Privacy policy
Information on the processing of personal data under Art. 13 GDPR.
Controller
The controller within the meaning of the GDPR is PayAT e.U. (trading as Asteroid Apps), owner Sergii Kovalov, Mautner-Markhof-Gasse 38/4/472, 1110 Vienna, Austria. You can reach us at info@asteroid-apps.at. There is no statutory obligation to appoint a data protection officer and none has been appointed.
Contact form
If you write to us using the contact form, we process your name, your email address, optionally your company name and the content of your message. The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering a contract) and Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries). Providing this data is voluntary, but without your name, email address and message we cannot deal with your enquiry. The data is used solely to handle your enquiry and is deleted as soon as it is no longer needed for that purpose, and at the latest after three years.
Abuse protection on the form
To prevent automated bulk submissions, when the form is submitted we store a timestamp against your IP address in the server's memory for a maximum of one hour and use it to limit the number of submissions. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse). This data is not stored permanently and is not disclosed to anyone.
Email delivery
To deliver form messages to our mailboxes we use Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor under Art. 28 GDPR. The data you enter in the form is transferred to and processed in the USA. The transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, supplemented by Standard Contractual Clauses.
Email mailbox
Messages sent through the form arrive in a mailbox hosted by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria. To that extent the provider is a processor under Art. 28 GDPR. Processing takes place in Austria; no transfer to a third country occurs.
Hosting
This website is operated by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, as a processor under Art. 28 GDPR. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the secure and efficient operation of the website). Data may be transferred to the USA; this is based on the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914, Module Two).
Server log files
When this website is accessed, technically necessary access data is processed (IP address, time of the request, page requested, volume of data transferred, and browser and operating system identifiers). The legal basis is Art. 6 (1) (f) GDPR, for the secure and stable operation of the website.
Cookies and tracking
This website sets no cookies that would require consent and embeds no third-party tracking or analytics scripts. That is why you see no cookie banner here. There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.
Fonts
The fonts used are served from our own server. No connection to external providers is made, and in particular no IP address is transmitted to third parties.
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). To exercise them, contact info@asteroid-apps.at or the address given above. Where we base processing on a legitimate interest, you may object to it at any time.
Right to lodge a complaint
If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
Last updated: 04.08.2026