Privacy Notice — MeteoAlarm API Access Registration

Effective date: 2026-02-27
Applies to: Visitors who submit the registration form to request access to the MeteoAlarm APIs.

1. Controller identity

GeoSphere Austria (“we”, “us”) is the data controller for the processing described in this notice.

We process the information you submit in the registration form in order to:

Manage and verify API registration requests.
Issue, administer, and secure API credentials (tokens).
Communicate about technical, operational, or policy matters related to API usage.
Monitor abuse and ensure platform security and availability.

We do not use this data for marketing unless we explicitly ask and you agree (no marketing is performed by default).

We rely on the following legal bases under the GDPR:

Performance of a contract (Art. 6(1)(b)) — to provide you with API access and manage your account.
Legitimate interests (Art. 6(1)(f)) — to protect the security and integrity of the API, prevent misuse, and maintain reliable service. We consider these interests balanced against your rights and expectations in this context.

From the registration form and during subsequent API use, we process:

Form fields: organization type, organization name, contact name, email address, description of intended use, requested API(s)
Operational/technical data: API token identifiers, timestamps of access, endpoints called, response codes, and IP addresses captured in server logs as part of normal security operations.

We ask you not to include personal information in free-text fields. If you do, it may be processed solely for the purposes stated above.

We do not transfer your personal data outside the European Economic Area (EEA).

Internal recipients: authorized personnel who need access for API administration, security, or support.
Service providers (processors): vetted vendors providing system development and maintenance, hosting, logging, monitoring, or support services.
Legal disclosures: where required to comply with applicable laws or enforce our terms.

We do not sell personal data.

Registration & account data: kept for the duration of your active API access.
Inactivity rules: if an API token shows no usage for 36 months, we will deactivate the token and the associated registration data will be deleted too.
Logs for security/operations: retained for 180 days, then deleted or anonymized.
Deletion process already in place: when access is revoked or an account is closed, our process deletes the related access and the personal data provided through the form within 30 days.

We may retain minimal records where necessary to demonstrate compliance or resolve disputes, for the shortest period necessary.

Under GDPR, you have the right to:

Access your data and obtain a copy.
Rectify inaccurate or incomplete data.
Erase your data (right to be forgotten), subject to legal/operational limits.
Restrict processing in certain circumstances.
Object to processing based on legitimate interests.
Data portability (for data you provided to us, processed by automated means).
Lodge a complaint with your local supervisory authority if you believe your rights are infringed.

To exercise your rights or ask questions, contact us at meteoalarm@geosphere.at

We will respond within one month of receiving your request (extendable by two months for complex requests; if extended, we will inform you).