Privacy Policy

The protection of your personal data is important to me. I process your data exclusively on the basis of statutory provisions (GDPR, Austrian Data Protection Act, Austrian Telecommunications Act 2021). This privacy policy informs you about the key aspects of data processing on this website and in my work.

1. Controller

2. Principles, cookies and consent

This website is built to be privacy-friendly: fonts are served locally from this site’s own server, there are no marketing or advertising cookies, and statistics (Google Analytics) only run if you agree.

Strictly necessary storage in your browser takes place without consent because it is required for the use you have requested (§ 165(3) Austrian Telecommunications Act 2021). This includes session and security cookies for signing in to the client area (Clerk, with Cloudflare as its security service provider), storing your cookie choice, and display settings such as light or dark mode.

We only use statistics with your consent (Art. 6(1)(a) GDPR, § 165(3) Telecommunications Act 2021), see section 4. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of every page. Withdrawal applies for the future.

3. Hosting, server log files and email

When you access this website, the hosting provider automatically stores information in server log files transmitted by your browser (IP address, shortened where technically possible, date/time, requested page, browser and operating system, referrer URL). This data serves solely the technical provision, security and stability of the website. The legal basis is the legitimate interest in secure operation (Art. 6(1)(f) GDPR). Log files are deleted automatically after a short period unless retained longer for security reasons.

Hosting provider (Vercel)

This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA); its server functions run in a data centre in the EU (Dublin, Ireland). Vercel processes personal data (in particular the server log files above) as a processor on my behalf. Data may be transferred to the USA. Vercel is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR), and a Data Processing Agreement (DPA) including the EU Standard Contractual Clauses is in place. Details: vercel.com/legal/privacy-policy.

Domain and email

Domain and outgoing email are handled by ALL-INKL.COM - Neue Medien Münnich (Germany). My mailbox at the contact address above is hosted by Google (Gmail; Google Ireland Limited, Ireland, parent company Google LLC, USA). Messages to me and notifications from the forms on this website are stored there. Google is certified under the EU-US Data Privacy Framework.

4. Statistics with Google Analytics (only with consent)

If you consent to statistics in the cookie settings, I use Google Analytics 4 by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to understand how the website is used and to improve it. No connection to Google Analytics is made before you consent.

Processed are in particular the pages visited, time and duration of the visit, the referring page, information about device, browser and approximate location (country, city), and a random identifier that Google Analytics stores in a cookie. I also record whether a digitalisation check (with the level of the result, e.g. “high potential”) or a booking was submitted, without name or content. Google Analytics 4 does not store IP addresses.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) Telecommunications Act 2021). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Usage data is deleted automatically after the retention period set in Google Analytics. You can withdraw your consent at any time via “Cookie settings”. Details: policies.google.com/privacy.

5. Contact

If you contact me via the contact form, email, phone or WhatsApp, your details (e.g. name, email, company, message) are processed to handle your enquiry and any follow-up questions. The legal basis is the performance of pre-contractual measures or my legitimate interest in handling your enquiry (Art. 6(1)(b) and (f) GDPR).

When you submit the contact form, your details are processed on the server and sent to me by email via the mail server of my hosting provider All-Inkl (see section 3). You automatically receive a confirmation email. To prevent abuse, the requesting IP address is briefly processed for spam and rate limiting. Data is not passed on to third parties without need and is deleted once no longer required for the purpose, unless statutory retention obligations apply.

Spam protection (Cloudflare Turnstile)

To protect the contact form, the booking page, the digitalisation check and the demo sign-up against automated requests, I use Cloudflare Turnstile by Cloudflare, Inc. (USA). Technical data such as IP address and browser and device information is transmitted to Cloudflare to check whether the request comes from a human. The legal basis is my legitimate interest in protecting the website against abuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. Details: cloudflare.com/privacypolicy.

WhatsApp

For WhatsApp communication, a service of WhatsApp Ireland Ltd. (Meta) is used; their privacy terms apply and data may be processed outside the EU. For particularly sensitive matters, please prefer email.

6. Booking and video calls

On the booking page you can schedule a call with me. For this I process your name, email address, optionally your phone number, your topic and the chosen time. You receive a confirmation with a calendar file, a reminder before the appointment and a link to cancel it. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR).

• Google Calendar (Google Ireland Limited or Google LLC): I check free slots in my calendar and add the appointment with name, email address, phone number and topic. Google is certified under the EU-US Data Privacy Framework.
• Zoom (Zoom Communications, Inc., USA): a meeting link is created for video calls; Zoom receives a title containing your name and your topic. During the call, Zoom processes connection, video and audio data. Zoom is certified under the EU-US Data Privacy Framework. Details: zoom.com/trust/privacy.
• Call summary: for video calls I may use Zoom’s summary feature (AI Companion) to follow up on the conversation. Zoom creates a written summary from the content of the call, which I store with your appointment and send to you on request. I point this out at the start of the call; if you do not want it, I switch the feature off. The legal basis is my legitimate interest in a complete follow-up (Art. 6(1)(f) GDPR).

I keep appointment data as long as it is needed to hold and follow up on the call and for any subsequent collaboration.

7. Digitalisation check and live demo

In the digitalisation check you answer questions about your company (e.g. size, industry, processes, systems in use, time spent, urgency, your role) and provide your name, email address, company and optionally your phone number. From your answers I automatically calculate a result that you see immediately and receive by email. Internally, I also assess how well your enquiry fits my services. This assessment is only used for my planning; no decision about you is made automatically.

Together with your enquiry I store how you reached the website: channel (e.g. search or ad), campaign details from the link (e.g. utm parameters), the referring page and the landing page. For click identifiers of ad networks I only store that one was present, not its value. This information is kept without cookies only during your visit and is transmitted when you submit the form.

For the live demo I create a demo account with your name and email address and send you the access link. As proof of your consent to the privacy policy and terms, I store the time, IP address and browser identifier.

The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR) and my legitimate interest in understanding which channels lead to enquiries (Art. 6(1)(f) GDPR). The data is stored in my database (see section 8, Supabase) and deleted once no longer needed for the enquiry and any subsequent collaboration.

8. Client portal, payments & maintenance

For clients I offer a password-protected client portal with project status, drafts, files and a message history. Each person only sees their own project data. The legal basis is the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR).

Authentication (Clerk)

For secure sign-in, Clerk (Clerk, Inc., USA) is used as a processor (email, name, login and session data). Clerk is certified under the EU-US Data Privacy Framework, and a DPA is in place. Details: clerk.com/legal/privacy.

Database & file storage (Supabase)

Project data, messages, enquiries and uploaded files are stored with Supabase (Supabase, Inc., USA) in a data centre in the EU (Ireland), as a processor under a DPA. As Supabase is a US company, access from the USA cannot be fully ruled out; the EU Standard Contractual Clauses agreed in the DPA apply (Art. 46 GDPR). Files are private and only accessible after sign-in or via short-lived signed links.

Email notifications

Portal notifications (e.g. invitation, status changes, new messages) are sent by email via the All-Inkl mail server (see section 3).

Payments (Stripe)

For paid maintenance contracts, payment is processed via Stripe (Stripe Payments Europe, Ltd., Ireland). The data required for payment (e.g. name, billing address, email and payment data) is processed; Stripe acts largely as its own controller for payment data. Any transfer to the USA is safeguarded by appropriate guarantees (EU-US Data Privacy Framework / EU Standard Contractual Clauses). Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Details: stripe.com/privacy.

Website maintenance (processing on the customer’s behalf)

Where I process personal data on a customer’s behalf within maintenance contracts (e.g. backups, access to database or hosting environments), I act as a processor under the Data Processing Agreement (DPA); the customer remains the controller. The service providers used for this are listed in the DPA.

9. AI-assisted tools in my work

To handle enquiries, emails, quotes, receipts and projects faster, I use AI services. The content of your messages, your contact details and information from our collaboration may be transmitted to the following providers:

• Anthropic (Anthropic PBC, USA): text processing (e.g. draft replies, summaries, recognising receipts in incoming emails).
• OpenAI (OpenAI Ireland Ltd., Ireland; further processing in the USA): voice output of my work assistant.
• Groq (Groq, Inc., USA): converting my own voice input into text.

I use these services exclusively via commercial accounts with a data processing agreement. The data transmitted is not used to train the AI models and is deleted by the providers after 30 days at the latest, unless it has to be retained longer because of suspected misuse. None of these providers is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the EU Standard Contractual Clauses agreed in the contracts (Art. 46 GDPR). I only transmit what the task requires.

The AI makes no decisions about you. I review every reply and document before it goes to you. The legal basis is the performance of pre-contractual measures or the contract (Art. 6(1)(b) GDPR) and my legitimate interest in efficient processing (Art. 6(1)(f) GDPR). You can object to this processing at any time; I will take this into account from receipt of your objection.

10. Web fonts

This website uses self-hosted fonts (Outfit, Hanken Grotesk, JetBrains Mono) loaded directly from this site’s server. No data is transferred to third parties (e.g. Google Fonts).

11. Retention

I store personal data only as long as necessary for the respective purpose. Documents I must keep for tax and commercial law reasons (e.g. invoices and accounting records) are kept for the statutory period, generally seven years (§ 132 Austrian Federal Fiscal Code, BAO).

12. Your rights

You have the rights to access, rectification, erasure, restriction, data portability and objection. You can withdraw any consent given at any time with effect for the future. If you believe the processing of your data violates data protection law, you may contact me or the supervisory authority.

13. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption (recognisable by “https://” and the padlock icon in the address bar).

14. Changes

I may update this privacy policy to keep it in line with current legal requirements or to reflect changes to my services. The current version applies to your next visit.