Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Matthias Bauernberger Software
Georg-Erber-Straße 10
4060 Leonding, Austria
Email: office@mbasoft.at
VAT ID: ATU64061446

2. Overview of Processing

We only process personal data to the extent necessary for the provision of our website and our services (Alfrodin Office Add-In and Alfrodin Web). Processing is carried out in accordance with the legal provisions of the GDPR and the Austrian Data Protection Act (DSG).

3. Types of Data Processed

We process the following categories of personal data:

• Usage data: Access times, pages visited, browser type, operating system
• Connection data: IP address, referrer URL
• Master data: Name, email address (only upon direct contact or account creation)
• Contract data: License data, billing information (for paid usage)
• Authentication data: Microsoft account information (when using Single Sign-On)
• License and sign-in data: license key, assignment of a license seat to an email address, sign-in code (only briefly)

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Art. 6(1)(a) GDPR - Consent: You have given your consent to the processing.
• Art. 6(1)(b) GDPR - Contract performance: Processing is necessary for the performance of a contract (e.g., provision of the add-in, licensing).
• Art. 6(1)(c) GDPR - Legal obligation: Processing is necessary for compliance with a legal obligation (e.g., tax retention requirements).
• Art. 6(1)(f) GDPR - Legitimate interest: Processing is necessary for the purposes of legitimate interests (e.g., security, abuse prevention).

5. Cookies and Local Storage

Our website does not set any cookies. There is no tracking and no advertising. Your language choice and, where applicable, the note that you have closed a product announcement are kept in your browser's local storage (localStorage). This storage is required to display the website in your language (Section 165(3) of the Austrian Telecommunications Act 2021, Art. 6(1)(f) GDPR) and does not require consent. The data remains in your browser, is not transmitted to our servers and can be deleted at any time via your browser settings. For sign-in, Alfrodin Web keeps a sign-in proof in your browser's local storage, see Section 9.

6. Hosting

Our website is hosted on servers within the European Union. The hosting provider processes access data (server log files) on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR. Server log files may contain the address and name of the pages accessed, date and time of access, data volumes transferred, the requesting provider, and browser type and version. This data is stored exclusively for security and error analysis purposes and is automatically deleted after no more than 30 days.

7. Microsoft Single Sign-On (SSO)

The Alfrodin Office Add-In offers the option to sign in with your Microsoft account (Single Sign-On). The Microsoft Authentication Library (MSAL) is used for this purpose. During sign-in, we receive the following data from Microsoft:

• Name and email address of your Microsoft account
• Tenant ID of your organization

This data is used exclusively for identification and license assignment. Authentication takes place directly between your browser and Microsoft - your credentials are never transmitted to our servers. The Microsoft Privacy Statement applies.

8. Alfresco Connection

The connection is established directly between your browser and your Alfresco Content Services server whenever your server permits it; in that case no documents, content, or credentials are routed through our servers. If a direct connection is not permitted by your server settings, requests are securely relayed through our service in transit only - we never store or retain your documents, content, or credentials, and we have no standing access to your Alfresco data. For a fully direct connection, your administrator can enable CORS for app.alfrodin.com (add-in) or web.alfrodin.com (Alfrodin Web) on your Alfresco server. See the manual →

9. Alfrodin Web: License Check at Sign-In

Before you sign in to your Alfresco server in Alfrodin Web (web.alfrodin.com), we check whether a license exists for your email address. You enter your email address and receive a sign-in code by email. In doing so, we process:

• Email address and, where applicable, license key, to find your license seat and to send the sign-in code. At the first sign-in with a license key, the seat is bound to your email address once the correct code has been entered. We store this assignment for the duration of the license.
• Sign-in code: six digits, valid for 15 minutes, at most five attempts. It is kept only in the memory of the license service and expires afterwards.
• IP address, to limit the number of requests and thus prevent misuse and the flooding of mailboxes. The counters are kept only in memory and expire after 15 minutes. Per email address we additionally count a non-reversible short value for up to 24 hours.
• Addresses of the Alfresco servers that the buyer of the license registers for their organization. Alfrodin Web connects only to these servers. We store them for the duration of the license.

After the correct code, Alfrodin Web keeps a signed sign-in proof, the addresses of the registered Alfresco servers and your email address in your browser's local storage, so that you do not need a code for every sign-in. The proof does not contain your email address. It is valid for 30 days from its last use and is removed when it expires, when the license no longer confirms it, or when you choose “Other email address”. This storage is strictly necessary for the sign-in you request (Section 165(3) of the Austrian Telecommunications Act 2021); you can delete it at any time in your browser settings. In the logs of the license service, your email address appears only as a non-reversible short value, and the sign-in code never appears.

Sending the sign-in code: We send the email with the code via Microsoft 365 (Exchange Online) of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as processor (Art. 28 GDPR). Microsoft processes your email address and the content of the message. We do not keep a copy of the message. Microsoft keeps delivery data (sender, recipient, time, delivery status) for up to 90 days for tracing. The email contains no tracking pixels; the logo is embedded, and opening it loads nothing from the internet.

Test accesses: For a test access without purchase, we store the company name, the contact address, the enabled email addresses and the addresses of the Alfresco servers. We use this information only for the test access and delete it at your request. We inform the contact by email seven days before the end, after the end and when the test access is extended; these emails are also sent via Microsoft 365.

Legal basis is Art. 6(1)(b) GDPR (provision of the licensed software to the licensee) and Art. 6(1)(f) GDPR. Our legitimate interest lies in enforcing the license terms and preventing misuse, in particular that Alfrodin Web is used to capture Alfresco credentials. If you received your license seat from your employer, your employer decides on the assignment of seats.

Requesting a trial on the website: When you request a trial on alfrodin.com, we process the company, your first and last name, your email address, the chosen product and, for Alfrodin Web, the address of your Alfresco server. We send a confirmation code to the address (six digits, valid for 15 minutes, kept only in memory); only after it has been entered do we set up the trial and send the license key by email, with a copy to us. So that each address receives one trial and each company at most three, we additionally keep the email address, the domain and the server as non-reversible check values, also after the trial has ended, for as long as we offer trials on the website. To prevent misuse, we count requests per IP address and per email address in memory for up to 24 hours; the website sets no cookies for this. We do not call the server address; we only check that its name does not point to a private network. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Art. 6(1)(f) GDPR (prevention of misuse). The emails are sent via Microsoft 365 as described above. Before sending the code, we check via DNS whether the domain of your address can receive email. To protect against automated requests, your browser solves a short computing task when the form opens; no personal data is processed for this. Requests that we do not set up immediately are stored until they are forwarded to us the next morning and are then deleted from this list.

10. Payment Processing

For direct license purchases, we use the payment service provider Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany. Digistore24 processes your payment data as an independent controller. The Digistore24 Privacy Policy applies.

For licenses via Microsoft Marketplace, the Microsoft Privacy Statement applies. We only receive information from the payment service providers about the completion and status of your order, not your payment data (e.g., credit card numbers).

11. Data Retention

Personal data is only stored for as long as it is necessary for the respective processing purpose. Contract data is stored after termination of the contract for the duration of the statutory retention periods (in Austria, generally 7 years pursuant to § 132 BAO). Server log files are deleted after no more than 30 days. Sign-in codes for Alfrodin Web expire after 15 minutes, rate-limit counters after no more than 24 hours, and the sign-in proof in the browser 30 days after its last use; Microsoft keeps delivery data of the code emails for up to 90 days. If consent is withdrawn, the affected data is deleted immediately, unless a statutory retention obligation exists.

12. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): You have the right to obtain information about your personal data stored by us.
• Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing.
• Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): You may object to the processing of your data at any time.
• Right to withdraw consent (Art. 7(3) GDPR): Consent given may be withdrawn at any time with effect for the future.

To exercise your rights, please contact: office@mbasoft.at

13. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the competent data protection supervisory authority:

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

14. Data Transfer to Third Countries

When using Microsoft Single Sign-On, data may be transmitted to Microsoft servers that may be located outside the EU. Microsoft has committed to complying with European data protection standards under the EU-US Data Privacy Framework. The same applies to Microsoft 365 for sending the Alfrodin Web sign-in codes: Microsoft processes the data in data centers in the EU; access from third countries is possible under the EU-US Data Privacy Framework and Microsoft's standard contractual clauses. No other transfer of personal data to third countries takes place.

15. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to reflect changes in the legal situation or changes to our services. The current version can always be found on this page.

Last updated: October 2026