a local diagnostic report does not, by itself, submit a support request to us. Operating-system diagnostics you have authorised Apple to receive are separately governed by Apple's settings and terms.

7. Website, hosting and essential technical data

We operate our website ourselves on infrastructure in a Telekom Austria data centre in Austria. Requests involve in particular IP address, time, requested page or file, HTTP status, browser/system information transmitted by the browser and, where provided, the referring page. This serves delivery, troubleshooting and protection against abuse, based on our legitimate interest in secure operations. We treat IP addresses as personal data, rather than describing them generally as anonymous.

Strictly necessary cookies or similar storage serve purposes such as form security and remembering your privacy choice. They are not required for advertising purposes. The web server's location does not mean that all external services described below process their data exclusively in Austria.

8. Website analytics, advertising and your choices

Analytics and marketing services are activated only after your prior voluntary consent. You may refuse and later change or withdraw your choice through the website's cookie settings. Withdrawal takes effect for the future and does not affect the lawfulness of earlier processing. Before consenting, the settings dialog provides information on the specific cookies, providers, purposes and lifetimes.

Google Analytics

Google Analytics provides statistical analysis of website use. Data may include visited pages, interactions, timestamps, device/browser information and online identifiers. The provider for the European region is Google Ireland Limited; other Google companies may be involved. Processing is based on your analytics consent. Further information: Google Privacy Policy and Analytics data retention.

Google Ads

Google Ads measures the effectiveness of our advertisements and, where covered by your selection, helps target advertising. Identifiers and cookies can associate advertising clicks with website actions. The provider is Google Ireland Limited, involving other Google companies. Processing is based on your marketing consent. Further information: Google advertising technologies.

Meta Pixel and advanced matching

The Meta Pixel from Meta Platforms Ireland Limited supports measurement and targeting of advertising on Meta services. Data may include page visits, events, IP address, browser information and identifiers. Advanced matching may additionally transmit contact details you provide, such as an email address or phone number, in hashed form to associate them with an account. Hashing is not anonymisation. This matching also requires your prior marketing consent.

For collection and transmission of the relevant event data, we and Meta are joint controllers to the extent covered by Meta's terms; Meta is responsible for its subsequent independent processing. The allocation of responsibilities, particularly Meta's responsibilities for data subject rights and security of this joint processing, is set out in the Joint Controller Addendum. You may also exercise your rights against us. See also the Meta Privacy Policy.

Advertising providers may use data for advertising profiling. We do not make solely automated decisions about you that produce legal or similarly significant effects. The website advertising services are not embedded in the apps listed above.

9. Retention and deletion

Regular web server logs: no more than seven days. For a specific security incident, necessary extracts may be kept separately for as long as investigation or legal action requires.
Additional support attachments: deleted within 30 days after the case closes, unless exceptionally required for a specific legal claim or obligation. This also covers operational copies in support mailboxes.
Other support correspondence: only as long as needed to handle the enquiry; where necessary to establish, exercise or defend claims, no more than three years after closure. Documents needed for proceedings already underway are retained until those proceedings end.
Invoices and tax-relevant records: generally seven years after the end of the relevant calendar year; longer where legally required or necessary for pending proceedings.
Licence assignment: for as long as necessary to fulfil the agreed usage rights, and thereafter only where legal obligations or specific claims require it.
Website analytics and advertising: cookie lifetimes are specified in the consent dialog. Retention of associated event and account data is distinct and depends on the purposes, retention settings and provider information applicable to each service. Consent records are retained only as long as evidence is required.
Local files, cloud data and backups: data you manage is subject to your settings and selected storage providers. Our operational backups follow a limited, purpose-related backup cycle. Deleted data is not restored for normal use; if restoration becomes necessary, deletions are reapplied.

10. Recipients and transfers outside the EEA

Access is limited to people and providers needed for the relevant purpose, such as infrastructure and IT support providers, Microsoft 365, tax advisers and banks involved in invoice payments. Other recipients include Apple for platform functions, your selected sharing recipients and, after consent, the named analytics and advertising providers. Authorities or courts receive data only on an appropriate legal basis. Processors are contractually bound; other recipients act within their own responsibilities.

International providers may process data outside the European Economic Area, particularly in the United States. Transfers initiated by us require a basis under Chapter V GDPR: an applicable adequacy decision or appropriate safeguards, particularly EU Standard Contractual Clauses with any necessary supplementary measures. A recipient's participation in an adequacy framework must cover the particular transfer. You can request information about the safeguards actually used, or a copy, from our privacy contact. General tracking consent does not replace this assessment.

11. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing, including related profiling, at any time without giving reasons.

Please contact info@techno-grafik.at. You may also complain to a supervisory authority, particularly in the country where you live or work. In Austria, this is the Austrian Data Protection Authority.

12. Changes

We update this policy to reflect actual changes in processing and legal requirements. A new policy version does not replace any required consent. Material changes will be brought to your attention in an appropriate way.