Privacy

Privacy policy

1. Controller

Horst Obernhofer
Vierthalerstr. 17/8
4020 Linz, Austria
Email: horst.obernhofer@gmail.com
Phone: +43 664 1970719

No data protection officer has been appointed. The processing carried out for this website does not meet the criteria requiring an appointment under Article 37 GDPR.

2. Hosting and server logs

The website is hosted by easyname GmbH, Canettistraße 5/10, 1100 Vienna, Austria. The hosting provider processes data required to deliver and protect the website. This can include IP address, requested URL, date and time, referrer, browser information, operating system and technical error data.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are reliable delivery, error analysis and protection against misuse. Log data is retained according to the provider's operational security periods and then deleted or anonymised. Data required to investigate a specific security incident may be retained until that incident and related legal claims have been resolved. easyname privacy information.

3. Language selection and local resources

Fonts and icons are delivered from the website's own server. No connection to Google Fonts or an external icon service is established. After an active language selection, the necessary cookie hf_lang stores the value de or en for one year. Its sole purpose is to display the explicitly selected language. The legal basis is Article 6(1)(f) GDPR and the exception for a service expressly requested by the user under Section 165(3) TKG 2021.

This website currently uses no visitor analytics, advertising tracking or embedded YouTube player. It therefore does not ask for analytics or marketing consent and does not display a consent banner. WordPress authentication cookies are only used in the non-public administration area after login.

The visitor-controlled layout preference is stored locally in the browser under hf_layout_preference using localStorage. It contains only the selected layout, is not transmitted to the server and remains until the visitor clears browser storage or changes it.

4. Contact and booking form

The form can process name, email address, optional phone number, enquiry type, message and, for booking enquiries, event date, location, event type, number of guests and budget. The submission time is stored for organisation. The entries are kept in the protected WordPress administration area. Notification emails contain no form content or visitor contact details.

Booking and contract-related enquiries are processed under Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR. The legitimate interest is direct and efficient communication. Abuse protection is also based on Article 6(1)(f) GDPR. HMAC-derived rate-limit values based on the IP address are kept only for the applicable short window: five minutes for the contact form, 60 seconds for newsletter requests and ten minutes for audience-wall submissions. The complete IP address is not stored with the enquiry.

Name, email address and message are required to process and answer an enquiry; phone number and booking details are optional unless needed for the requested booking. If required fields are not provided, the enquiry cannot be processed. The applicable legal basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for other enquiries.

Form entries are permanently deleted no later than 24 months after the later of the last update or the stated event date. Records that must be retained under tax, accounting or other statutory obligations are kept separately for the applicable statutory period.

5. Direct contact by email

If you contact me directly by email, the message is delivered to a Gmail mailbox. The service provider for users in the EEA is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Email content and metadata are processed to receive and answer the message. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for other correspondence.

Google operates servers worldwide, so processing outside the EEA is possible. Google states that it relies on adequacy decisions, the EU-US Data Privacy Framework and standard contractual clauses where required. See the Google Privacy Policy and Google's data transfer frameworks. Correspondence is deleted when it is no longer required for the enquiry, unless statutory retention or the establishment, exercise or defence of legal claims requires longer storage.

6. Newsletter

Newsletter registration processes the email address, registration and consent timestamps, consent text version and text hash, language, source, confirmation token, unsubscribe token, status and, where applicable, unsubscribe time. The pending record and confirmation message are processed only to complete the requested double opt-in; the newsletter becomes active only after confirmation. The legal basis for the newsletter is consent under Article 6(1)(a) GDPR and the prior-consent requirement for electronic direct advertising under Section 174(3) TKG 2021.

Unconfirmed registrations are deleted after seven days. Confirmed registrations are retained until consent is withdrawn. After unsubscription, the record is deleted or retained in blocked form for no longer than three years to demonstrate the former consent. Every newsletter contains an unsubscribe link. Delivery necessarily involves the server mail infrastructure and the email provider selected by the recipient.

7. Audience wall submissions

A submission can contain a display name, optional location, testimonial text and optional email address. Submission time and IP address are recorded for moderation and abuse prevention. Nothing is published automatically.

Publication of the display name, location and testimonial is based on consent under Article 6(1)(a) GDPR. Moderation, IP processing and protection against misuse are based on Article 6(1)(f) GDPR. The consent record stores the consent version, language, timestamp, source and a hash of the displayed wording so that the publication consent can be demonstrated. The privacy information is linked directly in the submission form. Unpublished submissions are permanently deleted after no more than 90 days. For published submissions, the internal email address and IP address are deleted no later than 90 days after publication. Published content remains visible until consent is withdrawn or the audience wall is discontinued.

Consent can be withdrawn at any time by email. The affected submission will then be removed unless a legal obligation requires temporary continued storage.

8. Recipients and transfers

Website and form data can be accessed by the hosting provider to the extent technically necessary. Direct email correspondence is processed through Google as described above. Newsletter delivery also reaches the provider chosen by each recipient. No other disclosure takes place unless required by law or necessary for the establishment, exercise or defence of legal claims.

9. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, data portability and objection. Consent can be withdrawn at any time with effect for the future. You can send a request to horst.obernhofer@gmail.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority.

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at
Website: dsb.gv.at

10. Automated decisions and security

No automated decision-making or profiling within the meaning of Article 22 GDPR takes place. Data is transmitted using TLS when the production website is accessed over HTTPS. Administrative access is restricted to authorised users.

Last updated: 19 August 2026