Privacy Policy

Last updated: 19 October 2026

1. Controller

Loomitech GmbH
Zimmermanngasse 8
1090 Vienna, Austria
Email: hello@mergeport.com

2. Website delivery and hosting

This website is delivered using AWS Amplify Hosting. When a page is requested, technically necessary connection data is processed. This may include the IP address, time of access, requested URL, referrer, and browser and device information.

This processing is necessary to deliver the website, maintain its stability and security, and investigate technical errors. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. We do not use this data to create user profiles or for marketing analytics. Technical log data is retained only for as long as necessary for operation, security, and troubleshooting, or where statutory retention obligations apply.

The provider is Amazon Web Services (AWS). Information about data protection in AWS Amplify is available in the AWS documentation and the AWS Privacy Notice.

3. Cookies, analytics, and embedded services

We do not use external web analytics services, advertising pixels, marketing cookies, or embedded third-party chat. The optional source tracking described below takes place with your consent in the current browser tab and is not a general visitor counter.

We use Cloudflare Turnstile to protect the newsletter and contact forms from automated abuse. When the security check loads, Cloudflare processes technical signals such as the IP address, TLS fingerprint, user-agent, site key and origin to distinguish humans from bots. This processing protects the form and is based on our legitimate interest under Article 6(1)(f) GDPR. Further information is available in Cloudflare's Turnstile Privacy Notice.

4. Contacting us

If you contact us using the contact form, by email or by phone, we process the information you provide to answer your request and manage the related communication. Depending on the subject of the request, the legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual steps, or our legitimate interest in handling business enquiries under Article 6(1)(f) GDPR. We delete the information when it is no longer required for the request, unless statutory retention obligations apply.

For contact form inquiries, we transfer your name, company, email address, selected audience and language, acknowledgement of the privacy notice, and an optional request for MERGEPORT Infrastructure Updates through Make to our CRM Attio. We store the inquiry there with its receipt time and technical submission ID. Make validates the Turnstile token server-side and maintains a technical processing register to identify duplicate submissions and uncertain processing steps. The token is not stored in Attio. The inquiry is stored independently of newsletter status. A newsletter subscription becomes active only after successful Double Opt-in confirmation with Brevo.

Optional answers and source tracking

In the contact form, you may optionally tell us how you found MERGEPORT and add further details. We store these answers with your inquiry through Make in Attio to understand and improve our information and acquisition channels. The legal basis for these voluntarily submitted answers is our legitimate interest under Article 6(1)(f) GDPR. Answering is not required to contact us.

Only if you explicitly allow source tracking, we store selected campaign parameters (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the landing page path without other URL parameters or fragments, the domain of an external referring website and capture timestamps in your current browser tab. The first and last identifiable sources are retained as you navigate our website. The source session is treated as expired after 30 minutes of inactivity; session storage ends when you close the tab. We do not create a persistent visitor ID or recognise you across visits.

The legal basis for this storage and subsequent processing is your consent under Section 165(3) Austrian Telecommunications Act 2021 and Article 6(1)(a) GDPR. Your choice is stored for the current tab so we can respect it. You can withdraw permission at any time for the future using “Source tracking: change or withdraw your choice” on this page. This deletes source data stored in this tab. Without permission, no automatic source data is stored or transmitted for the contact form.

Only when you submit a contact inquiry do we send the permitted source data, form path and technical format version through Make to Attio. An optional answer in the form is submitted independently of automatic tracking. These details are retained with the inquiry and deleted when no longer needed for the stated purposes, unless retention obligations apply. They are not sent to Brevo as new attributes and do not establish newsletter consent.

5. Newsletter

When you subscribe to MERGEPORT Infrastructure Updates, we process your email address, selected language, selected company type (ICP type), technical sign-up source, and consent and confirmation status. We use the company type to tailor newsletter content to your audience. The legal basis for registration and delivery is your consent under Article 6(1)(a) GDPR.

We use Brevo for registration, Double Opt-in, proof of consent, and delivery. When a new registration is processed, you receive a confirmation email; the newsletter becomes active only after you open the confirmation link. An already active or pending registration does not necessarily trigger another email. Brevo may retain the subscription time and form ID as proof of consent. After confirmation, we automatically transfer the email address, preferences, sign-up source, newsletter status, timestamps, and Brevo contact ID through Make to our CRM Attio. Brevo remains authoritative for delivery eligibility and unsubscribing.

You may withdraw your consent at any time with effect for the future using the unsubscribe link in every newsletter email or by contacting hello@mergeport.com. We retain the data for the duration of the active subscription and afterwards only where necessary to demonstrate consent, process the withdrawal, or comply with legal obligations. Further information is available in Brevo's Privacy Policy.

6. External links

This website contains links to external services, including appointment booking, documentation, the MERGEPORT Controller, and the support portal. A connection to the respective provider is established only after you open such a link. The provider's own privacy information applies to processing on that service.

7. Your rights

Subject to the applicable legal requirements, you have rights including information, access, rectification, erasure, restriction of processing, data portability, and objection. You may withdraw consent at any time with effect for the future. To exercise your rights, contact us at hello@mergeport.com.

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna.

8. Changes

We update this Privacy Policy when the website, the services used, or legal requirements change.