Last updated: 22 October 2026
This Privacy Policy informs you about the processing of personal data on the MINIFINITY website at minifinity.eu, including its country and language versions. It covers the use of the Composition Studio, contact and PDF requests, newsletter registrations and subsequent communication by email and telephone.
1. Controller and Data Protection Contact
The controller within the meaning of the General Data Protection Regulation is BRAIN Projects GmbH, Neubaugasse 43/4, 1070 Vienna, Austria. Email: chill@minifinity.eu. You can contact us at this address with questions about data protection and to exercise your data protection rights.
2. Website Provision and Security
We use Vercel for hosting and technical provision. The application functions are configured for Frankfurt, Germany. Website content is delivered through the provider’s international infrastructure. We use Sanity to manage and provide editorial content. When you access the website, technically necessary connection data is processed. This includes, in particular, your IP address, the time of access, the content requested and technical information about the request and the browser used. Request identifiers, status and error codes, execution times and information about the software version in use are also processed for troubleshooting and website security.
The processing serves to provide the website, ensure its functionality and protect it against misuse and unauthorised access. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests lie in the secure and reliable operation of the website. Application runtime logs are retained for 24 hours. This period applies to our application logs. For additional infrastructure and security data held by the providers, retention depends on the necessity of the data for providing and securing the service and investigating specific security incidents.
The website uses server-side input validation, request limits and technical measures against automated misuse. No external CAPTCHA service is currently integrated. Fonts are provided through our website infrastructure and are not loaded through external font APIs.
4. Contact and Composition Studio
When you contact us, we process the information you submit. This includes, in particular, your name, email address, telephone number and message content, and, where applicable, your company, country, the location of your planned MINIFINITY, product interests and attached documents. For website enquiries, the selected language, time of receipt and an internal enquiry reference are also processed. Name, email address, telephone number and message are mandatory fields in the contact form. The telephone number is used for follow-up questions about your enquiry. The form cannot be submitted without this information. There is no statutory obligation to provide it. Alternatively, you can contact us directly by email at chill@minifinity.eu.
In the Composition Studio, you can put together product variants, colours, finishes and equipment options. As long as you do not submit an enquiry or PDF request, your current selections generally remain in your browser or the current session. Merely creating a composition does not create an identifiable contact record in Pipedrive. When you actively submit a composition, we process the selected composition together with your form entries. This includes the product options, any displayed pricing information, language, contact details, other information you enter, the time of submission and an enquiry or composition reference.
The information is stored in Supabase and transferred to Pipedrive to process your enquiry. The primary Supabase database is located in Frankfurt, Germany. Daily database backups are retained for seven days. Automated acknowledgements are sent through Resend. The purposes of processing are to answer your enquiry, provide advice and requested information, and prepare a potential quotation. Where processing is necessary to take steps at your request before entering into a contract, it is based on Article 6(1)(b) GDPR. For general information enquiries, it is based on Article 6(1)(f) GDPR and our legitimate interest in responding to your request and keeping a clear record of how it is handled.
5. PDF Requests and Composition Documents
Your name and email address are required to request a composition as a PDF. The function cannot be used without this information. Your contact details, selected composition, language and associated enquiry references are stored in Supabase and transferred to Pipedrive. The requested documents are sent by email through Resend.
The PDF file generated for delivery is temporarily placed in a private Supabase storage area. Once Resend has accepted the email for sending, deletion of this file is initiated. An additional cleanup process retries unsuccessful deletions and removes remaining files once they are seven days old, on the next successful cleanup run. This also includes files from failed sending attempts and abandoned uploads. The deletion applies to the temporary file in Supabase. The underlying contact and composition data, as well as email copies and attachments held by the delivery service or in mailboxes, are retained separately. The respective retention periods described in this Policy apply to them.
Processing is based on Article 6(1)(b) GDPR where the documents are requested in connection with a specific product enquiry. For a general request for information, it is based on Article 6(1)(f) GDPR and our legitimate interest in providing the documents you have expressly requested. A PDF request does not automatically result in a newsletter subscription or consent to marketing calls or email tracking.
6. Pipedrive and Google Workspace
We use Pipedrive as our central system for managing enquiries and customer contacts. Information actively submitted through contact, composition and PDF forms is stored there and assigned to the relevant contact or enquiry. Newsletter registrations and consent information are handled in accordance with their separate purpose. The data processed in Pipedrive includes, in particular, contact details, submitted messages and form content, selected compositions, enquiry and quotation information, receipt timestamps, internal references and processing status. Emails and attachments, telephone activities, necessary call notes, appointments and tasks may be added as the enquiry progresses. The processing of email interaction data is governed by Section 7.
Our business email mailboxes are provided through Google Workspace/Gmail. Correspondence is managed in Pipedrive and synchronised with the connected Google Workspace mailboxes. Sender and recipient details, subject lines, message content, attachments, timestamps and technical message information are processed. The data may therefore be stored in both Pipedrive and Google Workspace.
The processing serves to handle your enquiry, provide advice, prepare quotations, carry out agreed follow-up steps and document communication. The legal basis is Article 6(1)(b) GDPR for necessary pre-contractual or contractual measures. Article 6(1)(f) GDPR applies to handling general enquiries and organising communication. Our legitimate interest lies in the orderly and traceable handling of your enquiry. Adding a contact to Pipedrive does not constitute consent to newsletters, marketing calls or personally identifiable email tracking.
7. Consent to Email Open and Click Tracking
For emails sent through Pipedrive, we use functions that track opens and clicks on an individual basis. An individual tracking pixel and links that can be attributed to the recipient are used for this purpose. When the pixel is retrieved or a tracked link is accessed, the data processed may include, in particular, a message or tracking identifier, the open or click event, the time, the relevant link and technically necessary connection data. The events are assigned in Pipedrive to the email sent and your contact record. The purpose is to identify which information attracts interest, tailor our communication accordingly and plan further responses to your enquiry. The tracking is not always reliable because of technical privacy features in email applications.
This personally identifiable analysis requires your prior, freely given and informed consent. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Consent must be obtained separately before the first tracked email is sent. It is given through an active, non-preselected choice in the relevant form or through a separate express statement after the appropriate information has been provided. A general acknowledgement of the Privacy Policy, submission of an enquiry, a newsletter registration without a separate tracking notice or opening an email does not replace this consent.
Consent to tracking is not a condition for handling your enquiry, receiving a requested PDF file or other necessary communication. Without consent, personally identifiable open and click tracking must not be used for the emails concerned. You can withdraw your consent at any time by sending a message to chill@minifinity.eu. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before withdrawal. Following withdrawal, the personally identifiable analysis will be discontinued; tracking data that is no longer required will be deleted or anonymised. Necessary records of consent and withdrawal may be retained separately.
Tracking data is retained only for as long as necessary for the stated analysis purpose and while consent remains in place, but no later than the deletion of the associated enquiry record. Statutory retention obligations for business correspondence do not automatically apply to all associated tracking data. This processing is separate from automated website emails sent through Resend. Open and click tracking for minifinity.eu is disabled in Resend.
8. Telephone Communication through Aircall and Pipedrive
We use Aircall in conjunction with Pipedrive for business telephone calls. When a call is initiated from a Pipedrive contact, the technical telephone connection is established through Aircall. For this purpose, your name and telephone number, in particular, are transferred from Pipedrive to Aircall and processed and stored there to identify the contact, make the call and assign the communication. The telephone communication is transmitted through the telephony service to conduct the conversation. Call metadata is also processed, including, in particular, the telephone numbers involved, call direction, time, duration and call status. The call information required to handle the enquiry is transferred back to Pipedrive or recorded there as a telephone activity and assigned to the relevant contact. Necessary call notes serve to document questions, answers and agreed follow-up steps.
Contact and call data is therefore processed in both Aircall and Pipedrive. The legal basis is Article 6(1)(b) GDPR where the telephone communication is necessary for your specific enquiry or a contractual relationship. Article 6(1)(f) GDPR applies to general enquiries. Our legitimate interest lies in conducting and keeping a clear record of the communication. Telephone marketing requires prior consent under Section 174 TKG 2021. Providing a telephone number or adding a contact to Pipedrive does not constitute general consent to marketing calls.
The retention period for the associated enquiry applies to call activities in Pipedrive. Technical call-history data within Aircall is retained separately in accordance with the terms of the service used and applicable statutory retention obligations. Following the end of the contract, Aircall generally provides a 30-day export period and then deletes data processed exclusively on our behalf, unless a statutory retention obligation prevents this. The retention period for Pipedrive therefore does not automatically apply to all Aircall data.
9. Automated Emails through Resend
We use Resend, a service provided by Plus Five Five, Inc., for automated website confirmations and composition emails. The data processed includes, in particular, the recipient’s address, name where applicable, subject line, message content, attachments, sending time, delivery status and information about failed deliveries. Technical delivery information is used to send messages, handle errors and prevent further delivery attempts to permanently unreachable or blocked addresses. Resend does not perform personally identifiable tracking of email opens or link clicks.
Under the service configuration used, email and log data is retained for 30 days. According to Resend, backups are retained for seven days. Deleting temporary PDF files from Supabase is separate from the processing of email attachments by Resend. Separate delivery, complaint and suppression records serve to prevent further delivery failures and unwanted messages. Their retention depends on whether the relevant delivery or suppression reason continues to exist. The general 30-day period does not automatically apply to all separately maintained suppression records. The legal basis is Article 6(1)(b) GDPR for requested or pre-contractual communications, Article 6(1)(a) GDPR for messages requiring consent, and Article 6(1)(f) GDPR for necessary delivery management, troubleshooting and prevention of misuse.
10. Newsletter Registration
For newsletter registration, we process your email address and the information required to carry out and document the registration. This includes, in particular, subscription status, registration and confirmation timestamps, and evidence of your consent. Registration uses a double opt-in procedure. The subscription is activated only after you click the confirmation link in the email sent to you. Registration records are stored in Supabase; contact and consent information is transferred to Pipedrive to manage the subscription. We use Resend for automated confirmation emails.
The purpose is to register you to receive the information about MINIFINITY described during registration. The legal bases are Article 6(1)(a) GDPR and Section 174 TKG 2021. Consent is voluntary and is not a condition for making an enquiry or requesting documents. Consent to receive the newsletter does not automatically include personally identifiable open and click tracking. Unconfirmed registrations are scheduled for deletion after seven days. Confirmed registrations are used for newsletter delivery until consent is withdrawn. You can unsubscribe through the unsubscribe link in a newsletter email or by sending a message to chill@minifinity.eu.
Following an unsubscribe request, necessary consent and unsubscribe records may be retained to fulfil statutory documentation obligations and defend against specific legal claims. The applicable documentation and limitation periods determine this retention. A necessary suppression entry remains in place for as long as needed to respect your withdrawal or objection. This data is not used to continue sending the newsletter.
11. Recipients and Processing on Our Behalf
Recipients of personal data include, in particular, the providers described in this Policy: Vercel, Sanity, Supabase, Resend, Pipedrive, Google Workspace and Aircall, each in accordance with their respective tasks. Access is granted to employees responsible for handling the matter and, where necessary for maintenance or technical support, contracted IT service providers. Processing by processors is governed by the required agreements under Article 28 GDPR.
Where a provider processes certain data to fulfil its own statutory obligations, that processing must be distinguished from its activities as a processor. This applies, for example, to independent obligations relating to telecommunications and billing data. Further disclosures take place where necessary to fulfil statutory obligations or establish, exercise or defend legal claims. Recipients may include, in particular, legal and tax advisers and competent authorities and courts. Depending on the circumstances, the legal basis is Article 6(1)(c) or (f) GDPR.
12. Data Transfers Outside the European Economic Area
The services used may involve the processing of personal data outside the European Economic Area. This applies, in particular, to Vercel’s international hosting and content delivery infrastructure, the US corporate and subprocessor structures of Sanity, Resend, Pipedrive, Google Workspace and Aircall, and Supabase Pte. Ltd. in Singapore and its subprocessors. Selecting Frankfurt as the database region or location of the application functions does not mean that all processing and support access takes place exclusively within the EEA.
Vercel Inc., Google LLC, Pipedrive Inc., Aircall.io, Inc. and Plus Five Five, Inc., trading as Resend, participate in the EU-U.S. Data Privacy Framework. Where a transfer to these US recipients falls within the scope of their respective certification, the European Commission’s adequacy decision under Article 45 GDPR is available as a basis for that transfer.
For other necessary transfers to third countries, the respective data processing agreements provide, in particular, for the European Commission’s Standard Contractual Clauses under Article 46 GDPR and, where necessary, supplementary safeguards. This applies, in particular, to transfers to Supabase in Singapore and relevant transfers within the Sanity infrastructure. The other providers named above also provide contractual arrangements for transfers not covered by the respective adequacy decision. You can request information about the safeguards applicable to a specific transfer and a copy of the relevant contractual provisions at chill@minifinity.eu.
13. Retention Periods and Deletion
A retention period of 24 months after the last substantive contact has been established for enquiries, compositions, PDF requests and associated communication and Pipedrive data that do not result in a contractual relationship. This serves to handle and maintain a clear record of your enquiry. Retention periods are monitored on the basis of the documented contact and processing status. If the processing purpose ceases earlier and no other legal basis exists, the data concerned is deleted or anonymised earlier. Longer retention requires a separate reason, in particular an ongoing contractual relationship, a statutory retention obligation or the necessity to establish, exercise or defend specific legal claims.
Where documents are subject to statutory retention obligations under Section 132 BAO or Section 212 UGB, they are generally retained for seven years, calculated from the start date specified by the applicable law. Longer retention may be necessary during pending proceedings. The legal basis is Article 6(1)(c) GDPR; necessary retention for the defence of legal claims is based on Article 6(1)(f) GDPR. Technical logs, backups, temporary PDF files, email tracking data, Resend data, newsletter records and Aircall call data are subject to the specific periods and criteria described in the relevant sections. Deletion must also take account of associated copies in the other systems we use.
14. Your Data Protection Rights
Subject to the statutory conditions, you have the right of access under Article 15 GDPR, rectification under Article 16 GDPR, erasure under Article 17 GDPR, restriction of processing under Article 18 GDPR and data portability under Article 20 GDPR. The right to data portability applies, in particular, to data you have provided that is processed by automated means on the basis of consent or a contract. You can withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.
To exercise your rights, you can contact chill@minifinity.eu. If we have reasonable doubts about your identity, we may request additional information where necessary to identify you. Requests are handled within the statutory time limits, generally within one month. We will inform you of any legally permitted extension and the reasons for it.
15. Separate Notice of Your Right to Object
Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object to that processing at any time on grounds relating to your particular situation. This also applies to profiling based on that provision. Where personal data is processed for direct marketing, you may object to that processing at any time without giving specific reasons. This also applies to profiling insofar as it is related to such direct marketing. Following your objection, the data will no longer be processed for those purposes. You may submit your objection, in particular, to chill@minifinity.eu.
16. Right to Lodge a Complaint
If you consider that the processing of your personal data infringes data protection law, you may lodge a complaint with a supervisory authority, in particular in the place of your habitual residence, place of work or the alleged infringement. The competent supervisory authority in Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria. Email: dsb@dsb.gv.at.
17. Automated Decisions and Changes
Within the processing described in this Policy, we do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. We update this Privacy Policy when the described processing activities or legal requirements change. We will inform you before processing begins for new purposes. Any required consent will be obtained separately.