Privacy policy
This statement provides information on the processing of personal data in connection with the use of CompanyDesk in accordance with Articles 13 and 14 of Regulation (EU) 2016/679, the General Data Protection Regulation, and with the Austrian Data Protection Act and the Telecommunications Act 2021.
1. Controller and contact
The controller within the meaning of Art 4(7) GDPR is AIXI Digital GmbH, Stoß im Himmel 1, 1010 Wien, Österreich, telephone +43 676 7852585, email office@aixi.com.
Please address data protection enquiries to office@aixi.com. No data protection officer has been appointed, as the conditions of Art 37 GDPR are not met; responsibility lies with the management.
2. Processing operations in detail
2.1 Provision of the application
When the site is accessed, the hosting provider's server infrastructure processes technical access data, namely the IP address, the time of the request, the resource retrieved, the status code, the volume transferred and information on the device used. The purpose is delivery, security and stability of the service. The legal basis is Art 6(1)(f) GDPR; the legitimate interest lies in secure and trouble-free operation. These access logs are kept not by the application itself but by the hosting provider's server infrastructure; their duration and details depend on the provider's specifications. The exclusively pseudonymised identifier used additionally by the application to enforce query quotas is described separately in section 2.2.
2.2 Enforcement of query quotas
Without a user account, up to 5 queries per calendar day are currently available; with a confirmed account, up to 10 per day and 150 per calendar month. To enforce this, the IP address is not stored in plain text but only as a hash value using a secret additional value; it cannot be traced back to the address without knowledge of this value. For logged-in users, counting is based on the user ID. The legal basis is Art 6(1)(b) GDPR for performing the user relationship and Art 6(1)(f) GDPR for preventing abuse. Daily counters apply until the next change of day, monthly counters until the next change of month according to the WordPress time zone. Expired counters are removed in the next daily clean-up run; if scheduling fails, deletion may be delayed.
2.3 User account
During registration, the email address and password are processed; first name, surname and company or firm may be provided voluntarily. The password is stored only as a hash value. The purpose is establishing and performing the user relationship; the legal basis is Art 6(1)(b) GDPR. Without this information an account cannot be maintained. The data are stored for the duration of the user relationship and deleted thereafter, unless there is a statutory retention obligation. Users can completely delete their account themselves at any time in My CompanyDesk; this also removes the watchlist, printed profiles and the list of retrieved documents.
2.4 Query log
Search term, selected register, number of results, response time and time are logged. For logged-in users, the entry is assigned to the account in order to enforce quotas and prevent abuse; no query history is shown in My CompanyDesk. The legal basis is Art 6(1)(b) GDPR and, with regard to preventing automated mass queries, Art 6(1)(f) GDPR. The logs are deleted automatically after 30 days.
2.5 Watchlist and notification of changes
CompanyDesk Pro users can add up to 20 profiles to a watchlist. Stored are country and registration number, company name and the time of saving, linked exclusively to the respective account. At the user's request, the public register status of a saved record is compared once a day with the last known status; for this purpose a checksum of the public register data is stored. If essential data change, the user receives a message at their email address. The legal basis is Art 6(1)(b) GDPR. Notification can be switched off at any time in My CompanyDesk; storage ends when the entry is removed or the account is deleted.
Add-in for Word and Excel
Users of CompanyDesk Pro can use CompanyDesk in Microsoft Word and Excel. Sign-in takes place in a separate window on companydesk.eu; an access authorisation is created for each device, of which only a checksum together with the device type and the times of sign-in and last use is stored. It is valid for no more than 180 days and can be revoked at any time in My CompanyDesk or by signing out in the add-in. The add-in transmits only search terms and registration numbers; document content is neither read nor transmitted. The legal basis is Art 6(1)(b) GDPR. Microsoft’s privacy terms apply to the running of the add-in in Microsoft Office.
With a confirmed account without CompanyDesk Pro, a total of 20 queries are available in the add-in to try it out; for this purpose the number of queries already made is stored in the account. The legal basis is Art 6(1)(b) GDPR.
The add-in interface is delivered via Microsoft Azure (Microsoft Ireland Operations Limited, storage location data centre Frankfurt am Main), which acts as processor. When the add-in is opened, Microsoft processes the IP address, the time and information on the device in order to provide the interface. Search requests and account data are not exchanged via Azure but directly with companydesk.eu; the access authorisation is stored only on the respective device in the add-in’s storage. Where Microsoft accesses these data from a third country in individual cases, this is safeguarded by the standard contractual clauses in Microsoft’s data protection terms and by its certification under the EU-US Data Privacy Framework. Microsoft is independently responsible for the use of Word and Excel themselves under the terms applicable between Microsoft and the user.
Firm licence
With a firm licence, the main licensee enters the email addresses of the members. For persons without an account, CompanyDesk creates an account and sends an invitation to set a password. The email address, group membership and time of admission are processed. The legal basis is Art 6(1)(b) GDPR in relation to the main licensee and Art 6(1)(f) GDPR in relation to the member; the legitimate interest lies in providing the licence acquired by the employer or principal. The main licensee has no insight into the members’ queries.
Preferred language
The preferred language can be set in My CompanyDesk. It is stored in the account and used for the display after sign-in and for email notifications; CompanyDesk in Word and Excel follows the Office language. The legal basis is Art 6(1)(b) GDPR.
2.6 Printed profiles and retrieved documents
If a logged-in user prints a profile, the country and registration number, company name, address of the profile and time are stored for seven days so that the profile can be reopened in My CompanyDesk; the information is then removed automatically. If a logged-in user retrieves a document, for example annual accounts, the type of document, company and time are stored in a list; the document itself is not stored. The user can delete this list at any time in My CompanyDesk. The legal basis in each case is Art 6(1)(b) GDPR.
2.7 Information by email about new features and products
Only if the user has expressly consented during registration or in My CompanyDesk will AIXI Digital GmbH inform them by email about new features of CompanyDesk and new products. Consent is voluntary and not a condition of use. Messages are sent only to addresses whose owners have confirmed the account via the confirmation link. The email address and the time and content of the consent are processed. The legal basis is Art 6(1)(a) GDPR in conjunction with section 174 of the Austrian Telecommunications Act 2021. Consent can be withdrawn at any time with effect for the future in My CompanyDesk or by message to the address given above; the lawfulness of processing carried out until withdrawal remains unaffected.
2.8 Consents
Consents given and refused are logged together with the time, type of consent, version of the declaration and pseudonymised IP address. The purpose is the proof required under Art 7(1) GDPR; the legal basis is Art 6(1)(c) GDPR. They are retained for the limitation periods.
2.9 Protection of the registration form
To protect against automated registrations, the form contains a check field invisible to humans and a signed timestamp. No additional personal data are collected, no cookies are set and no third-party services are integrated.
2.10 CompanyDesk Pro: logo on printouts and retrieval record
Users of CompanyDesk Pro can upload a logo that appears in the header of their printouts; it is stored as an image file and assigned to the account. A retrieval record is also kept for Pro users: for every opening of a profile, the time, country, registration number, company name, source, date and a checksum of the key information of the profile are stored, at most the last two thousand entries. The purpose is the user's own documentation of their research, for example to meet due diligence obligations. The legal basis is Art 6(1)(b) GDPR. Logo and retrieval record are deleted when removed by the user or when the account is deleted.
2.11 Ordering CompanyDesk Pro through Paddle
CompanyDesk Pro is ordered through Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, acting as merchant of record in its own name. Paddle collects the data required for payment, invoicing and sales tax under its own responsibility; Paddle’s privacy policy applies in this respect. We receive from Paddle the email address, the customer and subscription identifiers, the country and the payment status and term of the subscription in order to activate CompanyDesk Pro for the account; we do not receive payment data such as card numbers. The legal basis is Art 6(1)(b) GDPR. The transfer to the United Kingdom is based on the European Commission’s adequacy decision of 28 June 2021. The data is stored for the duration of the subscription and thereafter until statutory retention periods expire.
3. Data from public registers, information under Art 14 GDPR
The application processes data made publicly accessible by the registering authorities. Insofar as these data concern natural persons, for example sole traders or officers authorised to represent, processing is based on Art 6(1)(f) GDPR. The legitimate interest consists in providing legally relevant, already publicly accessible information for the professional practice of the legal and business advisory professions and for initiating and conducting business relationships. The balancing of interests favours processing because only information published by the registering authorities themselves is shown, because the data are not used for advertising purposes and not passed on to advertising partners, and because the origin of every item of information is stated.
The categories processed are company name, registration number, legal form, registered office and address, status, date of registration and deletion, capital, activity and, where the authority publishes them, information about authorised officers, namely name, function, power of representation, period and date of birth; visitors who are not signed in are shown only the year of birth. Residential addresses of natural persons are not processed. Personal information is not searchable and is not combined into profiles. The origin follows from the list below and, in individual cases, from the source indicated with each result.
Sources currently set up:
cross-border, Global Legal Entity Identifier Foundation, kept by Global Legal Entity Identifier Foundation, Basel, licence: Creative Commons Zero 1.0, public domain.
Austria, Company register, high-value datasets, kept by Republic of Austria, represented by the Federal Ministry of Justice, licence: Terms of use for information reuse, alternatively Creative Commons Attribution 4.0.
Austria, Austrian trade information system, stage 1, kept by Federal Ministry of Economy, Energy and Tourism, licence: Terms of use of the public interface, no licence reservation.
France, Recherche d’entreprises, kept by French State, Direction interministérielle du numérique, based on INSEE data, licence: Licence Ouverte 2.0 for the underlying Sirene data.
Czech Republic, Administrativní registr ekonomických subjektů, kept by Ministry of Finance of the Czech Republic, licence: Operating conditions of the register.
Poland, Krajowy Rejestr Sądowy, kept by Ministry of Justice of the Republic of Poland, licence: Terms of the open information service.
Slovakia, Register právnických osôb, kept by Ministry of the Interior of the Slovak Republic, Statistical Office, licence: Creative Commons Attribution 4.0.
Denmark, Det Centrale Virksomhedsregister, kept by Danish Business Authority, access through the government data distributor Datafordeler, licence: Creative Commons Attribution 4.0 (CC BY 4.0) for the free basic data.
United Kingdom, Companies House, kept by Companies House, United Kingdom, licence: Open Government Licence 3.0.
Ireland, Companies Registration Office, kept by Companies Registration Office, Ireland, licence: Creative Commons Attribution 4.0.
Greece, Γενικό Εμπορικό Μητρώο, kept by Greek commercial registry, licence: Open Data Commons Attribution License 1.0.
Croatia, Sudski registar, kept by Ministry of Justice of the Republic of Croatia, licence: Terms of the open data portal of the court register.
Switzerland, Zefix, central business name index, kept by Federal Commercial Registry Office, licence: Individually communicated Zefix REST API terms of use of 21.09.2026.
Sweden, Bolagsverket, kept by Bolagsverket, in cooperation with the statistics authority SCB, licence: High-value datasets under Implementing Regulation (EU) 2023/138, made available by Bolagsverket and SCB free of charge and without contract for re-use.
Norway, Enhetsregisteret, kept by Brønnøysundregistrene, licence: Norwegian Licence for Open Government Data.
Finland, Kaupparekisteri, kept by Patentti- ja rekisterihallitus, licence: Creative Commons Attribution 4.0.
Lithuania, Juridinių asmenų registras, kept by VĮ Registrų centras, licence: Creative Commons Attribution 4.0.
Latvia, Uzņēmumu reģistrs, kept by Uzņēmumu reģistrs of the Republic of Latvia, licence: Open data under the Freedom of Information Act, reuse without restriction.
Slovenia, Poslovni register Slovenije, kept by Agencija Republike Slovenije za javnopravne evidence in storitve, licence: Creative Commons Attribution 4.0, reuse without restriction and free of charge.
Cyprus, Register of registered organisations, kept by Department of Registrar of Companies and Intellectual Property, licence: Creative Commons Attribution 4.0.
Belgium, Kruispuntbank van Ondernemingen (KBO), kept by Federal Public Service Economy, SMEs, Self-employed and Energy, licence: Reuse, including commercial reuse, under the Royal Decree of 18 July 2008.
Estonia, Äriregister, kept by Registrite ja Infosüsteemide Keskus, licence: Creative Commons Attribution 4.0 (CC BY 4.0), stated on the register's open data page.
Malta, Malta Business Registry (MBR), kept by Malta Business Registry, licence: Creative Commons Attribution 4.0 (CC BY 4.0), officially stated.
Romania, Registrul Comerțului, kept by Oficiul Național al Registrului Comerțului, Ministry of Justice, licence: Creative Commons Attribution 4.0 (CC BY 4.0), for each ONRC dataset reviewed.
Denmark, Offentliggjorte regnskaber (published annual reports), kept by Erhvervsstyrelsen, licence: Publicly accessible company documents under § 14 of the Anmeldelsesbekendtgørelse; there is no express licence statement for the annual reports.
Romania, Situații financiare (key figures of annual accounts), kept by Ministerul Finanțelor, licence: Open Government Licence Romania 1.0 (OGL-ROU-1.0).
Lithuania, Finansinės atskaitomybės duomenys (financial statement data of the Register of Legal Entities), kept by VĮ Registrų centras, licence: Creative Commons Attribution 4.0.
France, Registre national des entreprises, comptes annuels (annual accounts), kept by Institut national de la propriété industrielle (INPI), licence: INPI re-use licence for RNE data (state-approved, free of charge, commercial re-use permitted); high-value dataset under Implementing Regulation (EU) 2023/138.
The information shown comes from the sources named in each case and is selected and processed technically for CompanyDesk. Stored information may differ from the current status of the source; the time of retrieval stated is decisive for its classification. CompanyDesk does not keep an official register. Requests for access, rectification, erasure, restriction or objection concerning processing by CompanyDesk can be addressed to AIXI Digital GmbH, office@aixi.com, and will be examined in accordance with the statutory requirements. The competent registering authority is also responsible for any change to the underlying official register entry.
Queried information is stored in our own dataset in order to avoid repeated queries to the registering authorities, to display subsequent pages without a new query and to offer suggestions from previously queried entries while typing. Suggestions show only company name, registration number, country and town and are only displayed from three characters entered and in limited number. Key figures derived from filed annual accounts are stored permanently per document, because a filed document cannot change; the document itself is not stored. Annual accounts concern the company and as a rule contain no personal data.
Retrieved register data are overwritten with each new query or delivery from the source; information that the source no longer holds is thereby removed. Addresses of company records are notified to search engines for indexing, in particular via the IndexNow procedure to Microsoft Bing; no information about persons is transmitted in the process. Records of sole traders and information about officers are not offered to search engines.
4. Advertising
Advertisements are fixed and displayed independently of the search term, the user and their behaviour. No profiling takes place, no advertising networks, tracking pixels or third-party identifiers are used, and no data are passed on to advertising partners. When an advertisement is clicked, the privacy policy of the page visited applies.
5. Cookies and similar technologies
Only technically necessary cookies and similar storage technologies are used; their use is based on section 165(3) of the Austrian Telecommunications Act 2021 and requires no consent. Specifically, these are the cookies set by WordPress itself for logging in and session management of logged-in users, a technical storage entry ending when the browser window is closed, which intercepts a single technical error message that would otherwise recur with an expired login token, and a storage entry in the browser recording that the notice on use as an app has been closed or accepted. Once an analytics tool is integrated, a storage entry recording the consent decision will be added. None of these entries serves analytics, advertising or recognition across sessions for any purpose other than the session management mentioned. No analytics tool is currently integrated; should one be used in future, this will take place only after express consent under Art 6(1)(a) GDPR. A decision once made can be changed at any time with effect for the future. If a person expressly chooses a language version, a technically necessary cookie (aixi_lang) remembers this choice for one year; it contains only the language code.
By way of derogation, as soon as and to the extent that you consent via the consent window, we use Google Ads to measure success: it is determined whether a click on one of our advertisements led to a registration. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google sets cookies and processes in particular online identifiers, the IP address, device information and the time of the click and of the registration; no personalised advertising takes place. The legal basis is your consent under Art 6(1)(a) GDPR in conjunction with section 165(3) of the Austrian Telecommunications Act 2021. No connection to Google is established before consent. A transfer to Google LLC in the USA is possible; it is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Google LLC is certified. The cookies are generally deleted after no more than 90 days. You can withdraw your consent at any time with effect for the future via the “Cookie settings” button.
6. Recipients and processors
Service providers acting under a contract pursuant to Art 28 GDPR are used to provide the service; this concerns in particular the operation of the server infrastructure, including the database and the sending of system messages. With each direct query, the search term is transmitted to the respective registering authority, which is independently responsible in that respect. Data are passed on to other third parties only where there is a legal obligation or where this is necessary to establish, exercise or defend legal claims.
For a direct query of Zefix, the company name or business identification number entered and the technically necessary connection data are transmitted from the CompanyDesk server to the Federal Office of Justice, Federal Commercial Registry Office, Switzerland. Authentication uses the operator access of AIXI Digital GmbH. The Swiss office processes the data received under its own responsibility. The Zefix connection does not transmit CompanyDesk account data or end-user passwords to the office.
7. Transfers to third countries
As a rule, no processing takes place outside the European Economic Area. For queries of the United Kingdom register, the transfer is based on the European Commission's adequacy decision of 28 June 2021; for queries of the Swiss register, on the adequacy decision concerning Switzerland. Should a transfer to a third country without an adequacy decision become necessary in an individual case, it will take place exclusively on the basis of the standard contractual clauses under Art 46(2)(c) GDPR together with supplementary safeguards.
8. Retention periods at a glance
Access logs of the server infrastructure according to the hosting provider's specifications. Pseudonymised daily and monthly counters until the end of the respective period and the subsequent clean-up run. Query logs 30 days. Printed profiles in My CompanyDesk seven days. Watchlist, list of retrieved documents, logo on printouts and retrieval record until deleted by the user or until the account is deleted. Account data for the duration of the user relationship and beyond until expiry of statutory retention obligations, namely seven years under section 132(1) of the Austrian Federal Fiscal Code for billing-related documents. Records of consent for the limitation periods.
Register data are stored for the duration of our business activity and updated with each query or delivery from the source.
9. Your rights
Under Articles 15 to 21 GDPR you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on Art 6(1)(f) GDPR. You can withdraw any consent given at any time with effect for the future. An informal message to office@aixi.com is sufficient to exercise these rights. Logged-in users can also request access and erasure through the account's privacy tools.
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority. In Austria, the competent authority is the Data Protection Authority, Barichgasse 40 to 42, 1030 Vienna.
Persons whose information from a register is displayed may object to the processing on grounds relating to their particular situation, for example where they are at risk. The objection should be sent to office@companydesk.eu. We examine it on a case-by-case basis and block the display if the grounds put forward prevail. Correction of inaccurate register information must be requested from the authority keeping the register.
To prevent data from being disclosed to unauthorised persons, we may request proof of identity for enquiries, for example by presenting an official photo ID.
10. No automated decision-making
No automated decision-making, including profiling within the meaning of Art 22 GDPR, takes place. The ranking of search results is based exclusively on the match with the search term entered and has no legal effect on data subjects. No credit, risk or reliability ratings are produced.
11. Data security
Transmission is encrypted according to the state of the art. Access to personal data is restricted by the allocation of roles and rights; access credentials for the registers are stored exclusively on the server side. The measures taken are reviewed regularly.
12. Changes
This statement will be adapted as soon as changes in processing or the legal situation require. The version available here at any given time is authoritative.