Privacy policy

Controller

The controller for data processing on this website is [Company name] OG, [Business address], email: [Contact email]. No data protection officer has been appointed, as there is no legal obligation to do so.

Hosting and server logs

This website is hosted by Cloudflare, Inc. (USA) and runs on Cloudflare Workers; requests are received by Cloudflare's global network, usually at a data centre near you. When you visit, the server processes technical access data (IP address, date and time, requested page, browser identifier) to the extent required to deliver the site and keep it stable and secure. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

A data processing agreement is in place with Cloudflare. Data may be transferred to the USA; such transfers are safeguarded by the EU standard contractual clauses or the EU-US Data Privacy Framework [verify certification status].

Contact form and project inquiry

If you write to us via the contact form or the project inquiry, we process the data you provide: name, email address, region (optional in the contact form), optionally company, and your message or project details, together with the language you use the website in and the time of your consent. The sole purpose is handling your inquiry; the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures).

For handling and follow-up we store your inquiry in our database, which Neon (Neon, Inc., USA) operates for us as a processor in the EU region Frankfurt; basis for any transfer to the USA: [verify transfer mechanism]. When enabled, we are also notified of new inquiries by email; delivery then runs through the Resend service (Resend, Inc., USA) as a processor.

We keep inquiries for as long as handling them requires, but no longer than [verify period; proposed: 12 months], unless statutory retention obligations apply.

To protect against automated abuse we limit the number of submissions per IP address; the IP address is processed only briefly and technically for this purpose and is not linked to your inquiry.

Bot protection (Cloudflare Turnstile)

When enabled, Cloudflare Turnstile (Cloudflare, Inc., USA) checks technical characteristics of your browser and your IP address when a form is submitted in order to detect automated access. The data is transferred to the USA; transfer mechanism [verify transfer mechanism]. The legal basis is our legitimate interest in protecting the forms from abuse (Art. 6(1)(f) GDPR).

Abuse protection (rate limiting)

To limit automated requests (rate limiting) we process your IP address at Upstash (Upstash, Inc., USA). The IP address is used solely as a counting key and stored briefly. The legal basis is our legitimate interest in protecting the forms and the availability of the website (Art. 6(1)(f) GDPR). Basis for the transfer to the USA: [verify transfer mechanism].

Cookies

This website sets only a few, mostly technically necessary cookies. We do not use third-party advertising or tracking cookies. The cookie banner offers a marketing category that currently activates nothing; it exists so that a future consent does not have to be collected retroactively.

• lush-locale: stores your language choice (functional; set when you switch languages).
• app_consent: stores your decision in the cookie banner (retention: 180 days).

Technically necessary cookies do not require consent. You can adjust or withdraw your choice for all other categories at any time via the “Change cookie settings” button at the bottom of this page.

Web analytics only with consent

Only if you consent to the “Analytics” category in the cookie banner do we use our own cookieless web analytics to count which pages are visited; without consent nothing is recorded. Your browser sends the visited page (without parameters), the referring website and any campaign parameters (UTM) to our analytics endpoint, which Cloudflare, Inc. operates as our processor; a successfully submitted inquiry is counted as an event without its content. From this, country, device type and browser and operating system family are derived. Your IP address is not stored: together with the browser identifier it only serves to form a pseudonymous value that changes every day and is not linked across days or websites. The individual records are deleted after three months; only daily totals are kept. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Any transfer to the USA is safeguarded by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Your rights

Under the GDPR you have, in particular, the following rights:

• access to the data processed (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing based on legitimate interests (Art. 21)
• withdrawal of any consent given, at any time and with effect for the future

To exercise them, contact [Contact email]. You also have the right to lodge a complaint with the Austrian data protection authority (dsb.gv.at).

Last updated: 2 October 2026. We will adapt this policy whenever the processing changes.