Privacy Policy

Aerodymax GmbH

Trading as "Dymaxa" - how we handle personal data

Version: 1.0

Effective for personal data processed on or after: 18 August 2026

Last updated : 18 August 2026

Issued in English (binding version). A German translation may be provided on request; the English version prevails in case of conflict.

This policy describes how Aerodymax GmbH ("Aerodymax", "we", "us"), trading as "Dymaxa", processes personal data in connection with our website, our commercial relationships with business customers and prospective customers, and our advertising activities. It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Austrian Datenschutzgesetz (DSG).

1. Who is responsible for your data

   The controller for your personal data within the meaning of Article 4(7) GDPR is: Aerodymax GmbH, Humboldtstrasse 45/3, 8010 Graz, Austria Registered in the Austrian Firmenbuch under FN 615852s UID (VAT) number: ATU80564747 Managing Director: Almaz Ayupov Email for privacy matters: almaz@dymaxa.com We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR or § 5 DSG. All privacy enquiries, including data-subject rights requests under Sections 8 and 9 below, should be directed to the email address above.

2. Scope of this policy

   This policy explains how Aerodymax collects, uses, shares and protects personal data when you:

   • visit our website at https://dymaxa.com;

   • contact us via our website, by email, by phone, or through a form;

   • are a customer, prospective customer, or business contact of Aerodymax;

   • apply for a role with Aerodymax; or

   • otherwise interact with us in a way that involves personal data.

3. Personal data we collect
   1. Data you provide to us directly

      When you contact us, we collect the personal data you choose to provide. Currently this is typically limited to:

      • your name;

      • your email address;

      • your company name and role, where you provide them;

      • any additional information you include in your message.

      Where our website forms are extended in future to collect additional categories of data (for example, phone number, address, or specific enquiry fields), those additional categories will be described in the relevant form and this policy will be updated accordingly.

   2. Data collected automatically when you visit our website

      When you visit https://dymaxa.com, our website and our analytics provider automatically collect certain technical information about your visit, including:

      • your IP address (typically shortened or pseudonymised before storage);

      • the type of browser and device you are using, and its operating system;

      • the pages you visit on our site, the time and duration of your visit, and the referring website;

      • general location information derived from your IP address (typically at country or city level).

      This information is collected via cookies and similar technologies and only where you have given your consent through our cookie banner, save for cookies that are strictly necessary for the operation of the website. See Section 5 for detail.

   3. Data we obtain from third parties

      We may collect personal data from third-party sources for the purposes of prospecting, lead qualification and account management. This includes:

      • publicly available business information (for example, from company websites, industry publications, LinkedIn, trade databases and business directories);

      • information received from partners, referrers or introducers where you have interacted with them.

      Where we collect personal data from third-party sources about a specific individual, we will, on request or as required under Article 14 GDPR, inform that individual of the source and the processing.

4. Why we process your data and on what legal basis

   We process personal data only where we have a lawful basis under Article 6(1) GDPR. The purposes and corresponding legal bases are as follows.

   1. Responding to enquiries and pre-contractual communication

      Where you contact us, we process your contact details and message content in order to respond to your enquiry and, where relevant, to take steps at your request prior to entering into a contract. Legal basis: Article 6(1)(b) GDPR (steps prior to entering a contract) and/or Article 6(1)(f) GDPR (our legitimate interest in responding to business enquiries).

   2. Performance of contracts with customers

      Where you or your organisation is a customer of Aerodymax, we process personal data of contact persons for the purposes of contract preparation, order fulfilment, delivery, invoicing, customer support, warranty and guarantee handling, and general account management.

      Legal basis: Article 6(1)(b) GDPR (performance of a contract) where the individual is a party to the contract; Article 6(1)(f) GDPR (our legitimate interest in managing customer relationships with corporate counterparties) for contact persons of corporate customers.

   3. Marketing, prospecting and business development

      We process personal data of business contacts, prospective customers, existing customers and other individuals within our target market for direct business-to-business marketing and prospecting purposes. This includes:

      • sending business communications about our products, services and events;

      • managing our sales pipeline in our customer relationship management (CRM) system (HubSpot);

      • creating and updating advertising audiences on third-party advertising platforms (see Section 4.5 and Section 6).

      Legal basis: Article 6(1)(f) GDPR (our legitimate interest in promoting our products and services in a business-to-business context to our target market). You have the right to object to processing based on legitimate interests, including for direct marketing purposes, at any time - see Section 9.

   4. Website analytics

      We process technical and usage information about visits to our website in order to understand how the website is used, measure the effectiveness of content, and improve the website. Where this involves cookies or similar technologies that are not strictly necessary, we do so only on the basis of your prior consent.

      Legal basis: Article 6(1)(a) GDPR (your consent), read together with § 165 of the Austrian Telekommunikationsgesetz (TKG). You may withdraw your consent at any time via our cookie settings (see Section 5).

   5. LinkedIn advertising and Matched Audiences

      We use LinkedIn Ads to promote our products and services to a business audience. As part of this, we upload lists of contacts from our HubSpot CRM to LinkedIn to create so-called Matched Audiences, so that our advertising is shown to relevant business contacts within our target market on LinkedIn. The contact data uploaded is typically limited to hashed email addresses and, where available, name and company information.

      When we upload contact data to LinkedIn for the creation of Matched Audiences, LinkedIn acts as an independent controller for the matching process and for the subsequent delivery of advertising, and we and LinkedIn may be joint controllers for the audience-creation step. LinkedIn provides information about its processing in its Privacy Policy (available at https://www.linkedin.com/legal/privacy-policy).

      Legal basis: Article 6(1)(f) GDPR (our legitimate interest in reaching relevant business contacts through targeted business-to-business advertising). You may object to this processing at any time by contacting us at almaz@dymaxa.com; on receipt of such an objection, we will remove your data from any LinkedIn Matched Audience upload we control.

   6. Recruitment

      Where you apply for a role with Aerodymax (whether in response to a vacancy or on a speculative basis), we process the personal data contained in your application (typically CV, cover letter, contact details, and any information you provide during the interview process) for the purpose of assessing your suitability and, where relevant, entering into an employment relationship.

      Legal basis: Article 6(1)(b) GDPR (steps prior to entering an employment contract at your request) and, where you consent to your data being retained beyond the recruitment process for future opportunities, Article 6(1)(a) GDPR (consent).

   7. Compliance with legal obligations

      We process personal data where necessary to comply with our legal obligations under Austrian and EU law, including tax law (in particular § 132 of the Bundesabgabenordnung, "BAO"), commercial law (in particular § 212 of the Unternehmensgesetzbuch, "UGB"), and other applicable legal, regulatory or reporting obligations.

      Legal basis: Article 6(1)(c) GDPR (compliance with a legal obligation to which we are subject).

   8. Defence of legal claims

      We may process personal data where necessary to establish, exercise or defend legal claims.

      Legal basis: Article 6(1)(f) GDPR (our legitimate interest in protecting our legal position); Article 9(2)(f) GDPR to the extent special-category data is involved.

5. Cookies and similar technologies

   Our website uses cookies and similar technologies (together, "cookies") to enable the website to function, to analyse how it is used, and — where you consent — to support marketing and advertising.

   1. Categories of cookies

      Strictly necessary cookies. These are required for the basic operation of the website (for example, session and security cookies, and cookies that remember your cookie preferences). These are set on the basis of § 165(3) TKG (necessary for the transmission of a communication or the provision of a service explicitly requested by the user); no consent is required.

      Analytics cookies. We use Google Analytics (a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how our website is used. Google Analytics sets cookies that collect information about your visit, including your (typically shortened) IP address, the pages you visit, the time and duration of your visit, and the type of device you are using. Google Analytics data may be transferred to Google LLC in the United States (see Section 7 for the safeguards applicable to international transfers). These cookies are set only with your prior consent.

      Marketing and advertising cookies. We may in future use cookies to support marketing and advertising activities, including remarketing and conversion tracking with third-party advertising providers (such as LinkedIn or Meta). Where such cookies are used, they will be set only with your prior consent, and this policy will be updated to identify the specific providers and the data they collect.

   2. How to manage your cookie preferences

      When you first visit our website, you are presented with a cookie banner allowing you to accept or reject non-essential cookies. You can withdraw or change your consent at any time through the cookie settings link on our website. Withdrawing consent does not affect the lawfulness of processing that took place before the withdrawal.

      You can also block or delete cookies through your browser settings. Please note that blocking strictly necessary cookies may impair the functionality of the website.

6. Who we share your data with

   We share personal data only with recipients who have a legitimate need to receive it, and only on the basis of a lawful ground. The categories of recipients are as follows.

   1. Processors acting on our behalf

      The following categories of service providers process personal data on our behalf as processors under Article 28 GDPR, in each case under a written data processing agreement:

      • HubSpot (HubSpot Ireland Limited, 2 Dockland Central, Dublin 1, Ireland, with processing infrastructure operated by HubSpot, Inc.) - our customer relationship management (CRM) platform, used for managing customer and prospect data, sales pipeline, and business communications.

      • Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) - website analytics via Google Analytics (see Section 5).

      • Website hosting provider - our website is hosted by a professional hosting provider, which processes technical data (including IP addresses and server-log data) in connection with delivering the website to your device.

      • Email and productivity infrastructure - the email and productivity tools we use to correspond with you and store business records are provided by professional service providers under data processing agreements.

      As our service-provider stack evolves, we may add or replace processors. Where we do so, this policy will be updated to reflect the change.

   2. Independent recipients and joint controllers

      LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland) — where we upload contact lists to LinkedIn for the creation of Matched Audiences (see Section 4.5), LinkedIn processes that data for the purposes of matching and advertising delivery. For the matching step, we and LinkedIn may act as joint controllers within the meaning of Article 26 GDPR; for LinkedIn's own subsequent processing, LinkedIn acts as an independent controller under its own privacy policy.

   3. Legal, regulatory and professional recipients

      We may disclose personal data to competent authorities (tax authorities, courts, supervisory authorities) where we are required to do so by law, and to our professional advisers (lawyers, accountants, auditors) under professional confidentiality obligations, where necessary for the establishment, exercise or defence of legal claims or the performance of our legal obligations.

7. International transfers of personal data

   Some of our service providers (in particular HubSpot, Google, and LinkedIn) are established in, or transfer personal data to, the United States. Where personal data is transferred outside the European Economic Area ("EEA"), we ensure an adequate level of protection through one or more of the following safeguards:

   • for transfers to recipients in the United States that are certified under the EU-U.S. Data Privacy Framework ("DPF"), we rely on the European Commission's adequacy decision of 10 July 2023 (Commission Implementing Decision (EU) 2023/1795);

   • for transfers not covered by an adequacy decision, we rely on the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), supplemented where necessary by additional technical, contractual and organisational measures.

   A copy of the safeguards applicable to a specific transfer can be requested by writing to almaz@dymaxa.com.

8. How long we keep your data

   We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The retention periods we apply are as follows.

   • Customer and contract records: 7 years from the end of the calendar year in which the last relevant transaction occurred, in accordance with § 132 BAO and § 212 UGB.

   • Prospect, lead and marketing contact data (including data held in our HubSpot CRM): 3 years from the date of last meaningful contact with the individual, unless a shorter period is required or a longer period is justified (for example, where the individual has become a customer, in which case the customer retention rule above applies).

   • Website enquiries and general correspondence not resulting in a contract: 3 years from the date of last correspondence.

   • Recruitment data: 6 months from the conclusion of the recruitment process, unless you have consented to your data being retained for longer for the purpose of considering you for future opportunities (in which case up to 2 years from your consent).

   • Website analytics data: in line with the retention configured in Google Analytics (typically no longer than 14 months for user-level and event-level data).

   • Cookie consent records: the record of your cookie consent (or refusal) is retained for as long as reasonably necessary to evidence your choice, typically up to 24 months.

   Where personal data is required for the establishment, exercise or defence of legal claims, it may be retained for the duration of the applicable limitation period under Austrian law (typically up to three years under § 1489 ABGB, or longer where a longer period applies).

9. Your rights

   Subject to the conditions set out in the GDPR, you have the following rights in respect of your personal data:

   • Right of access (Article 15): to obtain confirmation as to whether we process personal data about you, and to receive a copy of that data together with certain information about the processing.

   • Right to rectification (Article 16): to have inaccurate personal data corrected and incomplete data completed.

   • Right to erasure (Article 17): to have your personal data erased in the circumstances set out in the GDPR.

   • Right to restriction of processing (Article 18): to have the processing of your personal data restricted in certain circumstances.

   • Right to data portability (Article 20): to receive personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller, where the processing is based on your consent or on a contract and is carried out by automated means.

   • Right to object (Article 21): to object at any time to processing based on our legitimate interests (Article 6(1)(f)), including profiling. Where you object to processing for direct-marketing purposes, we will stop that processing.

   • Right to withdraw consent (Article 7(3)): to withdraw your consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before the withdrawal.

   • Right to lodge a complaint (Article 77): to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria; www.dsb.gv.at).

   To exercise any of these rights, please contact us at almaz@dymaxa.com.. We will respond within the time limits set out in Article 12(3) GDPR (in principle, within one month of receipt, extendable by up to two further months where necessary given the complexity and number of requests). We may request information reasonably necessary to verify your identity before responding to your request.

10. Security

    We implement appropriate technical and organisational measures under Article 32 GDPR to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction or damage. These measures include access controls, encrypted transmission where appropriate, access limited to those with a legitimate need, and use of professional service providers with contractual security commitments.

    No system, however, can guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority in accordance with Article 33 GDPR and, where required, communicate the breach to affected individuals in accordance with Article 34 GDPR.

11. Automated decision-making and profiling

    We do not carry out automated decision-making within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you. To the limited extent that we use automated tools to segment marketing contacts or to prioritise sales outreach (for example, within our CRM), these tools do not produce legal or similarly significant effects.

12. Children

    Our website and services are directed to business customers and business contacts, not to children. We do not knowingly collect personal data from children under the age of 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will delete it without undue delay.

13. Changes to this policy

    We may update this policy from time to time to reflect changes in our processing activities, our service-provider stack, applicable law, or supervisory-authority guidance. The current version of this policy is always published at https://dymaxa.com/privacy, together with the version number and effective date.

    Where a change is material (for example, the introduction of a new processing purpose, a new category of data, or a new tracking technology), we will draw the change to your attention by appropriate means (for example, a notice on our website, or a direct communication to customers where relevant).

14. Contact

    For any question about this policy, or to exercise any of your rights, please contact:

    Aerodymax GmbH

    Attn: Almaz Ayupov (Managing Director)

    Humboldtstrasse 45/3, 8010 Graz, Austria

    Email: almaz@dymaxa.com