Privacy Notice

Last updated: 18 August 2026 · Version 1.0

Privacy Notice PROsolutions 2013 GesmbH Last updated: 18 August 2026 · Version 1.0

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

PROsolutions 2013 GesmbH Althoeflein 9 2143 Großkrut, Austria

Registered seat: Großkrut Commercial register no.: FN 405457k Register court: Landesgericht Korneuburg VAT ID: ATU68282011 Managing director: Leopold Müllner

Phone: +43 664 1939615 Email (data protection): leopold.muellner@prosolutions.online Email (general): sales@prosolutions.online

We trade under the brand PROsolutions. This notice applies to the website prosolutions.online and to the brands and services offered through it (PROhome, PROarchidex, PROhouse, PROmaterials, PROproduction, PROsaaS, PROVIS, PROPPT), unless a separate privacy notice is provided in a particular case.

1.1. Data protection officer

We have not appointed a data protection officer, as the conditions of Art. 37 GDPR are not met. For any privacy-related question, please contact:

Leopold Müllner Email: leopold.muellner@prosolutions.online Phone: +43 664 1939615

2. Principles

We process personal data solely in accordance with the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). We

collect only the data required for the respective purpose and retain it only for as long as necessary for that purpose or as required by statutory retention obligations.

Providing your data is generally neither legally nor contractually required. However, certain data is necessary to enter into and perform a contract; without it we cannot perform the contract. We indicate such cases separately at the point of collection.

3. Processing activities in detail

3.1. Visiting our website (server log files)

Data: IP address, date and time of access, page or file requested, volume of data transferred, HTTP status code, referrer URL, browser and operating system used.

Purpose: Providing and delivering the website, ensuring system security and stability, detecting and preventing attacks, error analysis.

Legal basis: Art. 6(1)(f) GDPR (legitimate interests). Our legitimate interest lies in the technically sound and secure operation of our website.

Retention: 7 days for regular log files; in the event of a security incident, until the incident has been fully resolved.

Recipients: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as a processor under Art. 28 GDPR. Storage takes place exclusively in the AWS Frankfurt am Main region (eu-central-1), Germany; processing takes place there, apart from the remote support access described in section 5.

3.2. Cookies and similar technologies

We use cookies and comparable technologies (e.g. local storage) on our website.

Strictly necessary cookies are required to operate the website (e.g. session management, security and session functions). The legal basis is Art. 6(1)(f) GDPR in conjunction with § 165(3) TKG 2021, under which strictly necessary cookies do not require consent. Our legitimate interest lies in providing a functional and secure website.

All other cookies — in particular those used for statistics, analytics, marketing or personalisation — are set solely on the basis of your explicit consent under Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021. We do not currently set any such cookies. As soon as we do, we will obtain your consent in advance through a cookie banner and provide a „Cookie settings“ link in the footer of every page allowing you to withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Cookies currently in use: We use strictly necessary cookies only. We do not use statistics, analytics or marketing cookies.

Logging of your cookie decision. Because we currently use strictly necessary cookies only, we operate no cookie banner and therefore keep no consent records. As soon as we deploy optional cookies we will obtain your consent in advance through a cookie banner and store, in addition to the cookie, a server-side record of that decision — the categories selected, the time rounded to the hour, the version of the banner and of this notice, and the IP address underlying the request. The purpose would be to demonstrate consent; the legal basis Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR, retained for the validity of the consent plus three years (limitation period).

Because we use strictly necessary cookies only, no consent is required for them under § 165(3) TKG 2021. As soon as we deploy any optional cookies, we will obtain your prior consent through our cookie banner and extend this overview accordingly.

Our marketing pages (prosolutions.online and the brand sites) set no cookies at all. The two cookies above are set only by the signed-in applications (ERP, shop, planner) and are strictly necessary for them to work. We use no statistics, analytics, marketing or personalisation cookies, and we embed no third-party content that could set any. Because we use strictly necessary cookies only, no consent is required under § 165(3) TKG 2021 and we therefore do not operate a cookie banner.

3.3. Contacting us by email or contact form

Data: Name, email address, and where applicable company, phone number, the content of your message and any other information you choose to provide.

Purpose: Handling and answering your enquiry, and linking any follow-up correspondence.

Legal basis: - Art. 6(1)(b) GDPR where your enquiry is directed at concluding or performing a contract (pre-contractual measures); - Art. 6(1)(f) GDPR in all other cases. Our legitimate interest lies in responding to enquiries addressed to us.

Retention: Until your enquiry has been fully dealt with. Thereafter, where the correspondence is of a commercial nature, we retain it under commercial and tax retention obligations (§ 212 UGB, § 132 BAO: seven years). Correspondence not subject to retention obligations is deleted after 12 months.

Recipients: Our email and CRM provider as a processor. Enquiries submitted through the contact form and to sales@prosolutions.online are recorded in our CRM.

3.4. Clients — pre-contractual stage, contract and fulfilment

Data: Company name, names and roles of contact persons, address, contact details, VAT ID, banking and payment data, project and design data (including the room and 3D designs you create), order, delivery and installation data, complaints and warranty matters, communication history.

Purposes: Quotation and pricing, conclusion and performance of the contract, production and delivery through our partner network, installation, invoicing and payment processing, client care and support, handling complaints and warranty claims, accounting.

Legal bases: - Art. 6(1)(b) GDPR — performance of the contract or pre-contractual measures (where the contracting party is a natural person); - Art. 6(1)(f) GDPR — legitimate interest in managing the business relationship, where contact persons at a corporate client are concerned; - Art. 6(1)(c) GDPR — compliance with legal obligations, in particular under company, tax and accounting law.

Retention: For the duration of the business relationship. Thereafter seven years under § 212 UGB and § 132 BAO, calculated from the end of the calendar year for which the records were made (where a diverging fiscal year is used, from the end of the calendar year in which that fiscal year ends). Beyond that, we retain data at most until the

applicable warranty and limitation periods expire, where necessary to bring or defend legal claims: warranty two years for movable and three years for immovable goods from delivery (§ 933 ABGB), and for consumer sales of goods two years under §§ 10 et seq. VGG with the three-month limitation period under § 13 VGG; damages generally three years from knowledge of the damage and the party liable (§ 1489 sentence 1 ABGB); exceptionally thirty years in the cases of § 1489 sentence 2 ABGB (where the damage or the party liable remains unknown, or the damage arises from an intentional offence punishable by more than one year’s imprisonment).

Recipients: Production and supply partners within our European network, installation partners, transport and logistics companies, payment service providers and banks, tax advisers and auditors, legal counsel, IT and hosting providers, and public authorities where legally required.

3.5. Business contacts and prospects

Data: Name, role, company, business contact details, notes on interests and conversations, source of the contact (e.g. trade fair, event, website, professional network), communication history.

Purposes: Maintaining the business relationship, contact management in our CRM, handling enquiries, informing you about our services.

Legal bases: - Art. 6(1)(f) GDPR — legitimate interest in business development, relationship management and direct marketing to businesses (see Recital 47 GDPR); - Art. 6(1)(a) GDPR — your consent where required, in particular for sending electronic marketing.

Electronic marketing: To prospects, we send newsletters and other electronic direct marketing solely on the basis of your prior consent (Art. 6(1)(a) GDPR in conjunction with § 174(3) TKG 2021).

To existing clients we may send electronic marketing without separate consent only under the narrow conditions of § 174(4) TKG 2021, which apply cumulatively: we obtained the email address in connection with a sale to you, the marketing concerns our own similar products or services, you were able to refuse such messages free of charge and without difficulty both at the point of collection and in every individual message, and you are not listed on the register under § 7(2) ECG (the “ECG-Liste”), which we check before each send. The legal basis in that case is Art. 6(1)(f) GDPR; our legitimate interest lies in direct marketing of our own similar services to existing clients.

You may object or withdraw your consent at any time — via the unsubscribe link in every message or informally to the contact address above. We do not currently send a newsletter or any other electronic direct marketing. Should we begin to do so, we will update this notice in advance with the provider used and with any evaluation of open and click rates.

Retention: Until you object or withdraw, and in any event no longer than 24 months after the last contact. Unsubscribe data is kept permanently on a suppression list as proof of the opt-out (Art. 6(1)(c) and (f) GDPR).

Recipients: CRM and marketing providers as processors.

3.6. Source of data where we do not obtain it from you directly

Where we do not collect personal data directly from you (Art. 14 GDPR), it originates from the following sources:

from your employer or the company with which we have a business relationship, where you are named there as a contact person; from our production, supply and installation partners, where necessary to fulfil an order; from publicly accessible sources, in particular company websites, the commercial register, industry directories and professional networks; from trade fairs, events and industry conferences at which you provided us with your business contact details.

The data concerned falls within the categories listed in sections 3.4 and 3.5, in particular name, role, company and business contact details.

3.7. User accounts and platform use

Where you create an account on one of our platforms, we process the registration data you provide (name, email address, password in hashed form, company details) and usage data (login times, projects and designs created, configurations, price calculations).

Purposes: Providing and operating the account, authentication, storing your projects, abuse prevention, support.

Legal basis: Art. 6(1)(b) GDPR (the contract for use of the platform) and Art. 6(1)(f) GDPR (security and abuse prevention).

Retention: For as long as the account exists. Following deletion of the account, data is erased within 30 days unless statutory retention obligations apply.

Platforms with user accounts include in particular PROarchidex, PROVIS and PROPPT, as well as the webshop and configurator functions.

3.8. Use of artificial intelligence

We use artificial intelligence at the design and planning stage. This section explains what for, what data is processed and who receives it.

a) What we use AI for. In PROarchidex, PROVIS, PROPPT and our configurators, AI supports:

generating design proposals, room and floor-plan layouts and 3D visualisations; producing plans and prefilled documents from your project data; standards checks, i.e. automated comparison of a design against building standards; preparing production data for our manufacturing network.

b) What data is processed. We process your project and configuration inputs: dimensions, room geometries, materials, quantities, specification preferences, and

delivery and installation parameters. The legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures and of the contract) and Art. 6(1)(f) GDPR for quality assurance and the further development of our tools.

c) Prices are not set by AI. Prices are not generated by AI. They come from stored price lists and depend on the configuration selected and on your customer category — trade customers receive different terms from consumers. That distinction attaches to the type of business relationship, not to you as a person, your behaviour or any profile of you. No person-based price differentiation takes place.

d) Transmission to the AI provider. We use an external AI interface to generate designs, plans and production data. Only technical project and design data is transmitted — no customer master data, no contact details and no payment data. The legal basis is Art. 6(1)(b) and (f) GDPR. The provider is a processor under Art. 28 GDPR and does not use the data to train its own models.

e) No automated decision about you as a person. The systems used produce suggestions, plans, check results and calculations. They evaluate neither you nor your personal characteristics. We do not carry out decisions based solely on automated processing — including profiling — within the meaning of Art. 22(1) GDPR that produce legal effects concerning you or similarly significantly affect you. We do not perform automated creditworthiness checks or scoring.

f) Results are non-binding. Designs, plans and standards checks are automated preliminary checks. They do not replace review by a qualified, licensed planner and do not constitute a building-permit submission plan.

g) Retention. We store project and configuration data for as long as the user account exists (section 3.7); without a user account we delete it after 90 days unless an order results from it. At the AI provider, transmitted content is deleted in accordance with the periods agreed in the data processing agreement. Only aggregated and anonymised data feeds into the development of our own models. You may object at any time under Art. 21(1) GDPR to processing based on Art. 6(1)(f) GDPR (section 6.1).

3.9. Payment processing

What data: billing and delivery address, order and invoice number, amount, the payment method chosen and the details belonging to it. For cryptocurrency payments these are the wallet address and the transaction identifier; for cash on delivery the carrier receives the amount to be collected.

Purpose: processing and allocating your payment, accounting, fraud prevention.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR for tax record-keeping obligations.

Recipients: the payment service concerned as an independent recipient (section 4.2), our bank, our tax advisers.

Retention: seven years under § 212 UGB and § 132 BAO.

Note on cryptocurrency payments: a blockchain transaction is publicly visible and cannot technically be altered or deleted. What is recorded there — in particular the wallet address, the amount and the time — can be removed neither by us nor by the payment service. To that extent we cannot give effect to a right to erasure under Art. 17 GDPR. This concerns only the blockchain data itself; the order and invoice data held by us is deleted according to the periods stated above. If you would rather avoid this, please choose a different payment method.

4. Who else receives your data

Within our company, only those individuals who need your data for their task have access to it.

Externally, we share data in three situations only. We do not sell your data and we do not pass it on for third parties’ advertising purposes.

4.1. Service providers acting on our behalf (processors)

These companies process your data solely on our instructions and may not use it for their own purposes. We have concluded a data processing agreement under Art. 28 GDPR with each of them.

IT support, maintenance and development of our systems are carried out by our own staff; no external IT service provider is engaged for this. No newsletter provider is in use, as we do not currently send electronic direct marketing.

4.2. Independent controllers

These recipients decide on the processing themselves and are separately responsible for it under data protection law. We transmit only what is necessary to fulfil your order or to meet our obligations.

4.3. Public authorities and courts

We transmit data to authorities and courts only where we are legally obliged or entitled to do so — for example to tax authorities, social insurance bodies, or in the course of legal proceedings (Art. 6(1)(c) GDPR).

5. Transfers to third countries

Our website, our platforms and our data storage are located within the European Economic Area. A third-country transfer may however arise from our use of an AI provider; the information below is therefore set out separately by provider.

Our website and platforms run on Amazon Web Services in the Frankfurt am Main region (eu-central-1), Germany. Our contracting party is Amazon Web Services EMEA SARL, seated in Luxembourg. Storage takes place exclusively in Germany; processing takes place there, apart from the remote access described below.

In exceptional cases, remote access from outside the EEA may occur in the course of technical support. Such access constitutes a transfer to a third country in data protection terms. It is covered by the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, which form part of the data processing agreement concluded with Amazon Web Services (the AWS Data Processing Addendum). A copy of the clauses is available on request at the contact address above.

AI provider. For generating designs, plans and production data (section 3.8) we use Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA. Only technical project and design data is transmitted. Where such data has a personal reference in an individual case — for example through its attributability to your project — the following applies:

Transfer to the United States. Processing by the AI provider also takes place in the United States. The transfer is based on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR together with supplementary measures. A copy of the safeguards relied upon is available on request at the contact address above.

Should we engage further providers outside the EEA in future, we will amend this privacy notice beforehand and state the legal basis for the transfer concerned.

6. Your rights as a data subject

You have the following rights in relation to us:

6.1. Right to object — specific notice

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where we process your data for direct marketing purposes, you have the right to object at any time and without giving reasons. Following such an objection we will no longer process your data for direct marketing purposes.

6.2. Exercising your rights

An informal message to leopold.muellner@prosolutions.online or to the postal address above is sufficient to exercise your rights. We will respond without undue delay and at the latest within one month of receipt; for complex requests this period may be extended by up to two further months, and we will inform you if that applies. To protect your rights we may need to verify your identity.

7. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

The supervisory authority responsible for us is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40–42 1030 Vienna, Austria Phone: +43 1 52 152-0 Email: dsb@dsb.gv.at Web: www.dsb.gv.at

8. Data security

We implement technical and organisational measures under Art. 32 GDPR to protect your data against loss, misuse and unauthorised access. These include in particular:

encrypted transmission of all content via TLS (HTTPS); encryption of stored data and backups in the AWS Frankfurt region; access restrictions on a need-to-know basis, individual user accounts and multi-factor authentication for administrative access; logging of administrative access; regular, separately stored backups; obliging all staff to maintain data secrecy under § 6 DSG; regular updating of the systems and components in use.

No technical measure offers absolute protection. We review our measures continuously and adapt them to the state of the art.

9. Changes to this privacy notice

We will update this notice when our processing activities or the legal framework change. The version published on our website applies in each case. We will inform data subjects separately of any material changes.

This document is a draft for internal use. It does not replace legal advice in an individual case. Before publication, all placeholders must be completed and the processing described must be reconciled with actual practice.

This privacy notice exists in a German and an English version. In case of discrepancies, the German version prevails. Because the transparency obligation under Art. 12(1) GDPR

is assessed against the version actually presented to the data subject, both versions must be kept substantively identical.