Privacy Policy

1. Controller

Sebastian Loch, Innstraße 65b, 6020 Innsbruck, Austria
E‑mail: info@finali.net

As a private test project, there is no statutory obligation to appoint a data protection officer.

2. Purposes and legal bases of data processing

We process personal data solely for the following purposes:

• Registration and login: to enable your access to chat and comment functions. Legal basis: performance of pre‑contractual measures and performance of contract pursuant to Art. 6(1)(b) GDPR.
• Chat and comment functions: to display your posts and, if necessary, to moderate them. Legal basis: Art. 6(1)(b) GDPR.
• Technical stability and security (server log files): to ensure proper operation, analyse errors and defend against attacks. Legal basis: our legitimate interest pursuant to Art. 6(1)(f) GDPR.
• Analysis of user behaviour (Hotjar): to anonymously evaluate user guidance and improve the platform. The Hotjar script is loaded only if you consent in the cookie banner. Legal basis: your consent under Art. 6(1)(a) GDPR.
• Embedding of livestreams (YouTube): to play external videos. When you play a stream, data may be transferred to Google/YouTube (USA). Legal basis: our legitimate interest in presenting content in an appealing manner under Art. 6(1)(f) GDPR or – if optional cookies are used – your consent under Art. 6(1)(a) GDPR.

3. Categories of data processed

• Registration data: user name, e‑mail address, encrypted password.
• Communication data: chat messages and comments you write, time stamps, user ID.
• Server and security data: IP address, browser type, operating system, access time, error logs (collected by our hosting provider Hetzner).
• Analysis and tracking data (Hotjar): mouse clicks, scroll depth, page interactions; Hotjar automatically masks input fields.
• Third‑party content (YouTube): when playing embedded streams, your IP address and cookie information are transmitted to Google/YouTube.
• Audio and video data (LiveKit): if you use your webcam, video and audio signals are transmitted in real time and are not stored permanently during the test phase.

4. Recipients and data transfers

• Hetzner Online GmbH (Germany): hosting and database (processing under a data processing agreement).
• Hotjar Ltd. (Malta/EU): analysis tool; data processing within the EU.
• Google LLC / YouTube (USA): provision of video infrastructure. Google is certified under the EU–US Data Privacy Framework or standard contractual clauses are used to ensure an adequate level of data protection.

5. Data transfers to third countries

When using embedded YouTube videos, personal data may be transferred to the USA. Transfers are based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses pursuant to Art. 46(2)(c) GDPR. For further information, please refer to Google's privacy policy.

6. Retention period

• Registration, chat and comment data: are stored for as long as your account exists. After deletion of the account, these data are deleted within 6 months.
• Server log files: are kept for security reasons for a maximum of 6 months.
• Hotjar data: are automatically anonymised or deleted after 12 months at the latest.
• Webcam streams (LiveKit): are transmitted only in real time and are not stored.

7. Voluntariness of provision

Providing your registration data (user name, e‑mail address, password) is necessary to create an account and use the chat and comment functions. Without these details you cannot register; however, you can watch livestreams passively without registering.

Consent to Hotjar tracking is voluntary and can be refused or withdrawn at any time via the cookie banner or your browser settings; your ability to use the platform is otherwise unaffected.

8. Rights of data subjects

Under the GDPR you have the right to access, rectification, erasure, restriction of processing and data portability, as well as the right to object to the processing of your personal data if it is based on Art. 6(1)(f) GDPR (legitimate interests). If processing is based on your consent, you may withdraw that consent at any time with effect for the future without affecting the lawfulness of processing up to the withdrawal. To exercise these rights, please contact us at info@finali.net.

You also have the right to lodge a complaint with the competent supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna (www.dsb.gv.at).

9. No automated decision‑making

We do not carry out automated decision‑making or profiling within the meaning of Art. 22 GDPR.

10. Data security and test character

Your data are protected by appropriate technical and organisational measures (SSL/TLS encryption, password hashing). As this is a non‑commercial test environment, technical errors or data loss cannot be completely ruled out.