Privacy Policy

1. Data Controller

MoLo FlexKapG is the controller responsible for the processing of your personal data on this website, as described in this privacy policy. If you have questions about data protection, you can reach us at any time at the contact details above.

2. Overview

We take the protection of your personal data seriously. This website is designed with a privacy-first approach. We use cookieless analytics by default and only load cookie-based tracking when you explicitly consent.

3. Hosting

This website is hosted on a virtual private server (VPS) provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner operates data centres exclusively within the European Union (Germany and Finland).

When you visit this website, the web server automatically logs technical connection data (so-called server log files). This includes your IP address, the pages accessed, date and time of access, browser type and version, and the referring URL. These logs are stored for security purposes (e.g. detecting attacks) and are automatically deleted after 14 days. The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in the security and stability of our web service).

4. Analytics

Plausible Analytics (cookieless)

We use Plausible Analytics, a privacy-focused, open-source web analytics tool. Plausible is self-hosted on our own server within the EU.

Plausible does not use cookies. We use it for aggregate website analytics and do not link its analytics data to contact records or create named visitor profiles.

Data collected by Plausible includes page URL, referrer, general browser and device information, country, and campaign tags in tagged links. We also measure interactions such as link and call-to-action clicks, section visibility, scroll milestones, navigation, tabs, FAQs, carousels, and use of the Meridian demo. On insight articles, progress events mark when the viewport reaches 25%, 50%, 75%, 90%, and 100% of the article body; they measure scroll position, not whether text was read. A demo-completion event is sent after all chapters have been visited and the final chapter is reached. Event properties use category-level values such as page type, language, section or control identifiers, action type, and progress milestone. Text entered into the Meridian demo is not sent. Campaign tags are used for analytics attribution and are not attached to contact form submissions or ERPNext leads. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding website usage patterns in aggregate).

4.2 Google Analytics 4 (consent-gated)

We use Google Analytics 4 (GA4), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, only when you explicitly consent to the use of analytics cookies. GA4 is loaded only after you click "Accept" on the cookie consent banner, in compliance with TKG 2021 §165 (Austrian Telecommunications Act).

If you consent, GA4 uses cookies to generate pseudonymised usage statistics. It measures page views, traffic-source and device information, and website interactions such as link and call-to-action clicks, scroll depth, content sections, tabs, FAQs, carousels, and use of the Meridian demo. On insight articles, progress events mark when the viewport reaches 25%, 50%, 75%, 90%, and 100% of the article body; they measure scroll position, not whether text was read. A demo-completion event is sent after all chapters have been visited and the final chapter is reached. When these interactions occur, GA4 may also record on-site searches, embedded video engagement, file downloads, and contact form starts and submissions. Depending on the event, this can include search terms, video titles and URLs, file names and types, and technical form details such as a form identifier, destination URL, or submit-button text. Our custom contact-form events include the form identifier and selected service category. Names, email addresses, company names, messages, and other identifying form field values are not sent to GA4. Text entered into the Meridian demo is not sent. Campaign tags are used for analytics attribution and are not attached to contact form submissions or ERPNext leads. Google may transfer data to servers in the United States; Google relies on EU Standard Contractual Clauses (SCCs) and additional safeguards for such transfers. You can revoke your consent at any time through Cookie settings in the website footer.

If you consent to analytics, Google Signals may let Google associate data from your visits with information from your Google Account when you are signed in and have Ads Personalization enabled. Google account information may include location, Search and YouTube activity, and activity on sites that partner with Google. This supports cross-device reporting and aggregated reports about demographic groups and interests, such as age ranges, gender, and interests. We only see aggregate reports, not named visitor profiles, and Google may hide results for small groups. You can manage Ads Personalization in your Google Account and withdraw your website analytics consent at any time through Cookie settings in the footer.

The legal basis for processing through GA4 is Art. 6(1)(a) GDPR (your consent). Without your consent, GA4 will not be loaded and no data will be collected through it.

5. Cookies

This website does not set any cookies by default. Cookies are only placed if you actively consent to Google Analytics 4 via the cookie consent banner. Our primary analytics tool, Plausible, operates entirely without cookies.

If you consent to GA4, the following cookies may be set: _ga (used to distinguish users, expires after 2 years), _ga_<ID> (used to persist session state, expires after 2 years). You can manage or delete cookies through your browser settings at any time.

6. Contact Forms & Email

When you submit the contact form, we process your name, email address, optional company and message, selected interest, and language to respond to your inquiry. Campaign tags are used by our analytics tools as described above; they are not included in the form submission or attached to the ERPNext lead. We retain inquiries for up to three years after the last contact, unless a contract is concluded or statutory retention obligations apply. For abuse prevention, the form endpoint temporarily checks the request IP and network group; hashed rate-limit counters remain in server memory for up to 15 minutes and are not sent to analytics. If you email us directly, we process your email address and message through Google Workspace (Google Ireland Limited, Dublin, Ireland). The legal basis for handling inquiries is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).