Privacy Policy
As of: 03.11.2026
We greatly appreciate your interest in our company. Data protection is of particularly high importance to the management. The use of our website is generally possible without providing any personal data. However, if a data subject wishes to make use of special services offered by our company via the website, the processing of personal data may become necessary. If the processing of personal data is required and there is no legal basis for such processing, we generally obtain the consent of the data subject.
The processing of personal data—such as the name, address, email address, or telephone number of a data subject—is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to our company. Through this privacy policy, our company aims to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, data subjects are informed of their rights through this privacy policy.
As the data controller, we have implemented numerous technical and organizational measures to ensure the most complete protection possible of personal data processed through this website. Nevertheless, internet-based data transmissions can generally have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us via alternative means, such as by telephone.
Payment Processing via Stripe
To process payments, we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). When you make a payment on our website, the data required for the payment processing will be transmitted to Stripe.
The data processed includes, in particular:
- Email address
- Transaction amount and date
The processing of this data is based on Article 6(1)(b) of the GDPR (performance of a contract), as the payment is necessary for the fulfillment of the contract. Stripe may also process the transmitted data for its own purposes, in particular for fraud prevention and to optimize its own services.
For more information on how Stripe processes personal data, please refer to Stripe’s privacy policy: https://stripe.com/privacy.
Data Transfer to Third Countries (USA)
Stripe may also transfer personal data to countries outside the European Union, in particular to the United States. To ensure an adequate level of data protection, Stripe uses the Standard Contractual Clauses (SCCs) approved by the European Commission.
Data subjects have the right to request information about the data stored by Stripe and to request its correction or deletion. Inquiries can be directed to Stripe directly: https://support.stripe.com/contact.
Definitions
This privacy policy is based on the terminology used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our aim is for this privacy policy to be easy to read and understand for both the general public as well as our customers and business partners. To ensure this, we would like to explain the terminology used in advance.
a) Personal Data
Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific characteristics that express the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
b) Data Subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing.
c) Processing
Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Name and Address of the Controller
Controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union, and other regulations related to data protection is:
Name: Rene Erler
Address: Achenseestraße 164, 6215 Achenkirch – Austria
Email: info@alpakamanager.at
Cookies
This website uses cookies. Cookies are text files that are stored on a computer system via an Internet browser.
| Name | Purpose | Validity |
|---|---|---|
| .AspNetCore.Antiforgery.* | Stores a security token that protects forms and requests against cross-site request forgery (CSRF). | Session |
| .AspNet.Consent | Stores whether you have consented to the use of cookies. | 1 year |
| .AspNetCore.Cookies | Keeps you signed in to the administrative area of the web application. Only set for signed-in users, not for other site visitors. | up to 1 year; session if you sign in without “Stay signed in” |
| .AspNetCore.Session | Assigns your requests to a server-side session while you use the application. | Session (30 minutes of inactivity) |
| .AspNetCore.Correlation.Google.* | Only set while signing in with Google; protects the sign-in process against tampering. | 15 minutes |
| .AspNetCore.Culture | Stores the selected language. | 1 year |
| alpaka-font-scale | Stores the font size chosen in your user account so pages are shown in that size right away. | 1 year |
| loginFresh | Marks the first page after signing in so no unnecessary notices about your permissions are shown. | 30 seconds |
| claimsNotification | Carries a notice when your permissions or licence have changed; deleted once shown. | 5 minutes |
| JustLoggedOut | Set after logout to force the Google account selection on the next login. | 5 minutes |
| __stripe_mid | Used by Stripe when buying a licence to identify a session across multiple page requests. | 1 year |
| __stripe_sid | Stores a session ID for Stripe to enable fraud detection and payment processing. | 30 minutes |
Local storage in the browser
For some settings the web application uses your browser's local storage (local storage or session storage). This data stays on your device, is not transmitted to us and can be deleted in your browser settings. Session storage entries are deleted when the tab is closed.
| Name | Purpose |
|---|---|
| alpaka-theme | Selected theme (light or dark). |
| DataTables_* | View of the animal list (sorting, page length, search) so it stays the same on your next visit. |
| alpakaScopeFilterHint_v55 | Remembers that the hint about the animal list filter has already been shown. |
| pwaInstallDismissed, pwaInstalled | Remembers whether the app was installed or the install prompt was dismissed. |
| newsAutoOpened (Session Storage) | Prevents the news from opening automatically more than once in the same session. |
| publicBackLink (Session Storage) | Remembers which marketplace page you came from to an animal, so “Back to the marketplace” still works after changing the language. |
Retention and deletion of farm data
We store your farm's data (animals, health and breeding records, files, user accounts) for as long as the licence is valid. When the licence expires, the data is kept for a while so you can continue seamlessly after a renewal:
- 6 months after the licence has expired, we notify the farm's managers by e-mail.
- If the licence is not renewed within 30 days of that e-mail, we lock access and archive the data. Archived data is no longer visible to anyone; renewing the licence restores it.
- No earlier than 3 months after archiving, we permanently delete all of the farm's data, including uploaded files.
- User accounts that no longer belong to a farm are deleted once their registration is more than 90 days old.
- We keep the name and e-mail address of deleted user accounts for 12 months as a record and delete them afterwards.
- Application log entries (containing the user name) are deleted after 30 days.
The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in allowing customers to return without losing data (Art. 6(1)(f) GDPR). You can request earlier deletion at any time at info@alpakamanager.at.
Map services and location
Map on the marketplace (alpakas-kaufen, deckhengste): the map is only loaded when you click “Show map”. Your browser then loads map images from the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom), transmitting your IP address and the addresses of the requested map images. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR); the EU Commission has issued an adequacy decision for the United Kingdom. Privacy policy: https://osmfoundation.org/wiki/Privacy_Policy.
Radius search: the postcode or place you enter is only looked up in our own place table (data from GeoNames, no request to third parties). If you choose “My location”, your browser asks for permission; the location stays in your browser and is not transmitted to us – the distance is calculated there.
Plan route: farms that have released their exact location offer a link to Google Maps. Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) only opens when you click it, and its privacy policy applies: https://policies.google.com/privacy.
Location of the farms: each farm decides in its settings whether its location is shown on the marketplace not at all, approximately (rounded to about 5 km) or exactly; the default is “don't show”.
Maps in the application (pasture management, farm location in the settings, logged-in users only): depending on the chosen map type your browser loads map images from OpenStreetMap, Esri (Esri Inc., USA), EOX (Sentinel-2, Austria), basemap.at (City of Vienna), swisstopo (Switzerland), PDOK (Netherlands), ČÚZK (Czech Republic) or USGS (USA), transmitting your IP address to that provider. For the automatic slope of a pasture its coordinates are sent to OpenTopoData (api.opentopodata.org) or Open-Elevation (api.open-elevation.com). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
Matomo (formerly Piwik)
This website uses the web analytics service Matomo (formerly Piwik) to analyze and regularly improve the use of our website. For more details, please visit the provider's website at https://matomo.org/privacy/.
| Name | Purpose | Validity |
|---|---|---|
| _pk_id | Visitor ID used by Matomo to recognize returning visitors. | 13 months |
| _pk_ref | Contains information about the visitor's referrers. | 6 months |
| _pk_ses, _pk_cvar, _pk_hsr | Session cookies that keep the “active” status for 30 minutes after the user's last action. | 30 minutes |
| mtm_consent, mtm_consent_removed | Stores whether you have consented to or declined web analytics. | 30 years (Matomo default) |