Privacy Policy

1. Controller

TRADEMAX SOLUTIONS GmbH (Piano Shift)
Stolberggasse 1-3/14
1050 Wien
Austria
Phone: +43 1 523 37 88 99
E-Mail: info@piano-shift.com
Company register number: FN 652383 m, Commercial Court of Vienna

Please send privacy requests to the e-mail address above or by post to the address given.

No data protection officer has been appointed.

2. Overview

We process personal data only as far as necessary to operate this website and to handle your requests: when you visit the website, when you calculate a price, when you send a quote or contact request (including photos) and, only with your consent, for web analytics. We do not sell data, we do not use advertising trackers and we make no automated decisions within the meaning of Art. 22 GDPR.

3. Visiting the website, hosting and security

The website runs on a server of Hetzner Online GmbH (Gunzenhausen, Germany; data centre Nuremberg). Cloudflare (Cloudflare, Inc., USA) sits in front of the server as reverse proxy, CDN and security service: the connection is terminated at Cloudflare, so Cloudflare processes every request to the website, including the contents of the forms you submit.

Every visit processes technically necessary data and stores it in the access log: the full IP address, time, method and requested address including the query string, status code and response size. Faulty or abusive requests are additionally recorded in a security log, with the IP address (for IPv6 only the /64 network), time, event type, requested endpoint and reason. The request limiting (below) also works with the IP address (for IPv6 only the /64 network).

To protect against abuse we limit the number of requests per IP address (for IPv6 per /64 network) and temporarily block conspicuous addresses (each block lasts 24 hours at most). The counters, blocks and the last 1000 security events are held in memory only and are lost when the server restarts.

Server logs stay on our server (Hetzner, Germany) and are not forwarded elsewhere. They are capped at 30 MB per service, the oldest entries are overwritten continuously, and all logs of a service are deleted when its container is replaced (for example on an update).

We do not write the contents of your forms (name, contact details, addresses, message) to the server logs. If e-mail delivery or other processing fails, only technical error identifiers and our internal request number are logged.

Purpose and legal basis: operation, security and abuse prevention, i.e. our legitimate interest (Art. 6(1)(f) GDPR).

4. Price calculator and distance calculation

As soon as you have entered a formally valid start and destination address in the price calculator, the distance is calculated automatically, without you pressing a button. For this our server converts the address text into coordinates and calculates the driving distance from them. Both are done by our own services (Photon and OSRM) on our server at Hetzner, based on OpenStreetMap map data (© OpenStreetMap contributors, ODbL). The addresses are not transmitted to any other provider for this, and your browser does not contact any further service for it.

Addresses and calculated distances are cached in the server memory until the server restarts; at most the last 5000 address pairs (distances) and the last 5000 single addresses (coordinates) are kept.

When you move from the price calculator to the quote request, the calculator stores your entries (instrument, addresses, floors, preferred date and time, price) in your browser's session storage (entry quote-handover) so the quote form can take them over. The entries are not passed in the page address and are only sent to our server when you submit the request. The entry is deleted as soon as the quote form has taken over the values, and at the latest when you close the tab or browser window.

Legal basis: Art. 6(1)(b) GDPR (price information requested by you), additionally Art. 6(1)(f) GDPR (operation and security).

5. Quote request

For the quote request we need first and last name, e-mail address, phone number, instrument type and start and destination address. Floors, preferred date and time, message and photos are optional. Without the mandatory details we cannot prepare an offer.

The details are stored in our database on the server at Hetzner (together with the calculated price and the distance), sent to us by e-mail and sent to you as a confirmation by e-mail (section 8). The distance is calculated on our own server as described in section 4.

The price shown is calculated automatically. It is a non-binding estimate (see GTC), not an automated decision within the meaning of Art. 22 GDPR.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request). Retention: see section 13.

6. Photos for your quote request

You upload photos voluntarily (up to 5 images in JPEG, PNG or WebP format, 10 MB each) so that we can prepare the offer more accurately. On upload every image is re-encoded and stripped of all metadata, including GPS data. Please do not photograph people.

The photos are stored on our server only, are not published and are not sent by e-mail. Our e-mail notification contains only a secret link, which appears only in that notification and with which we view the photos on our server; the link stops working once the photos are deleted. The original file name is stored with the photo. The photos are not part of the backups.

Deletion: 90 days after your request or, if later, 90 days after your preferred date, but no later than 455 days after the request, in each case within one day after expiry (deletion runs daily). Photos that do not belong to a request (for example because you did not submit the request) are deleted after 24 hours, within one day after expiry.

Legal basis: Art. 6(1)(b) GDPR.

7. Contact form, e-mail, phone and WhatsApp

The details in the contact form (name, e-mail address and phone number, and optionally instrument type, addresses, preferred date, message) are not stored in a database but only sent to us by e-mail; you receive a confirmation by e-mail (section 8). The same applies if you write to us by e-mail or call us directly: we use your details to answer your enquiry.

WhatsApp: only when you click the WhatsApp button does WhatsApp open (WhatsApp Ireland Ltd., Dublin, part of Meta). From then on their terms of use and privacy policy apply. We use the chat only to answer your enquiry.

Legal basis: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR (answering general enquiries).

8. E-mail delivery

The notification to us and the confirmation to you are sent via IONOS SE (Montabaur, Germany) and processed in the mailboxes there. IONOS is our processor. The notification to us contains all details from the form, but no photos, only a secret link to our server if photos were uploaded (section 6). The confirmation to you contains only the request number, instrument type and price.

9. Cookies and local storage

Under § 165(3) of the Austrian Telecommunications Act 2021 we use technically necessary cookies and storage entries without consent; analytics cookies are only set with your consent.

10. Web analytics with Google Analytics 4

We use Google Analytics 4 of Google Ireland Limited (Dublin, Ireland) to understand how the website is used. Among other things we measure pages visited (with the full page address), use of the price calculator (instrument type, kilometres and price) and clicks on phone and WhatsApp. According to Google, Google Analytics 4 does not store IP addresses. Advertising features and ad signals are disabled. The data may be transmitted to Google LLC in the USA (section 12).

Google Analytics is only loaded once you have chosen “Accept” in the banner. As long as you have not agreed, or if you decline, the Google script is not loaded and no data is transmitted to Google. The legal basis is solely your consent (Art. 6(1)(a) GDPR and § 165(3) Austrian Telecommunications Act 2021).

After you agree, Google Analytics sets the cookies _ga and _ga_2Q8ETJNM6G (2 years), which allow visits to be recognised across sessions. Your decision is stored in your browser (local storage, entry cookie-consent), so measurement continues on later visits without asking again.

Withdrawal: you can withdraw your consent at any time with effect for the future, as easily as you gave it: via the “Cookie settings” link in the footer of every page or here: Cookie settings. This deletes your stored decision, removes the Google Analytics cookies (_ga, _ga_2Q8ETJNM6G), Google Analytics then stops sending data and is no longer loaded on further page views, and the banner is shown again. Alternatively, you can delete the site data (cookies and local storage) of piano-shift.com in your browser. The lawfulness of the processing carried out until then is not affected.

The data is kept in Google Analytics for 2 months. More: policies.google.com/privacy

11. Recipients and processors

In addition we disclose data to authorities and courts where we are legally obliged to do so.

12. Transfers to third countries

Cloudflare, Inc. and Google LLC are based in the USA. The transfer relies on the European Commission adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and, as a fallback, on standard contractual clauses (Art. 46 GDPR). All other recipients are based in the EU.

13. Retention

We keep invoices and other documents relating to an order placed with us (including the related correspondence) in our accounting for 7 years from the end of the calendar year pursuant to § 132 of the Austrian Federal Fiscal Code (BAO).

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of legitimate interests (Art. 6(1)(f)), you may object to the processing on grounds relating to your particular situation (Art. 21). You can withdraw consent you have given at any time (Art. 7(3), see section 10).

To exercise your rights, a message to the e-mail address or postal address given in section 1 is sufficient.

15. Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority:

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Wien
E-Mail: dsb@dsb.gv.at
www.dsb.gv.at

16. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The price calculator only provides a non-binding estimate.

17. Changes

We update this privacy policy when the website or the processing changes. The date of the last change is given below.