Privacy notice .
How personal data is handled on AutomatenKiosk.at.
Last updated: 19 October 2026
1. Controller
emere e.U.
Registered address: to be added before publication
E-mail: office@emere-group.com
Phone: +43 660 800 3140
Contact the controller using the contact details above for data protection requests. If a data protection officer is legally required, their contact details must be added here.
2. Website hosting and server logs
The platform is designed to be hosted by an EU-based provider, with the web server, JSON data files, uploaded location photographs and backups stored in the EU. Before publication, the actual provider’s legal name, address, processing locations, subprocessors, support access, backup locations, log types and retention period must be inserted and verified. An EU server location alone does not establish that every access or subprocessor is EU-only.
Depending on the hosting configuration, technical request data such as IP address, timestamp, requested URL, referrer and browser information may be recorded in server logs for delivery, troubleshooting and security. The actual contents and deletion periods are determined by the selected host and must be confirmed before launch.
3. Contact form
When you use the contact form, the information you provide (such as name, email address, subject and message) is processed to answer your enquiry. Submissions are stored in a server-side JSON file. If email delivery is configured, a notification may also be sent through the configured mail service; its provider must be identified before launch. Please do not submit sensitive information.
The processing basis will ordinarily be taking steps at your request before a contract, where relevant, or the controller’s legitimate interest in handling correspondence. Submissions are scheduled to be deleted after 365 days, unless they must be kept longer for legal obligations or to establish, exercise or defend legal claims.
4. Location data and photographs
Published location entries may contain a location name, address, opening hours, product categories, payment methods, access details and coordinates. Uploaded photographs are stored on the web server and displayed with the relevant entry after publication. Do not upload unnecessary personal data or photographs of identifiable people without an appropriate legal basis. Location entries and photos are kept while the listing remains active or until correction or deletion is required, subject to legal requirements.
5. Administration and security
The administration area is access-controlled. It uses a password hash, session authentication, a CSRF token and a temporary limit on failed sign-in attempts. The system may store a hashed identifier derived from connection information for the purpose of limiting repeated login failures. Access to the administration area is logged according to the actual hosting configuration. Administrator credentials must not be shared.
6. Interactive map and external map service
The interactive map is not loaded automatically on a first visit. Only after you press “Accept and load map” does the browser request the map library and map data. The choice is saved in local storage for this browser (not a cookie) and reused to load the map automatically on later visits until you revoke it in the locations section or on the cookie information page. The selected map service is OpenFreeMap (tiles.openfreemap.org); its public service is operated by Hyperknot Software Kft., Hungary. The map uses OpenStreetMap data and OpenMapTiles. Your browser necessarily connects to the map service and may transmit the IP address, browser/technical request data and the map tile URLs requested for the current view. The website does not request your device’s GPS location. OpenFreeMap states that it does not use cookies and normally omits IP addresses from access logs, but its policy describes limited IP processing in error/security logs and possible CDN use.
The MapLibre GL JS library is also loaded on demand from unpkg.com when the map is requested. This is a map-related third-party delivery dependency; it is not hosted by the site itself. If the project’s EU-only rule is meant to exclude every non-EU delivery network except the actual map service, the library should be self-hosted locally within the EU before production.
Provider notices: OpenFreeMap Privacy Policy, OpenFreeMap Terms, OpenStreetMap copyright.
7. Cookies and similar technologies
The site does not intentionally use analytics or advertising cookies. A technically necessary PHP session cookie may be set when a form is opened or the administration area is used; it supports CSRF protection and authentication and is configured as HttpOnly and SameSite=Lax, with the Secure flag when HTTPS is detected. Language selection is passed in the URL and is not stored in a language cookie. The map permission is stored in local storage after an explicit click (not in a cookie); while the preference remains saved, the external map loads automatically on later visits. You can revoke it in the locations section or cookie information page. See the separate cookie information page for details.
8. Recipients and international transfers
The intended rule is that the hosting provider, server, data storage, backups and ordinary services are EU-based. The exact host, email delivery service and subprocessors must be verified and named before launch. The map provider and map-library delivery are the explicitly planned external mapping exception described above; the map-library CDN must be considered part of this external mapping integration unless the library is self-hosted locally in the EU. No other analytics, marketing, social-media or external font integrations are planned.
9. Your rights and complaints
Subject to the legal requirements, you may have rights of access, rectification, erasure, restriction, data portability and objection. Where processing is based on consent, you may withdraw it for the future. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde).
Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna, Austria
10. Changes and launch review
This notice must be reviewed whenever the actual host, email delivery, map implementation or other site functions change. Before production, confirm the controller address, hosting company and server region, backup and log locations/retention, mail provider, and the precise legal bases.