Privacy Policy
Last updated: November 2025
1. Data Controller and Information We Collect
The data controller for the IVTTV platform is Media4you Internet Services GmbH, Handelskai 94-96, Millennium Tower, 1200 Wien, Austria (Firmenbuch: FN 417450y), represented by Managing Director Thomas Dolezal. We collect and process the following categories of personal data: (a) Data you provide directly: name, email address, password (stored in hashed form), and payment details (processed by our third-party payment provider). (b) Data collected automatically: IP address, device type and operating system, browser type and version, approximate geolocation (country level, for territorial licensing compliance), pages visited, viewing history, and timestamps. (c) Data from third-party services: if you use social login or third-party authentication, we may receive your name and email from that provider. We process personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Austrian Datenschutzgesetz (DSG).
2. Legal Basis and Purposes of Processing
We process your personal data on the following legal bases under Article 6 GDPR: (a) Performance of contract (Art. 6(1)(b)): to create and manage your account, provide streaming services, process payments, and handle subscription management. (b) Legitimate interest (Art. 6(1)(f)): to improve the Service, detect and prevent fraud, ensure network security, and perform internal analytics. Our legitimate interest does not override your fundamental rights. (c) Legal obligation (Art. 6(1)(c)): to comply with Austrian tax law, commercial law retention obligations, and lawful requests from public authorities. (d) Consent (Art. 6(1)(a)): where we send you marketing communications or use non-essential cookies, we will obtain your prior consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
3. Data Sharing and Recipients
We do not sell your personal data to third parties. We may share your data with the following categories of recipients, each acting as a data processor under a data processing agreement pursuant to Article 28 GDPR: (a) Payment service providers (e.g. Stripe, SEPA processors) to process subscription payments. (b) Cloud infrastructure and content delivery network providers to host and deliver the Service. (c) Email service providers to send account-related and transactional messages. (d) Authentication providers (Supabase) for secure account management. We may also disclose personal data to law enforcement or judicial authorities if required by applicable Austrian or EU law, or to protect the vital interests of data subjects. We do not share your personal data with advertisers.
4. Cookies and Tracking Technologies
IVTTV uses only strictly necessary cookies required for the Service to function. We do not use advertising cookies, social media tracking pixels, or third-party analytics cookies. You can manage cookie settings through your browser. Disabling essential cookies (such as authentication cookies) may prevent you from signing in and using the Service. For detailed information about each cookie we use, please refer to Section 14 (Cookie Policy) below.
5. Data Retention
We retain your personal data only for as long as necessary for the purposes described in this Privacy Policy: (a) Account data is retained while your account is active and for up to 90 days after account deletion, to allow account recovery in case of accidental deletion. (b) Payment and billing records are retained for 7 years to comply with Austrian tax and commercial law retention requirements (Bundesabgabenordnung, Unternehmensgesetzbuch). (c) Server access logs (including IP addresses) are retained for up to 90 days for security and fraud prevention purposes. (d) Viewing history is retained while your account is active. After the applicable retention period, personal data is securely deleted or anonymised.
6. Your Rights Under GDPR
Under the GDPR and the Austrian Datenschutzgesetz (DSG), you have the following rights: (a) Right of access (Art. 15 GDPR): obtain confirmation of whether we process your data and request a copy. (b) Right to rectification (Art. 16 GDPR): correct inaccurate or incomplete data. (c) Right to erasure (Art. 17 GDPR): request deletion of your data ("right to be forgotten"), subject to legal retention obligations. (d) Right to restriction of processing (Art. 18 GDPR): request that processing be restricted under certain circumstances. (e) Right to data portability (Art. 20 GDPR): receive your data in a structured, commonly used, machine-readable format. (f) Right to object (Art. 21 GDPR): object to processing based on legitimate interest, including profiling. (g) Right to withdraw consent (Art. 7(3) GDPR): withdraw any consent given at any time, without affecting prior processing. To exercise any of these rights, contact us at privacy@ivttv.com or dpo@ivttv.com. We will respond within 30 days. If we need more time (up to 60 additional days for complex requests), we will inform you.
7. Data Security
Media4you Internet Services GmbH implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, in accordance with Article 32 GDPR. These measures include: encryption of data in transit (TLS 1.2+), secure password hashing, access controls and role-based permissions, regular security reviews, and incident response procedures. Despite these measures, no method of electronic transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Oesterreichische Datenschutzbehoerde within 72 hours in accordance with Article 33 GDPR and inform affected data subjects without undue delay where required by Article 34 GDPR.
8. Children's Privacy
IVTTV is not directed at children under 16 years of age. We do not knowingly collect or process personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us at privacy@ivttv.com and we will promptly delete such data. This age limit is in accordance with Article 8 GDPR as implemented by the Austrian DSG.
9. International Data Transfers
Your personal data is primarily processed within the European Economic Area (EEA). Where data is transferred to countries outside the EEA, we ensure that appropriate safeguards are in place as required by Chapter V of the GDPR, such as: (a) an adequacy decision by the European Commission (Art. 45 GDPR), or (b) standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You may request information about the specific safeguards applied to any international transfer by contacting dpo@ivttv.com.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes at least 30 days before they take effect, via email to your registered address or through a prominent notice within the Service. Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance. The date of the most recent revision is indicated at the top of this page.
11. Contact
For any privacy-related inquiries or to exercise your rights as a data subject, please contact: Media4you Internet Services GmbH, Handelskai 94-96, Millennium Tower, 1200 Wien, Austria. Email: privacy@ivttv.com. Managing Director: Thomas Dolezal. Firmenbuch: FN 417450y. You may also contact our Data Protection Officer directly at dpo@ivttv.com. privacy@ivttv.com.
12. Data Protection Officer
Media4you Internet Services GmbH has appointed a Data Protection Officer (DPO) in accordance with Article 37 GDPR. The DPO is responsible for monitoring compliance with the GDPR, the Austrian DSG, and all other applicable data protection legislation. You may contact the DPO for any questions about how we process your personal data, to exercise your data subject rights, or to raise a concern or complaint. DPO contact details: Data Protection Officer, Media4you Internet Services GmbH, Handelskai 94-96, Millennium Tower, 1200 Wien, Austria. Email: dpo@ivttv.com.
13. Right to Lodge a Complaint with a Supervisory Authority
If you believe that our processing of your personal data infringes the GDPR or the Austrian DSG, you have the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR. The competent supervisory authority for Media4you Internet Services GmbH is: Oesterreichische Datenschutzbehoerde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Wien, Austria. Website: https://www.dsb.gv.at. Email: dsb@dsb.gv.at. If you reside in another EU/EEA member state, you may also lodge a complaint with the supervisory authority in the member state of your habitual residence, place of work, or where the alleged infringement occurred.
14. Cookie Policy
IVTTV uses a small number of cookies, all classified as strictly necessary for the website to function. Authentication cookies (sb-access-token, sb-refresh-token) are set by our authentication provider Supabase to keep you signed in securely — they are httpOnly, Secure, and SameSite=Lax, and expire when your session ends or after the configured session timeout. The locale preference cookie (NEXT_LOCALE) remembers your language choice between visits and is valid for 1 year. We do NOT use tracking cookies, advertising cookies, or third-party analytics cookies. We do NOT share cookie data with advertisers or any third party. You can delete or block cookies at any time through your browser settings; note that blocking authentication cookies will prevent you from signing in. As consent for strictly necessary cookies is not legally required under the ePrivacy Directive (Directive 2002/58/EC) or Section 165(3) of the Austrian Telekommunikationsgesetz 2021 (TKG 2021), IVTTV does not display a cookie consent banner.