Privacy policy
What this website learns about you, what we need it for and when we delete it.
We want to know as little about you as possible. For visitors, this website sets no cookies and stores nothing in your browser’s storage. It loads no content from outside servers. Whatever data still arises, we explain here in full.
Who is responsible
The controller is SpiceCRM FlexCo, Wienerbergstraße 11, 1100 Vienna, Austria. For questions about data protection, reach us at office@spicecrm.com or by phone at +43 (1) 89083610.
When you open a page
Whenever you open a page, your browser sends technical data to our server. The server logs, among other things, the IP address, the time and the address requested. We need these logs for secure operation and to fend off attacks. If the server detects repeated attack patterns, it temporarily blocks the IP address concerned. We delete archived logs after seven days at the latest. The legal basis is our legitimate interest in secure operation. It rests on Article 6 paragraph 1 point f of the General Data Protection Regulation.
How we measure reach
We want to know which content gets read and which does not. For this we use the analytics software Matomo on our own server. Here, Matomo works without cookies and stores nothing on your device. Your IP address is shortened before it is stored. For IPv4 addresses, the last two of the four number blocks are dropped.
We also store the pages opened, the time and technical details of browser and operating system. Of the page that referred you, we store only the address without appended parameters. Matomo groups page views in quick succession into one visit. If your browser has Do Not Track switched on, Matomo does not record your visit.
We delete the individual records after 180 days; only aggregated figures remain after that. The legal basis is our legitimate interest in improving the website under Article 6 paragraph 1 point f.
When you write to us
The contact form asks for your first name, last name, email address, company, product of interest and message. Required fields are marked with an asterisk. The website itself does not store your enquiry. It passes it straight to our own CRM system, SpiceCRM. We use the details only to answer your enquiry.
A field invisible to people and ALTCHA protect the form against automated submissions. ALTCHA solves a small computing task in your browser and sets no cookies. If you email us, Microsoft also processes your message, as our email service runs on it.
The legal basis is your consent under Article 6 paragraph 1 point a of the General Data Protection Regulation. If your enquiry aims at a contract, point b applies as well. We delete your details once your enquiry is settled. If a contract results, the statutory retention periods apply.
When you request content
Some content, such as our white papers, we send you on request. For this we need your email address, your first and last name and your company. The website passes these details on to SpiceCRM. From there you receive a personal, time-limited download link by email. The link is valid for seven days. When you open the link, we store the time of access with your request.
The legal basis is your consent under point a. We delete the data as soon as you withdraw your consent. At the latest, we delete it 24 months after your last contact, unless a business relationship results from it.
When you use the price calculator
The price calculator works out its proposal in your browser. Your answers leave the browser only when you send the proposal as an enquiry. Your answers and the proposal then go to SpiceCRM together with name, company, email address and, if given, phone number. We use these details to make you a suitable offer.
The legal basis is your consent under point a, and point b for the offer. Deletion follows the same rules as for the contact form.
When you want news from us
In our forms you can tick, voluntarily, that you would like to receive occasional news about Spice by email. We send nothing until you confirm your sign-up through a link in a confirmation email. For this we store your email address, your name and the time of your consent. We send our news with SpiceCRM, our own software. Every issue contains a link you can use to unsubscribe at any time.
You can withdraw your consent at any time. The unsubscribe link in every message or an email to office@spicecrm.com is enough. We keep the details until you withdraw. The legal basis is your consent under point a.
When you apply to work with us
The form on the careers page asks for your name, email address and message. The website stores these details in its own database. We use them only to process your application. The legal basis is your consent under point a, and point b for the application itself. If no employment results, we delete your details after seven months.
Where the data is kept
The website’s web server and database run in a Google Cloud data centre in Frankfurt am Main. Our SpiceCRM instance also runs in the Google Cloud, in the Frankfurt am Main region (Germany). This is where we process the details from the contact form, content requests and the price calculator. Google processes the data only on our behalf. This rests on a data processing agreement under Article 28 of the General Data Protection Regulation. We do not sell data and do not pass it on for advertising.
We use Microsoft 365 for email, for example when you write to us at office@spicecrm.com. Microsoft processes this data on our behalf. This rests on a data processing agreement under Article 28 of the General Data Protection Regulation. A transfer to countries outside the EU, in particular to the USA, cannot be ruled out. Microsoft Corporation participates in the EU-US Data Privacy Framework. The European Commission has issued an adequacy decision for this framework under Article 45 of the General Data Protection Regulation.
What we do not use
We embed no maps, videos or social network buttons.
Your rights
You have the right of access, rectification, erasure and restriction of processing. You also have the right to data portability. You may object to processing based on our legitimate interest. You may withdraw any consent you have given at any time. This does not affect what happened before. In each case, an email to office@spicecrm.com is enough. You may also lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
Last updated: 12 November 2026