Privacy policy
We take data security very seriously and are committed to providing a service that handles your data securely and responsibly.
Introduction and terms
1. Introduction
Protecting your personal data is a particular concern for us. We therefore process your data exclusively on the basis of the statutory provisions (GDPR, Austrian Data Protection Act (DSG), Austrian Telecommunications Act 2021 (TKG 2021)).
By operating our website Form.taxi (hereinafter “Website”) and the associated online service for processing form submissions (hereinafter “Online Service”), we process personal data. We treat this data confidentially and process it in accordance with applicable law, in particular the General Data Protection Regulation (GDPR). This privacy policy informs you which personal data we collect, for what purposes and on what legal basis we use it, and to whom we may disclose it. We also explain the rights you have to protect and enforce your data protection.
2. Terms
This privacy policy contains technical terms from the GDPR. To help you understand them, we explain these terms in plain language below.
Personal data
“Personal data” means any information relating to an identified or identifiable person (Art. 4(1) GDPR). Information about an identified person may be, for example, their name or email address. Personal data also includes data where the person’s identity is not immediately apparent but can be determined by combining it with other information. A person can be identified, for example, by their address or bank details, date of birth or user name, IP address and/or location data.
Processing
Under Art. 4(2) GDPR, “processing” means any operation performed on personal data. This includes in particular collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
Responsible person
“Controller” means the party that, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4(7) GDPR).
Processor
“Processor” means a party that processes personal data on behalf of and on the instructions of a controller (Art. 4(8) GDPR). This is based on a data processing agreement (DPA) under Art. 28 GDPR.
Responsible person
3. Person responsible for data processing
wrkt*biz Reinhard Söllradl
Brandstatt 9, 4070 Eferding, Austria
Email: support@form.taxi
Scope
4. Who does this privacy policy apply to?
Several groups of people are affected when Form.taxi is used. Depending on the group, we either act as the controller ourselves or process data on behalf of our customers.
| Group of people | Our role | Section |
|---|---|---|
| Visitors to our website form.taxi | Responsible person | 6 |
| Customers who have a user account with Form.taxi | Responsible person | 7 |
| Form senders who fill in a form on the website of one of our customers | Processor | 8 |
If you have filled in a form on another website that is delivered via Form.taxi, the operator of that website is responsible for your data. You will find more information in Section 8 and in the privacy policy of the website operator concerned.
Processings
5. Processing framework and hosting
We do not sell, rent or otherwise pass on your data to third parties. Where we use external service providers for processing, this takes place under a data processing arrangement in which we are entitled to issue instructions to our contractors. The service providers used are named for the respective processing activities.
For hosting the Website and the Online Service, we use the service provider ALL-INKL.COM – Neue Medien Münnich, with its data center in Dresden, Germany. For more information about the data center and its security standards, see https://all-inkl.com/info/unternehmen/.
The Website and the Online Service, including the processing of form submissions, are operated exclusively within the European Union. We do not transfer any data to third countries. Payments for paid plans are processed by Paddle as an independent controller, see Section 7.
6. Processing on our website
On the Website, we process the personal data listed below. We only process data that you actively provide (e.g. by filling in a form) or that your browser transmits automatically.
Provision of the website
Each time you access the Website, we automatically collect information that your browser transmits to our server and store it in log files:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred
- Website from which the request originates
- Name, language and version of the browser software
- Operating system and its version
This processing is carried out to enable access to the Website and to ensure its stability and security. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log files are deleted after one year at the latest.
Contact form and contact by email
If you contact us by email or via a contact form on the Website, we store the data you provide in order to handle your request. The legal basis is the performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in responding to your request (Art. 6(1)(f) GDPR). We delete the data once storage is no longer necessary, or restrict processing where statutory retention obligations apply.
Web analysis with Matomo
We use the web analytics service Matomo to analyse the use of our Website and to improve our offering on a regular basis. The legal basis is our legitimate interest in optimising our Website (Art. 6(1)(f) GDPR).
The information collected is stored on a server within the European Union. Matomo is operated without cookies. Your IP address is truncated before further processing, so that it cannot be directly linked to you. The transmitted IP address is not combined with any other data we collect. Matomo is an open-source project. For information on data protection, see https://matomo.org/privacy-policy/.
7. Processing for our customers
When you create a user account with Form.taxi and use the Online Service, we process the following data as the controller:
- Login details for the administration panel (email address and password)
- Account settings (e.g. language, time zone)
- Details of your web forms (title, website address, recipient addresses, settings)
- Log of the actions you perform
- Details you provide when creating a data processing agreement
- Your correspondence with our support team
This processing is carried out to provide the Online Service and to perform our contract with you (Art. 6(1)(b) GDPR). We delete the data once it is no longer required, at the latest when your user account is deleted, unless statutory retention obligations apply.
Email delivery with Mailjet
We use the Mailjet service to send emails to you, such as account emails, notifications and forwarded form submissions. The data is processed exclusively in data centers within the European Union. The legal basis is our legitimate interest in the reliable and secure delivery of emails (Art. 6(1)(f) GDPR). Mailjet acts as a processor, and a data processing agreement has been concluded.
Service provider: Mailjet GmbH, Alt-Moabit 2, 10557 Berlin, Germany. Privacy policy: https://www.mailjet.de/privacy-policy/
Newsletter
If you enable the newsletter in your account settings, we use your email address to inform you about news and offers from Form.taxi. We also use Mailjet to send the newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 174 TKG 2021). We store the time of your consent as proof. You can withdraw your consent at any time by disabling the option in your account settings or by using the unsubscribe link in every newsletter. Your data will then be removed from the mailing list.
Payment processing with Paddle
Paid plans are processed via Paddle. Paddle acts as reseller (“Merchant of Record”) and is independently responsible for payment processing, invoicing and tax remittance. You enter the data required for the purchase (e.g. name, email address, billing address, payment details) directly with Paddle. We receive the information from Paddle that is needed to manage your subscription, but not your full payment details. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
Paddle processes data through several companies, including in the United Kingdom, Ireland, the USA and Canada. According to Paddle, transfers to countries without an adequacy decision of the European Commission are based on Standard Contractual Clauses. Paddle is responsible for this processing. For information on data protection at Paddle, see https://www.paddle.com/legal/privacy.
Retention of accounting records
To comply with statutory retention obligations, we keep billing-related records for the legally required period (Art. 6(1)(c) GDPR, Section 132 of the Austrian Federal Fiscal Code (BAO)).
8. Processing of form submissions on behalf of our customers
Our customers integrate Form.taxi into the forms on their own websites. When you fill in and submit such a form, we process your data on behalf of the website operator concerned. The website operator is the controller within the meaning of the GDPR, and Form.taxi is its processor. Processing is based on a data processing agreement under Art. 28 GDPR and takes place solely on the instructions of the website operator. The website operator informs you of the legal basis for processing in its privacy policy.
Data processed
- the content you enter in the form, including uploaded files
- IP address and user agent (browser identifier)
- date and time of the submission
- the address of the website from which the submission originates
An approximate location is derived from the IP address and shown to the website operator. For this, we use a database that runs directly on our server. No data is transferred to external services in the process.
Purpose of processing
We process this data in order to receive your submission, protect it against spam, deliver it to the website operator (e.g. by email) and make it available in the website operator’s submission archive. Form.taxi does not use the data for its own purposes.
Sub-processors used
The complete list of sub-processors is set out in the data processing agreement with our customers.
Storage period
Form submissions are stored for a maximum of one year and then deleted automatically. Submissions classified as spam are deleted after one month. The website operator can delete submissions at any time. The IP address and user agent are deleted together with the respective submission.
Forwarding by the website operator
The website operator can have submissions forwarded to other providers via webhooks, automation services or other delivery channels. The website operator is responsible for such forwarding and for the processing that takes place there.
Your rights as a form sender
Please address requests regarding your data subject rights, e.g. access or erasure, to the operator of the website on which you filled in the form. If such a request reaches us, we forward it to the website operator, insofar as we can identify them, and support them in responding.
Cookies and security
10. Encryption of data transmission
To protect your data from unauthorised access, the Website and the Online Service use an SSL/TLS certificate. It encrypts data transmission between our server and your device. You can recognise active encryption by the padlock icon in your browser’s address bar.
Your rights
11. Data subject rights
You generally have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You can reach us with any requests at support@form.taxi.
For data from form submissions on our customers’ websites, please refer to the information in Section 8.
If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, https://www.dsb.gv.at.
Last updated: October 2026