Privacy Policy.

Last updated: 23 October 2026.

Personal data (usually referred to just as “data” below) will only be processed by us to the extent necessary and for the purpose of providing a functional and user-friendly website, including its contents, and the services offered there.

Per Art. 4 No. 1 of Regulation (EU) 2016/679, i.e. the General Data Protection Regulation (hereinafter referred to as the “GDPR”), “processing” refers to any operation or set of operations such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, or combination, restriction, erasure, or destruction performed on personal data, whether by automated means or not.

The following privacy policy is intended to inform you in particular about the type, scope, purpose, duration, and legal basis for the processing of such data either under our own control or in conjunction with others. We also inform you below about the third-party components we use to optimize our website and improve the user experience, which may result in said third parties also processing data they collect and control.

Our privacy policy is structured as follows:

I. Information about us as controllers of your data
II. The rights of users and data subjects
III. Information about the data processing

I. Information about us as controllers of your data

The party responsible for this website (the “controller”) for purposes of data protection law is:

cortEXplore GmbH
Technologiepark 17
4320 Perg
Austria

Email: office@cortexplore.com

II. The rights of users and data subjects

With regard to the data processing to be described in more detail below, users and data subjects have the right

to confirmation of whether data concerning them is being processed, information about the data being processed, further information about the nature of the data processing, and copies of the data (cf. also Art. 15 GDPR);
to correct or complete incorrect or incomplete data (cf. also Art. 16 GDPR);
to the immediate deletion of data concerning them (cf. also Art. 17 GDPR), or, alternatively, if further processing is necessary as stipulated in Art. 17 Para. 3 GDPR, to restrict said processing per Art. 18 GDPR;
to receive copies of the data concerning them and/or provided by them and to have the same transmitted to other providers/controllers (cf. also Art. 20 GDPR);
to withdraw consent at any time with effect for the future (cf. also Art. 7 Para. 3 GDPR);
to file complaints with the supervisory authority if they believe that data concerning them is being processed by the controller in breach of data protection provisions (see also Art. 77 GDPR). The competent supervisory authority for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria — dsb.gv.at.

We do not use your data for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

In addition, the controller is obliged to inform all recipients to whom it discloses data of any such corrections, deletions, or restrictions placed on processing the same per Art. 16, 17 Para. 1, 18 GDPR. However, this obligation does not apply if such notification is impossible or involves a disproportionate effort. Nevertheless, users have a right to information about these recipients.

Likewise, under Art. 21 GDPR, users and data subjects have the right to object to the controller’s future processing of their data pursuant to Art. 6 Para. 1 lit. f) GDPR. In particular, an objection to data processing for the purpose of direct advertising is permissible.

III. Information about the data processing

Your data processed when using our website will be deleted or blocked as soon as the purpose for its storage ceases to apply, provided the deletion of the same is not in breach of any statutory storage obligations or unless otherwise stipulated below.

Server log files / Hosting

Our website is currently hosted by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Österreich. When you visit our website, our hosting provider automatically collects information that your browser transmits to our server. This data is stored temporarily in so-called server log files and includes:

IP address of the requesting device
Date and time of the request
Name and URL of the file retrieved
Website from which the access was made (referrer URL)
Browser used and, where applicable, the operating system of your computer

The legal basis is Art. 6 Para. 1 lit. f) GDPR. Our legitimate interest lies in the secure and stable operation of the website. The data is not used in a way that allows conclusions to be drawn about your person. Log entries are deleted after a maximum of 14 days unless they are required for evidence purposes in the event of a security incident.

Cookies

a) Session cookies

We use cookies on our website. Cookies are small text files or other storage technologies stored on your computer by your browser. These cookies process certain specific information about you, such as your browser, location data, or IP address.

This processing makes our website more user-friendly, efficient, and secure, allowing us, for example, to keep you signed in to the members area.

The legal basis for such processing is Art. 6 Para. 1 lit. b) GDPR, insofar as these cookies are used to collect data to initiate or process contractual relationships.

If the processing does not serve to initiate or process a contract, our legitimate interest lies in improving the functionality of our website. The legal basis is then Art. 6 Para. 1 lit. f) GDPR.

Some of the session cookies are technically necessary within the meaning of § 165 Para. 3 TKG 2021 and do not require your consent.

Session cookies are deleted when you close your browser. The cookies of the members area expire as described in the section “Members area”.

b) Third-party cookies

If necessary, our website may also use cookies from companies with whom we cooperate for the purpose of analyzing or improving the features of our website (see the sections on web analytics and YouTube below).

Please refer to the following information for details, in particular for the legal basis and purpose of such third-party collection and processing of data collected through cookies.

c) Disabling cookies

You can refuse the use of cookies by changing the settings on your browser. Likewise, you can use the browser to delete cookies that have already been stored. The steps and measures required vary depending on the browser you use. If you have any questions, please use the help function or consult the documentation for your browser.

If you prevent or restrict the installation of cookies, not all of the functions on our site may be fully usable.

When you first visit our website, a consent banner asks you to choose which categories of cookies and embedded media you allow:

Essential — required for the site to function. Always active.
Analytics — Google Analytics; loaded only after you opt in. Off by default.
External media — embedded YouTube videos on the tutorials page.

Until you accept the “External media” category, embedded videos run in a privacy-preserving fallback mode:

For YouTube, the embed is replaced by a placeholder; no request to YouTube’s servers is made until you opt in.

Google Analytics is loaded only after you accept the “Analytics” category. Separately, Cloudflare Web Analytics measures visits without cookies and stores no information on your device (see below) — it therefore requires no consent under § 165 Para. 3 TKG 2021 and is not part of the banner.

You can change your choice at any time via the “Cookie settings” link in the page footer. Your choice is stored in a first-party cookie (cc_cookie) for a maximum of 12 months. The legal basis is Art. 6 Para. 1 lit. a) GDPR (consent) and § 165 Para. 3 TKG 2021 (Austrian implementation of the ePrivacy Directive).

We honor the Global Privacy Control browser signal (Sec-GPC: 1) where applicable for visitors covered by US state privacy laws.

Contact form / email

If you contact us via email or our contact form, the data you provide will be used for the purpose of processing your request. We must have this data in order to process and answer your inquiry; otherwise we will not be able to answer it in full or at all.

The legal basis for this data processing is Art. 6 Para. 1 lit. b) GDPR (steps prior to entering a contract) or Art. 6 Para. 1 lit. f) GDPR (legitimate interest in responding to inquiries).

Contact-form submissions are delivered by email to office@cortexplore.com and stored on our web server together with the details you entered (name, email address, organisation, country, message, the configuration for quote requests and, where applicable, the campaign through which you reached our website). The notification email is sent via Microsoft 365, operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as our processor.

Submissions are protected against automated abuse by Cloudflare Turnstile, a privacy-friendly CAPTCHA alternative provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. In this context Cloudflare processes your IP address, TLS fingerprint and user agent. Cloudflare acts as our processor and, to improve its bot detection, also as an independent controller. Data may be transferred to the USA. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Cloudflare, Inc. The transfer to the USA is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR), under which Cloudflare, Inc. is certified. The data processing agreement additionally contains the EU Standard Contractual Clauses. The legal basis is Art. 6 Para. 1 lit. f) GDPR; our legitimate interest is preventing spam and abuse. According to Cloudflare, Turnstile does not set cookies; we do not use Cloudflare’s pre-clearance cookie.

Requests that lead to an offer or an order are kept with our business records for the statutory retention period of seven years. Other requests are deleted three years after our last contact with you. You can ask us to delete your request at any time.

Web analytics

We use Cloudflare Web Analytics, a privacy-first analytics service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to understand how our website is used.

Cloudflare Web Analytics is cookieless: it does not set any cookies, does not use localStorage, and does not fingerprint or otherwise track individuals across sites or over time. It produces aggregated measurements such as page URL, referrer, country, browser and device type, and core web-vitals performance metrics. No advertising profiles are built and no data is sold or shared for advertising.

Because Cloudflare Web Analytics stores no information on your device, it does not require consent under § 165 Para. 3 TKG 2021. When the measurement script is loaded, your IP address is transmitted to Cloudflare, Inc. (USA) as a technical part of the connection; according to Cloudflare, it is not stored. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Cloudflare, Inc. The transfer to the USA is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR), under which Cloudflare, Inc. is certified. The data processing agreement additionally contains the EU Standard Contractual Clauses. The legal basis of the processing is Art. 6 Para. 1 lit. f) GDPR; our legitimate interest is the needs-based design and continuous improvement of our website.

In addition, our own server keeps two aggregate counters that involve no personal data: how often a link carrying campaign parameters (utm_* or a short c code) was followed to a page, and how often a page that no longer exists was requested, so that we can fix broken links. Neither counter records IP addresses, cookies or any identifier. If you send us a contact or quote form right after arriving through such a link, the campaign name is saved with your message so we know which campaign reached you (legal basis: Art. 6 Para. 1 lit. f) GDPR; stored together with the message for the same period); it is held only in the open page, never stored on your device.

Further information is available in Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.

In addition, and only after you opt in to the “Analytics” category of our consent banner, we use Google Analytics 4, a web-analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics sets cookies (e.g. _ga) and processes usage data to help us understand how our website is used; data may be transferred to Google servers in the USA. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Google LLC. The transfer to the USA is based on the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR), under which Google LLC is certified. The data processing agreement additionally contains the EU Standard Contractual Clauses. According to Google, IP addresses of users in the EU, Switzerland and the UK are not logged or stored in Google Analytics 4. Until you consent, no analytics cookies are set and no data is sent to Google. You can withdraw your consent at any time via the “Cookie settings” link in the footer, which also deletes the analytics cookies.

The legal basis is Art. 6 Para. 1 lit. a) GDPR (consent) and § 165 Para. 3 TKG 2021. See Google’s privacy policy at https://policies.google.com/privacy.

YouTube (embedded videos)

The tutorials page embeds videos hosted on YouTube. YouTube is operated by Google Ireland Limited (address as above). We use the privacy-enhanced mode (youtube-nocookie.com), and the embed is only loaded after you have accepted the “External media” category in the cookie banner.

When you play an embedded video, YouTube may set cookies and similar technologies on your device to count views, remember playback preferences, and protect against abuse. Personal data, including your IP address, may be transmitted to Google servers, including in the United States. The legal basis is Art. 6 Para. 1 lit. a) GDPR (your consent).

For details, see Google’s privacy policy at https://policies.google.com/privacy.

We maintain an online presence on LinkedIn to present our company and our services and to communicate with customers and prospects. LinkedIn is a service of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

For the processing of personal data when you visit or interact with our company page, we are jointly responsible with LinkedIn Ireland Unlimited Company (Art. 26 GDPR). We have no access to LinkedIn’s databases, and you can exercise your rights both with us and directly with LinkedIn. The legal basis is our legitimate interest in communicating with interested persons and presenting our company (Art. 6 Para. 1 lit. f) GDPR); where LinkedIn requires your consent, the legal basis is Art. 6 Para. 1 lit. a) GDPR.

We would like to point out that this might cause user data to be processed outside the European Union, particularly in the United States. Transfers to LinkedIn Corporation in the US are based on the EU-US Data Privacy Framework and on Standard Contractual Clauses.

When you click the LinkedIn link in our footer, LinkedIn may record information about you and your visit. If you are logged into your LinkedIn account, that visit may be associated with your account. To prevent this, log out of LinkedIn before clicking the link.

The LinkedIn privacy policy is available at https://www.linkedin.com/legal/privacy-policy.

Members area

Pages under /members/ are protected by a sign-in. To use them, you provide an email address and a password, which we store in a server-side user file (passwords are hashed with bcrypt). Login state is maintained in a signed cookie (cx_session) that expires after seven days or when you sign out. A second cookie (cx_user) contains only your display name and email address for the page header and expires at the same time. The legal basis is Art. 6 Para. 1 lit. b) GDPR (contract execution / pre-contract) and Art. 6 Para. 1 lit. f) GDPR (legitimate interest in restricting access to confidential resources).

You can request deletion of your account at any time by writing to office@cortexplore.com. Accounts are kept as long as the contractual relationship exists and are deleted on request.

Error reports from our software

If CORTEXPLORER software encounters an error, or if you choose “Report a problem”, you can send us an error report. It is transmitted only after you click “Send” and contains a memory snapshot of the software at the time of the error (which may include fragments of data that were loaded), the application log, a Windows system report, the tracking configuration (camera calibrations and tool library), your description, and the dongle number, computer name and Windows user name. You can exclude the application log and the system and tracking information before sending. We use error reports only to analyse and correct defects and to support you; they are stored on our own server at our premises in Perg, Austria, and are not shared with third parties. The legal basis is Art. 6 Para. 1 lit. f) GDPR (our legitimate interest in correcting defects of our products) and, where you ask us for support, Art. 6 Para. 1 lit. b) GDPR. Error reports are deleted two years after receipt. Please do not send error reports that contain data of identifiable persons (for example patients or study participants); you are responsible for this. If cortEXplore becomes aware of such data in a report, it will delete it.

Build-Your-System configurator and quote requests

In the Build-Your-System configurator you select components for your system. The selection is stored only in your browser (local storage) and remains there until you clear it in the configurator or delete your browser data. It is not transmitted to us until you send a quote request. If you send a quote request, we process the contact details you provide and your configuration to prepare the quote. The legal basis is Art. 6 Para. 1 lit. b) GDPR (steps prior to entering a contract). Requests that lead to an offer or an order are kept with our business records for the statutory retention period of seven years. Other requests are deleted three years after our last contact with you. You can ask us to delete your request at any time.

Customers and orders

If you purchase our products or services, we process name, address, contact details, ordered goods and date of purchase to perform the contract, to maintain the business relationship and to meet legal obligations (Art. 6 Para. 1 lit. b) and c) GDPR). We keep contract data until the statutory tax retention period of seven years has expired. Name, address, purchased goods and date of purchase are kept for a further period until the product liability period of ten years has expired (Art. 6 Para. 1 lit. f) GDPR).

Model based on a Model Data Protection Statement by Anwaltskanzlei Weiß & Partner, adapted by cortEXplore GmbH.