Privacy — 8Network

1. Controller and DPO

Soheil Gholamalizadehdahraei
Einzelunternehmen, GISA-Zahl: 39565181
Vorgartenstraße 204, 1020 Wien, Austria
Email: info@8network.io

No Data Protection Officer is appointed. The thresholds in Art 37(1) GDPR are not met (no large-scale systematic monitoring; no large-scale processing of special-category data).

2. What We Process

a) Inquiry emails

Legal basis: Art 6(1)(f) legitimate interest in responding to business inquiries directed at us, and Art 6(1)(b) pre-contractual measures at the request of the data subject.
Legitimate interest balancing: a data subject who writes to us has a clear expectation of a reply. Processing the email is necessary and proportionate to that expectation; no less intrusive alternative exists.
Data: email address, message content, mail metadata (timestamps, headers).
Retention: kept during engagement evaluation + 12 months for follow-up; then deleted unless a paid engagement is signed (Austrian business record-keeping rules then apply, in particular §132 BAO — 7 years).

b) Contact form submissions (/contact)

Legal basis: Art 6(1)(f) legitimate interest in responding to and qualifying inbound business inquiries, and Art 6(1)(b) pre-contractual measures at the request of the data subject.
Legitimate interest balancing: the form collects only information needed to understand the inquiry and respond. The data subject submits it voluntarily to start a business conversation. Processing is necessary and proportionate to that purpose.
Data: name, email, optional company, optional service area, free-text project context, submission timestamp, IP address and user-agent metadata.
Processing: stored in Cloudflare Workers KV (Cloudflare, Inc., USA, under the EU-US Data Privacy Framework). A notification email is sent through Cloudflare Email Routing and delivered to a Gmail mailbox operated by Google LLC (USA, EU-US DPF).
Retention: same as (a) — kept during engagement evaluation + 12 months for follow-up; then deleted unless a paid engagement is signed.

c) Website hosting metadata

Legal basis: Art 6(1)(f) legitimate interest in operating and securing the website. For the strictly-necessary cookie below, the legal basis is Art 5(3) ePrivacy Directive (as implemented in Austrian law) — strictly necessary for the service explicitly requested by the user; no separate consent required.
Processor: Cloudflare, Inc. (USA), operating under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795).
Data: IP address, request timestamp, user agent, and standard HTTP request metadata processed for delivery and bot/abuse protection.
Cookies: Cloudflare may set the __cf_bm bot-management cookie (max 30 minutes per Cloudflare specification) — strictly necessary for bot protection of this site. No first-party analytics or marketing cookies are set.
Retention: Cloudflare retains request logs per its own retention policy; 8Network does not maintain separate server logs of visitor data.

d) Analytics

None.

3. Recipients

Cloudflare, Inc. (USA) — website hosting, Cloudflare Workers KV storage of /contact form submissions, and Cloudflare Email Routing for inbound and outbound mail.
Google LLC (USA) — Gmail mailbox receiving inquiry emails and /contact form notifications routed by Cloudflare Email Routing.

4. International Transfers

Both processors are US-based and operate under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795):

Google LLC — Gmail (email).
Cloudflare, Inc. — hosting, Workers KV storage, Email Routing.

5. Your Rights (Art 15-22 GDPR)

Access (Art 15), rectification (Art 16), erasure (Art 17), restriction (Art 18), data portability (Art 20), objection (Art 21). To exercise these rights, email info@8network.io. We respond within 30 days (Art 12(3)). Where there is reasonable doubt about the identity of the person making the request, we may ask for additional information to confirm identity (Art 12(6)).

6. Right to Lodge a Complaint (Art 77)

Datenschutzbehörde
Barichgasse 40-42, 1030 Wien
https://dsb.gv.at

7. Provision of Data

Voluntary. Not providing an email means we cannot reply. No statutory or contractual obligation to contact us.

8. Automated Decision-Making