Privacy notice

Controller

The controller responsible for the processing of personal data on this website within the meaning of the GDPR is: Kachelbunt GmbH, represented by Marius Feilhauer, Hütteldorferstraße 253a, 1140 Wien, Austria. E-mail: office@kachelbunt.at.

The full company details required by the Austrian E-Commerce Act (ECG) and Media Act (MedienG) are set out in the imprint.

To the imprint

Data protection officer

We have not appointed a data protection officer and are not required to do so: we are not a public authority, and our core activities consist neither of regular and systematic monitoring of individuals on a large scale nor of large-scale processing of special categories of data (Art 37(1) GDPR). We answer data protection questions ourselves — write to office@kachelbunt.at.

Hosting and server log files

This website is hosted by Divio AG, Hardturmstrasse 161, 8005 Zürich, Schweiz. The provider processes the resulting data solely on our behalf and on our instructions and Data processing agreement under Art 28 GDPR: Active.

Every time a page is requested, the web server automatically writes an entry to its log file. This records the IP address of the requesting device, the date and time of the request, the address requested, the HTTP status code and the volume of data transferred, the browser type and operating system (user agent), and the previously visited page (referrer) if your browser transmits it.

The purpose is the technical delivery of the website, operational security and stability, fault analysis and the prevention of attacks and misuse. The legal basis is Art 6(1)(f) GDPR. Our legitimate interest is precisely this: being able to provide the website in a technically sound, stable and attack-resistant manner. No analysis of user behaviour takes place, and log data is not combined with other data sources.

Retention period: 3 years. Entries are deleted afterwards. You may object to this processing at any time; the section Your rights explains how.

Cookies

This website uses strictly necessary cookies only — to protect forms against cross-site request forgery, to remember your language choice, to store your cookie decision and, solely where someone signs in to the site administration, to hold the session identifier. There are no analytics, marketing or third-party cookies.

Because these cookies are technically necessary, no consent is required for them under section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). In so far as personal data is processed in the course of this, we rely on Art 6(1)(f) GDPR; our legitimate interest is being able to deliver the website securely, in your language and with working forms. The cookie notice on the site therefore only informs you; it does not collect consent. The cookie policy lists each cookie, what else the website stores on your device, how long it is kept and how to change your decision.

To the cookie policy

Contact form

There is a form on the contact page. It asks for the topic you select (Translate, Implement, Connect or Enable), your name, your e-mail address, optionally your message and, optionally, whether you are an SME or an NGO.

When you submit the form, your entries are stored in a database on our own server so that we can handle your enquiry. Nothing is sent by e-mail and nothing is passed on to third parties. We additionally record the time of receipt, the language version of this site you used, and a hash of your IP address salted with a secret key. The IP address itself is not stored and cannot be recovered from the hash; it serves only to detect abusive bulk submissions.

legal.privacy.contactform.p3

The purpose of the processing is to handle and answer your enquiry. The legal basis is Art 6(1)(b) GDPR where your enquiry is aimed at concluding a contract or at pre-contractual steps, and otherwise Art 6(1)(f) GDPR, our legitimate interest being to answer enquiries from prospective clients. There is no recipient and no processor — the data stays on our server. The retention period is 1 year.

You are under no statutory or contractual obligation to give us any data, and no disadvantage arises if you do not — you can simply send us an e-mail instead. If you do use the form, your name and e-mail address are mandatory fields: without those two entries the form cannot be submitted, and without them we could not reply to you either. The message and the SME or NGO indication are optional.

Images in the news section

The images accompanying posts in the news section are stored on the same infrastructure as the website and are served from our own server. We do not use an image service or a content delivery network for them. Loading an image therefore produces only the same server log entry as loading the page itself; nothing is transmitted to third parties.

No third-party services

This website embeds no external services whatsoever. When you open a page, your browser connects only to our own server. Your IP address is therefore not transmitted to any third party. In detail:

• All fonts and all JavaScript libraries in use (HTMX and Alpine.js) are stored on our own server — no Google Fonts, no font CDN, no script CDN.
• The map of Austria on the geodata page is a vector graphic embedded directly in the page. There is no map service and no tile server that could see your request.
• No web analytics, no tag manager, no tracking pixels, no advertising networks, no retargeting.
• No embedded videos, maps, calendars or other iframes, and no social media plugins, like or share buttons.

These statements describe the position as at 28 July 2026. As soon as an external service is added, we will amend this section and, where required, obtain your consent beforehand.

Recipients and processors

We do not sell data and do not pass it on for advertising purposes. Access is granted only to service providers that are necessary for operating the website, only to the extent necessary and only as processors under Art 28 GDPR: Divio AG for hosting and server operation

Beyond that, we disclose data only where we are legally obliged to do so, for instance to public authorities or courts.

Transfers to third countries

We do not intend to transfer personal data to countries outside the EU and the EEA. We select our service providers so that they process the data within the EU or the EEA. Should a transfer to a third country nevertheless become necessary in future, it will take place only on the basis of an adequacy decision of the European Commission or appropriate safeguards under Art 46 GDPR, in particular the standard contractual clauses; we will amend this section accordingly. You may request a copy of those safeguards from us.

Retention periods

We store personal data only for as long as is necessary for the relevant purpose or for as long as statutory retention obligations require. The data is deleted afterwards.

• Server log files: 3 yers.
• Contact enquiries: 1 year
• Cookies: the duration stated for each cookie in the cookie policy. Your cookie decision is stored for six months and then requested again.
• Business correspondence of tax relevance: seven years under section 132 of the Austrian Federal Fiscal Code (BAO).

Your rights

You have the following rights in respect of your personal data:

• Access (Art 15 GDPR): you can find out whether and what data we process about you and request a copy of it.
• Rectification, erasure and restriction (Art 16, 17 and 18 GDPR): we must correct inaccurate data and complete incomplete data; at your request we delete your data, unless a retention obligation prevents it, or restrict the processing instead of deleting.
• Data portability (Art 20 GDPR): you receive the data you have provided to us in a structured, commonly used and machine-readable format.
• Objection (Art 21 GDPR): you can object to processing that we base on a legitimate interest — see the highlighted paragraph below.
• Withdrawal of consent (Art 7(3) GDPR): you can withdraw consent at any time with effect for the future; the lawfulness of processing carried out up to that point is unaffected. At present we do not base any processing on consent. You can reset your stored cookie decision via the Change cookie settings item in the footer — on every page, with one click.

An informal message to office@kachelbunt.at is enough to exercise any of these rights. We normally reply within one month (Art 12(3) GDPR). Where we have reasonable doubts about your identity, we may request additional information to confirm it (Art 12(6) GDPR). Exercising your rights is free of charge for you.

Complaint to the supervisory authority

If you believe that we are not processing your data lawfully, you can lodge a complaint with the supervisory authority. The competent authority is the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, e-mail dsb@dsb.gv.at, web www.dsb.gv.at.

Regardless of that, feel free to come to us first. That is usually the faster route, and we take every piece of feedback seriously.

No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art 22(1) and (4) GDPR. No evaluation of you as a person, no analysis of your behaviour on this website and no creation of usage profiles takes place.

Version of this notice

Version: 28 July 2026. We update this notice as soon as the processing actually changes — in particular when the contact form starts delivering enquiries or an external service is added. The version currently in force is always available on this page.