Legal

Privacy Policy

This privacy policy applies to this website (leoflex.io). The processing of personal data within the LeoFlex product (sign-in to and use of the app at app.leoflex.io) is governed by a separate privacy policy within the product.

1. Controller

NEO Digital – Erich Nigg
Nordweg 14
8010 Graz, Austria
E-mail: support@leoflex.io

Controller within the meaning of the GDPR and the Austrian Data Protection Act (DSG).

2. Principles

We process personal data only to the extent necessary and on the basis of the GDPR. Unless expressly stated otherwise, your data is processed exclusively in the EU: hosting at IONOS (Berlin), AI features via an EU router (Requesty) and Microsoft Azure (EU region). Where, in individual cases, a transfer to a third country takes place (only with consent-based analytics/marketing services, see sections 7 and 8), it is based solely on appropriate safeguards (adequacy decision, in particular the EU-US Data Privacy Framework, or EU Standard Contractual Clauses).

3. Hosting (IONOS)

This website is hosted by IONOS SE (Germany); the server location is Berlin (Germany, EU). When you access the site, technically necessary server log files are processed (IP address, date/time, file requested, volume of data transferred, browser/operating system, referrer) for delivery, stability and security of the website. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with IONOS.

4. Contact requests (form, Leo chat, e-mail)

We use data from the contact form, Leo chat and e-mail (e.g. name, e-mail address, company, message) exclusively to process your request. Legal basis: consent (Art. 6(1)(a) GDPR) or pre-contractual measures (lit. b). To protect against spam we use a data-minimising, self-hosted method (ALTCHA) that works without tracking. Transmission and storage take place within the EU (recipient: support@leoflex.io). The data is deleted once it is no longer required, at the latest after statutory retention periods expire.

5. Newsletter (Brevo)

If you subscribe to our newsletter, we process your e-mail address and, as proof of consent, the time of sign-up/confirmation and the IP address. Sign-up uses the double opt-in procedure: you receive a confirmation e-mail and are only added to the list after clicking the confirmation link. Legal basis: your consent (Art. 6(1)(a) GDPR). Sending and management are handled by Brevo (Brevo SAS, Paris, France, EU) as a processor (Art. 28 GDPR). You can unsubscribe at any time via the unsubscribe link in every mailing or by contacting us; the withdrawal takes effect for the future.

6. AI chat "Leo"

The website offers an AI chat ("Leo") that is loaded only after your consent ("Functional" category). Your input is processed to answer your enquiry. Processing takes place via an EU router (Requesty, EU region) and a language model on Microsoft Azure in an EU region with European data residency. Please do not enter sensitive personal data in the chat. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the cookie settings.

7. Cookies & local storage

We use technically necessary cookies without consent; all further services are activated only after your consent via the consent banner.

  • Necessary: lf_session (session, duration: session), lf_consent (stores your cookie choice, 6 months).
  • Functional: leo_chat (AI assistant "Leo", 30 days, Requesty EU router / Microsoft Azure EU region), lf_lang (language setting DE/EN, 1 year).
  • Statistics (only with consent): _ga, _ga_* (Google Analytics 4, Google Ireland Ltd., 14 months, transfer to the USA possible), _clck, _clsk, MUID (Microsoft Clarity, Microsoft Ireland Operations Ltd., 13 months, transfer to the USA possible).
  • Marketing (only with consent): _gcl_au (Google Ads, Google Ireland Ltd., 90 days) – active, with a possible transfer to the USA. Prepared, currently not active: _fbp, fr (Meta Pixel, Meta Platforms Ireland Ltd., 90 days).

You can change or withdraw your choice anytime via "Cookie settings" in the footer. Details: Cookie Policy.

8. Web analytics & marketing (consent-based)

If you consent, we use services for reach measurement and remarketing. Of the marketing services, Google Ads is active (only after consent); Meta Pixel is prepared, currently not active. These services are not loaded without your consent and set no cookies without consent. Legal basis: consent (Art. 6(1)(a) GDPR; § 165(3) Austrian Telecommunications Act 2021).

  • Statistics: Google Analytics 4 (Google Ireland Ltd.) and Microsoft Clarity (Microsoft Ireland Operations Ltd.) for reach and usage measurement.
  • Marketing: Google Ads (Google Ireland Ltd.) – active, only after consent – for conversion measurement and remarketing. Meta Pixel (Meta Platforms Ireland Ltd.) is prepared, currently not active.

This may involve a transfer of data to Google, Microsoft or Meta in the USA; such transfers are safeguarded by the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses. The Cookie Policy shows which services are actually active.

9. Recipients / processors

We only pass data to processors with whom an agreement under Art. 28 GDPR is in place:

  • IONOS SE (Berlin, Germany) – website hosting.
  • Brevo (Brevo SAS) (Paris, France) – newsletter delivery with double opt-in.
  • Requesty (EU router) and Microsoft Azure (EU region) – operation of the "Leo" AI chat.
  • Google Ireland Ltd. – Google Analytics 4 and Google Ads, only after consent (third-country risk USA).
  • Microsoft Ireland Operations Ltd. – Microsoft Clarity, only after consent (third-country risk USA).

No data is passed on for other purposes.

10. Retention periods

We store personal data only as long as required for the stated purposes: server log files are deleted automatically after a short period; contact requests after final processing, at the latest after statutory retention periods expire; newsletter data until consent is withdrawn; cookie lifetimes see section 7.

11. Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection, as well as to withdraw consent given. Please contact support@leoflex.io. Complaints can be addressed to the Austrian Data Protection Authority (https://www.dsb.gv.at).

12. Contact for data protection matters

support@leoflex.io · NEO Digital – Erich Nigg, Nordweg 14, 8010 Graz.

Last updated: July 2026