Austrian health agency — 36 requests, 3 domains. Piwik on a proprietary subdomain webstatistik.ages.at. Chatbottery (an Austrian company) not mentioned in the policy as a recipient — the only shortcoming. One of the cleanest results in the Austrian series.
Timeline of the leak
Declared versus actual
Transfer timings
Chatbottery — chatbot. Austria
Self-hosted Piwik on an AGES subdomain
Detected trackers
- Chatbottery (web-runtime.chatbottery.com)
Context
AGES (Österreichische Agentur für Gesundheit und Ernährungssicherheit GmbH) is the Austrian state agency for health and food safety. Responsible for monitoring food products, medicinal products, and infectious diseases. DPO — datenschutz@ages.at. The policy is in German. HAR: 36 requests, 3 domains.
Piwik on a proprietary subdomain
webstatistik.ages.at/piwik/ — Piwik (the predecessor of Matomo) on a proprietary subdomain. Analytics data stays within AGES’s infrastructure. The same principle as the Matomo setup at EBA and eu-LISA — analytics without transferring data to third parties. Two requests per session: piwik.js and the piwik.php pageview call.
Chatbottery — an Austrian company, not mentioned
web-runtime.chatbottery.com (+502 ms) — the Chatbottery GmbH (Linz, Österreich) chatbot platform. Loads a chatbot widget in the bottom-right corner. An Austrian company — data stays within the EU. However, AGES’s privacy policy does not mention chatbottery.com as a data recipient. Visitors’ IP addresses are transmitted to Chatbottery on every page load.
Policy — detailed, in German
The AGES Datenschutzerklärung is detailed: it describes categories of data (Bestands-, Kunden-, Kontakt-, Auftrags-, Gesundheits- und Kommunikationsdaten), legal bases, data subject rights, and DPO contact. It states that data is processed exclusively where a legal basis exists. Chatbottery is absent from the list of recipients.
Conclusion
AGES is one of the cleanest results in the Austrian series. Self-hosted Piwik, zero Google Analytics, zero external advertising services. The only issue: Chatbottery is not mentioned in the privacy policy as a data recipient.
965b73bb2d9ac9cb4c8f4db425443008b26ec89fe30f5e036582ff251527b25f