Domavi

GDPR overview

GDPR implementation is concrete and documented rather than merely asserted. web-crossing GmbH, Eduard-Bodem-Gasse 9, 6020 Innsbruck, Österreich, is named as controller for the site and acts as Auftragsverarbeiterin under Art. 28 for the platform; the DSGVO, TKG 2021 and the Austrian DSG are all invoked. Rights under Art. 15-21 are set out and exercisable by informal e-mail, and the supervisory authority is named: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien. A Datenschutz-Folgenabschätzung is stated as documented, an AVV is available on request, the product ships a DSGVO-Löschkandidaten feature, and the application discloses AI-prepared proposals under Art. 50 of the EU AI Act. No data protection officer is named, and no Art. 27 representative is designated — none is required for an Austrian establishment. One real gap: although AI processing reaches the United States, no transfer mechanism is named anywhere on the site.

Who owns the data?

The customer keeps ownership and control of what it enters. Under the Datenschutzerklärung each Hausverwaltung is the controller within the meaning of the DSGVO, while web-crossing GmbH acts only as Auftragsverarbeiterin under Art. 28 for the operation of the Domavi platform. A conforming Auftragsverarbeitungsvertrag is supplied on written request by e-mail and must be concluded before processing begins. The customer warrants that the data was collected lawfully and is solely responsible for the accuracy of the content it enters; reselling or sublicensing access to third parties requires the publisher's written consent. On termination the customer has 30 days to export everything in machine-readable CSV or JSON before deletion. The site's own texts, graphics, logos and code remain the publisher's copyright.

Reuse rights

The customer's business data stays the customer's to use and to take away: it can be exported in machine-readable CSV or JSON, and the publisher claims no licence over it beyond running the service. What the publisher collects on its own account is narrow and purpose-bound. Server logs (truncated IP, timestamp, URL called, HTTP status, transferred volume, referrer, browser and system identifiers) rest on legitimate interest, Art. 6(1)(f). Cookies are strictly technical — a session cookie and an XSRF-TOKEN anti-CSRF cookie — and need no consent under § 165 Abs. 3 TKG 2021; there are no analytics, tracking or marketing cookies and no third-party services, and fonts are served from the publisher's own server rather than a CDN. In the protected areas, localStorage holds only the display preference for the Zum Startbildschirm hinzufügen banner: no identifier, no usage behaviour, and nothing sent to the server. Consent is handled by a CCM19 manager self-hosted in Österreich, which records the choice, a timestamp and a random identifier as evidence under Art. 7(1). E-mail enquiries are processed under Art. 6(1)(b) and (f); sign-in data (e-mail address, password hash, role, login IP, security events) under contract performance and the security interest. Two uses deserve attention. AI features send text to Anthropic PBC in the United States, stripped of e-mail addresses, phone numbers, IBANs and card numbers before every call, but not of names, addresses or Objektbezeichnungen. The SMS module passes the number and the message to LINK Mobility Austria GmbH, Brauquartier 5/13, 8055 Graz, Österreich (websms brand), which processes them in Österreich with no transfer outside the EEA, sends only to people who consented under Art. 6(1)(a) DSGVO and § 174 TKG 2021, and keeps a delivery log for 365 days. The legal bases invoked throughout are the DSGVO, TKG 2021 and the Austrian DSG.

Data retention & training

Hosting summary

Hosting runs on the publisher's own infrastructure in Österreich or the European Union, and the AGB add that data is held in certified data centres — without naming a single certification. For hosting itself, no transfer outside the EEA takes place. That claim is independently corroborated: the site's public IP, 193.58.165.90, geolocates to Innsbruck on AS202516, which belongs to web-crossing GmbH, and the name servers are the publisher's own. One explicit exception matters: the AI functions are currently processed by Anthropic PBC in the United States, therefore outside the EEA. Before each model call the application strips e-mail addresses, phone numbers, IBANs and card numbers, but not names, addresses or Objektbezeichnungen. An EU alternative through AWS Bedrock in region eu-central-1 is described as technically prepared but not active, with no date given. Inside the platform, Mandanten are strictly separated, sensitive data such as IBANs and OAuth tokens is encrypted at rest, an Audit-Protokoll records every change with timestamp, user and before and after values, and daily backups are restore-tested. The SMS subprocessor, LINK Mobility Austria GmbH in Graz, processes in Österreich with no transfer outside the EEA; the full list of providers is available on request only.