Controller
Aloaha Limited, “Helgoland” 45, Triq Gio Felice Inglott, Pembroke PBK1131, Malta
E-mail: info@aloaha.com, phone: +49 541 3859 4554. More details in the imprint.
If you use a form published by another organisation on this server, that organisation is responsible for the form data; Aloaha processes them on its behalf.
Information pages: what we do not do
- No cookies on the information pages, neither our own nor third-party.
- No analytics or statistics services, no advertising or tracking pixels, no fingerprinting.
- No external fonts or CDNs: fonts, styles and images are delivered by this server.
Server logs
Like every web server, this server logs technical access data: IP address, date and time, requested address, status code, amount of data, referrer and browser identification (user agent). We need these data to deliver the website and the forms securely and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). We do not use them for advertising or profiling, do not combine them with other data and do not pass them on.
Using the form server
When you log in or fill in a form, the server uses a session cookie and, after logging in, cookies that keep you signed in. They are technically necessary for these functions (Art. 6(1)(b) and (f) GDPR) and expire when you log off or the session ends.
Remembered entries: so that you do not have to type everything again, your browser keeps what you enter in a form in its local storage, separately for each form, for up to 90 days. These entries stay on your device and are not sent to us. Passwords, signatures, attachments and payment details are never kept. Use "Clear" in the notice on the form, or delete the site data in your browser, to remove them.
Bot protection: to keep automated spam out, the form page contains an invisible check. Your browser computes a short value in the background, and the server checks it together with the time between opening and sending the form. No personal data is used for this, no cookie is set for it and no third-party service is involved.
Submitted forms: the data you enter and the attachments you add are used to create a sealed PDF and an XML file. They are sent by e-mail to you (if you entered an e-mail address) and to the business owner of the form. By default the server does not keep a copy; if the form owner has enabled the encrypted archive, a password-protected PDF is kept that can only be opened with the submission ID.
Sign-in with an identity provider: if you sign in with an Aloaha or CodeB account (www.aloaha.com, phone.codeb.io or phone.aloaha.com), or a form requires sign-in, you are redirected to that provider, and we receive the identity data needed for the sign-in (such as name, e-mail address and role) and, if the form uses it, for pre-filling the form.
Contact by e-mail or phone
If you write to us or call us, we process your details (name, e-mail address, phone number, content of the request) to deal with your request. The legal basis is Art. 6(1)(b) GDPR if your request aims at a contract, otherwise Art. 6(1)(f) GDPR. We delete the data when they are no longer needed, unless statutory retention periods apply.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. An e-mail to info@aloaha.com is enough.
You can also complain to a data protection supervisory authority, for example the authority responsible for us in Malta, the Information and Data Protection Commissioner (IDPC), or the authority where you live or work.
No automated decisions
We do not make automated decisions or create profiles within the meaning of Art. 22 GDPR.
Security
The website and the forms are delivered over HTTPS only.
Last updated: October 2026
Last updated: