Privacy

Last updated: 22 October 2026

This notice explains how CaviTech GmbH, which operates Itogix in the EU, handles personal data on its websites — the page eu.itogix.com, this page, the open demo at demo-bc.itogix.com and the customer dashboards at *.eu.itogix.com — and when you write to us or request access.

Who is responsible

CaviTech GmbH, Sterngasse 3/2/6, 1010 Vienna, Austria, hello@itogix.com (see the imprint).

Visiting our websites

When you write to us

E-mails to hello@itogix.com are forwarded by our domain provider EuroDNS S.A. (Luxembourg) to the mailbox of our team at Google (Gmail). We use your message and contact details only to answer you and, if you become a customer, to set up and run the service (Art. 6(1)(b) and (f) GDPR). We delete correspondence when it is no longer needed, unless retention periods under commercial or tax law apply.

When you request access

When you send the request form on eu.itogix.com, we store your e-mail address, company name, country, accounting program, the type of fiscal year, whether you are a company or an accounting firm, the version of the consent text you agreed to, the campaign parameters in the link you came from (utm_source, utm_medium, utm_campaign, utm_content, utm_term, m) and your browser's language setting. Your IP address is held only in the server's memory for up to 24 hours, to limit repeated requests, and is not written to disk.

We use these details to set up your access, to contact you about it and to see which of our campaigns brought requests. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to hello@itogix.com, and steps taken at your request before a contract (Art. 6(1)(b) GDPR).

The request is stored on our server in Nuremberg (Hetzner Online GmbH, our processor). A confirmation to you and a copy to our team are sent through Sendinblue SAS (Brevo), Paris, our processor; the copy goes to hello@itogix.com, which EuroDNS S.A. forwards to our team's mailbox at Google (Gmail). If we do not sign a contract within 12 months, the request is deleted; you can ask us to delete it earlier at any time.

Customer dashboards

For our customers we process accounting data and the data of their users (e-mail address, name if provided, role, sign-in times, IP address in security logs) on their behalf, as a processor under a data processing agreement (Art. 28 GDPR); the customer is the controller for that data.

If you upload a ledger export (SIE, XAF auditfile, SAF-T, DATEV or FEC), we process it on your behalf under the data processing agreement. It is stored encrypted on our server in Nuremberg. We keep the latest export (one file or a set of files) for each fiscal year while you are a customer, delete it whenever you ask and delete all exports 30 days after the contract ends. Backup copies are overwritten within 14 days. Exports contain personal data: SAF-T and XAF files include lists of customers and suppliers with names, addresses and VAT numbers, and posting descriptions can name customers, suppliers or employees. We process this data only to build your company's reports, and it is not shown outside your company's Itogix.

Sign-in codes and invitations are sent by e-mail through Sendinblue SAS (Brevo), Paris, France, acting as our sub-processor. Details are set out in the data processing agreement each customer receives.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Write to hello@itogix.com. You may also lodge a complaint with a supervisory authority, in Austria the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.