How we handle personal data in the Cevio Workspace, under the GDPR (EU 2016/679) and the Austrian DSG.
Controller within the meaning of the General Data Protection Regulation (GDPR):
For data protection matters, simply send an informal email to contact@cevio.at. A data protection officer is not appointed, because the conditions of Art. 37 GDPR are not met.
This policy applies to the Cevio Workspace at www.cevioworkspace.at, that is, to the sign-in page, the client area behind the login and every function it contains.
A separate policy applies to our company website: cevio.at/privacy. For websites we operate for clients, the operator of the website concerned is the controller.
Processing is based on the following legal bases under Art. 6(1) GDPR:
Minimum age. The Workspace is intended for our business clients and for persons who have reached the age of 14 (§ 4(4) DSG, Austrian Data Protection Act). Should we learn that an account was created without the necessary consent, we will delete it together with its data.
The Workspace runs on servers in Austria. Web hosting and database are provided by World4You Internet Services GmbH (Hafenstraße 47-51, 4020 Linz, Austria). The application is written in PHP, the data is held in an SQLite database on the same server.
When our pages are accessed, the web server automatically records the following technical data in log files:
This data is processed to ensure secure operation and to detect and defend against attacks (Art. 6(1)(f) GDPR). It is not merged with other data sources.
The Workspace is a closed client area. An account is created by invitation or by registration. In doing so we process:
This data is required in order to provide the client area. Legal basis: Art. 6(1)(b) GDPR.
Changes and deletion. You can change your name, phone number, profile picture and password yourself at any time in your profile. A change of email address is confirmed by a code sent to the new address. Using the button Delete account in your profile you can request deletion of your account; excluded is data we are legally required to retain (see section 17).
Signing in is protected by a second factor. For this we process:
Trusted devices. On request the Workspace remembers a device, so that the second factor is not requested there at every sign-in. Stored for this purpose are a hash of the device token, the browser identification (user agent), the time of setup, the most recent use and an expiry date. Expired entries are removed automatically, existing ones can be revoked at any time.
You may optionally link your account to a Discord account and then sign in via Discord. Linking uses OAuth 2.0 with Discord Netherlands B.V. respectively Discord Inc.
identify scope only, that is, only your Discord user ID.The legal basis is your consent given by linking (Art. 6(1)(a) GDPR). When the Discord sign-in is opened, Discord processes data on its own account; the Discord privacy policy applies.
At the heart of the Workspace is working together on projects. In doing so we process the content that you and we put there:
This content is accessible only to the people assigned to the respective project and to us as the operator. Legal basis: Art. 6(1)(b) GDPR (contract performance).
Messages and feedback can contain personal data if you enter such data there. Please do not enter special categories of personal data under Art. 9 GDPR, such as health data.
Files can be uploaded in the Workspace, for example drafts, images, documents or project backups. Stored are the file itself as well as file name, size, time and the uploading person.
Files are held on the same server in Austria. Access is limited to the people assigned to the respective project. Legal basis: Art. 6(1)(b) GDPR.
Project previews. The preview function allows websites under construction to be viewed inside the Workspace. The respective draft is served; the content of those drafts is the responsibility of the respective project.
As part of the business relationship we process the data required for the contract and for billing:
Encrypted storage. The master data of our business partners, that is email address, phone number, address, postcode and city as well as VAT and ZVR number, is stored encrypted in the database (libsodium) and decrypted only when displayed.
The legal basis is contract performance (Art. 6(1)(b) GDPR) and the statutory retention obligation (Art. 6(1)(c) GDPR in conjunction with the Austrian Federal Fiscal Code). Invoice-related documents are kept for seven years.
From the Workspace we send service-related emails only. We do not send advertising or newsletters unless you have expressly agreed to it.
Reasons for sending:
No external newsletter or marketing services are used. All data remains in Austria (EU).
The Workspace sets only a few cookies, namely those required for operation (Art. 6(1)(f) GDPR, § 165(3) TKG 2021, Austrian Telecommunications Act):
In addition, the interface stores individual settings in your browser's local storage. You can delete cookies and local storage at any time through your browser settings; you will then have to sign in again.
For traceability and to protect accounts, the Workspace logs security-relevant events:
These logs serve IT security, abuse prevention and the traceability of changes to project and business data only. Legal basis: Art. 6(1)(f) GDPR. No evaluation for performance or behaviour monitoring takes place.
We measure usage with a self-hosted solution on our own server. No data is transmitted to third parties, and no service such as Google Analytics is used.
Recorded are page views, the address requested and the page title, the referring address, time on page, pages per visit as well as coarse information about device, browser and operating system.
The legal basis is our legitimate interest in a data-minimising evaluation to improve the service (Art. 6(1)(f) GDPR). You can prevent the measurement by clearing this site's local storage or by blocking its use in your browser.
We deliberately keep the number of external services small. In use are:
World4You. Hosting of the application, the database and email delivery. All data remains in Austria (EU).
Google Fonts. The Outfit and Syne fonts are loaded from Google servers. Your IP address is transmitted to Google in the process. Legal basis: Art. 6(1)(f) GDPR (consistent presentation).
Discord. Only if you link your account or sign in via Discord, see section 06.
Cloudflare. Individual program libraries are loaded through the cdnjs content delivery network. Your IP address is transmitted to Cloudflare in the process. Legal basis: Art. 6(1)(f) GDPR.
For transfers to the USA we rely on the Standard Contractual Clauses under Art. 46(2)(c) GDPR and, where applicable, on the EU-U.S. Data Privacy Framework.
Where external service providers process personal data on our behalf, data processing agreements under Art. 28 GDPR are in place.
Where we look after your own website or your own bot under a contract and process data of your users in doing so, we act as processor and you as controller. For that case we conclude a separate agreement under Art. 28 GDPR on request.
Under the GDPR you have the following rights regarding your personal data:
Consent you have given, for example for the Discord link, can be withdrawn at any time (Art. 7(3) GDPR). The withdrawal does not affect the lawfulness of the processing carried out until then.
To exercise them, simply send an email to contact@cevio.at. We reply without undue delay, at the latest within one month.
Right to lodge a complaint. You have the right to lodge a complaint with the Austrian supervisory authority:
We store personal data only as long as necessary for the respective purpose:
We implement technical and organisational measures to protect your data from unauthorised access, loss and misuse:
We adjust this policy when the legal situation or our services change. The current version can always be found on this page. We inform registered users by email about significant changes.
Last updated: 18 August 2026